diff options
Diffstat (limited to 'identity/aidl/default/common/IdentityCredential.cpp')
| -rw-r--r-- | identity/aidl/default/common/IdentityCredential.cpp | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/identity/aidl/default/common/IdentityCredential.cpp b/identity/aidl/default/common/IdentityCredential.cpp index 94779971b1..c8ee0dd67a 100644 --- a/identity/aidl/default/common/IdentityCredential.cpp +++ b/identity/aidl/default/common/IdentityCredential.cpp @@ -253,14 +253,17 @@ ndk::ScopedAStatus IdentityCredential::startRetrieval( } } - // Feed the auth token to secure hardware. - if (!hwProxy_->setAuthToken(authToken.challenge, authToken.userId, authToken.authenticatorId, - int(authToken.authenticatorType), authToken.timestamp.milliSeconds, - authToken.mac, verificationToken_.challenge, - verificationToken_.timestamp.milliSeconds, - int(verificationToken_.securityLevel), verificationToken_.mac)) { - return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage( - IIdentityCredentialStore::STATUS_INVALID_DATA, "Invalid Auth Token")); + // Feed the auth token to secure hardware only if they're valid. + if (authToken.timestamp.milliSeconds != 0) { + if (!hwProxy_->setAuthToken( + authToken.challenge, authToken.userId, authToken.authenticatorId, + int(authToken.authenticatorType), authToken.timestamp.milliSeconds, + authToken.mac, verificationToken_.challenge, + verificationToken_.timestamp.milliSeconds, + int(verificationToken_.securityLevel), verificationToken_.mac)) { + return ndk::ScopedAStatus(AStatus_fromServiceSpecificErrorWithMessage( + IIdentityCredentialStore::STATUS_INVALID_DATA, "Invalid Auth Token")); + } } // We'll be feeding ACPs interleaved with certificates from the reader |