diff options
Diffstat (limited to 'identity/aidl/default/IdentityCredential.cpp')
| -rw-r--r-- | identity/aidl/default/IdentityCredential.cpp | 46 |
1 files changed, 12 insertions, 34 deletions
diff --git a/identity/aidl/default/IdentityCredential.cpp b/identity/aidl/default/IdentityCredential.cpp index 87d9a935de..dfcd4f557f 100644 --- a/identity/aidl/default/IdentityCredential.cpp +++ b/identity/aidl/default/IdentityCredential.cpp @@ -272,6 +272,7 @@ ndk::ScopedAStatus IdentityCredential::startRetrieval( const HardwareAuthToken& authToken, const vector<uint8_t>& itemsRequest, const vector<uint8_t>& signingKeyBlob, const vector<uint8_t>& sessionTranscript, const vector<uint8_t>& readerSignature, const vector<int32_t>& requestCounts) { + std::unique_ptr<cppbor::Item> sessionTranscriptItem; if (sessionTranscript.size() > 0) { auto [item, _, message] = cppbor::parse(sessionTranscript); if (item == nullptr) { @@ -279,7 +280,7 @@ ndk::ScopedAStatus IdentityCredential::startRetrieval( IIdentityCredentialStore::STATUS_INVALID_DATA, "SessionTranscript contains invalid CBOR")); } - sessionTranscriptItem_ = std::move(item); + sessionTranscriptItem = std::move(item); } if (numStartRetrievalCalls_ > 0) { if (sessionTranscript_ != sessionTranscript) { @@ -319,7 +320,7 @@ ndk::ScopedAStatus IdentityCredential::startRetrieval( vector<uint8_t> encodedReaderAuthentication = cppbor::Array() .add("ReaderAuthentication") - .add(sessionTranscriptItem_->clone()) + .add(std::move(sessionTranscriptItem)) .add(cppbor::Semantic(24, itemsRequestBytes)) .encode(); vector<uint8_t> encodedReaderAuthenticationBytes = @@ -776,13 +777,6 @@ ndk::ScopedAStatus IdentityCredential::finishRetrieval(vector<uint8_t>* outMac, optional<vector<uint8_t>> mac; if (signingKeyBlob_.size() > 0 && sessionTranscript_.size() > 0 && readerPublicKey_.size() > 0) { - cppbor::Array array; - array.add("DeviceAuthentication"); - array.add(sessionTranscriptItem_->clone()); - array.add(docType_); - array.add(cppbor::Semantic(24, encodedDeviceNameSpaces)); - vector<uint8_t> deviceAuthenticationBytes = cppbor::Semantic(24, array.encode()).encode(); - vector<uint8_t> docTypeAsBlob(docType_.begin(), docType_.end()); optional<vector<uint8_t>> signingKey = support::decryptAes128Gcm(storageKey_, signingKeyBlob_, docTypeAsBlob); @@ -792,31 +786,15 @@ ndk::ScopedAStatus IdentityCredential::finishRetrieval(vector<uint8_t>* outMac, "Error decrypting signingKeyBlob")); } - optional<vector<uint8_t>> sharedSecret = - support::ecdh(readerPublicKey_, signingKey.value()); - if (!sharedSecret) { - return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage( - IIdentityCredentialStore::STATUS_FAILED, "Error doing ECDH")); - } - - // Mix-in SessionTranscriptBytes vector<uint8_t> sessionTranscriptBytes = cppbor::Semantic(24, sessionTranscript_).encode(); - vector<uint8_t> sharedSecretWithSessionTranscriptBytes = sharedSecret.value(); - std::copy(sessionTranscriptBytes.begin(), sessionTranscriptBytes.end(), - std::back_inserter(sharedSecretWithSessionTranscriptBytes)); - - vector<uint8_t> salt = {0x00}; - vector<uint8_t> info = {}; - optional<vector<uint8_t>> derivedKey = - support::hkdf(sharedSecretWithSessionTranscriptBytes, salt, info, 32); - if (!derivedKey) { + optional<vector<uint8_t>> eMacKey = + support::calcEMacKey(signingKey.value(), readerPublicKey_, sessionTranscriptBytes); + if (!eMacKey) { return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage( - IIdentityCredentialStore::STATUS_FAILED, - "Error deriving key from shared secret")); + IIdentityCredentialStore::STATUS_FAILED, "Error calculating EMacKey")); } - - mac = support::coseMac0(derivedKey.value(), {}, // payload - deviceAuthenticationBytes); // detached content + mac = support::calcMac(sessionTranscript_, docType_, encodedDeviceNameSpaces, + eMacKey.value()); if (!mac) { return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage( IIdentityCredentialStore::STATUS_FAILED, "Error MACing data")); @@ -830,9 +808,9 @@ ndk::ScopedAStatus IdentityCredential::finishRetrieval(vector<uint8_t>* outMac, ndk::ScopedAStatus IdentityCredential::generateSigningKeyPair( vector<uint8_t>* outSigningKeyBlob, Certificate* outSigningKeyCertificate) { - string serialDecimal = "0"; // TODO: set serial to something unique - string issuer = "Android Open Source Project"; - string subject = "Android IdentityCredential Reference Implementation"; + string serialDecimal = "1"; + string issuer = "Android Identity Credential Key"; + string subject = "Android Identity Credential Authentication Key"; time_t validityNotBefore = time(nullptr); time_t validityNotAfter = validityNotBefore + 365 * 24 * 3600; |