summaryrefslogtreecommitdiff
path: root/identity/support/include
AgeCommit message (Collapse)Author
2022-02-23Export extractDerSubjectFromCertificate() utility API for oem Hal usageJoseph Jang
mDL oem Hal may need X509 utility API to extract subject name from certificate. Bug: 218613398 Change-Id: I6316dfb3f1c50394af2d3d35c95d616bd6a2106b
2022-02-09Fix cert-dcl16-c warningsChih-Hung Hsieh
Bug: 120614316 Test: make tidy-hardware-interfaces_subset Change-Id: I6bbeddb9990e4771155ec7d49a68f0e161789030
2022-01-25Revert^2 "Refactor IC support for RKP"Seth Moore
201e6abbd0999ea4afb7e9ef825fc12af359f999 Change-Id: I52171d7d5253b415cdcdfcf09061629e9a20ee1a
2022-01-25Revert "Refactor IC support for RKP"Seth Moore
Revert "Add dependency on keymint cpp lib" Revert "Allow default identity service to call keymint" Revert submission 1956689-add rkp to identity-default Reason for revert: Broke git-master. Will resubmit later. Reverted Changes: I96dcf3027:Add remote key provisioning to the IC HAL Id686ac33a:Add dependency on keymint cpp lib Ib368a2a00:Log to logd in the default identity service I7d2906de0:Refactor IC support for RKP Iae0f14f1c:Fix formatting of identity credential aidl I01d086a4b:Allow default identity service to call keymint Change-Id: I0bbce79b86e1bbbc2526288072289478744d7613
2022-01-24Refactor IC support for RKPSeth Moore
Remote key provisioning means that attestation keys and certs are passed in, and not pulled directly from the factory-provisioned data. In anticipation of RKP support, parameterize/refactor some existing functions so that we can pass keys to them. Also new extern functions for generating an RKP-attested key as well as keypair/cert for testing. Test: VtsHalIdentityTargetTest Bug: 194696876 Change-Id: I7d2906de04835906682455952ebe238c3fa57321
2021-01-23Identity Credential changes for Android 12David Zeuthen
- Add IIdentityCredential.deleteCredentialWithChallenge() - Deprecate IIdentityCredential.deleteCredential() - Add IIdentityCredential.proveOwership() - Add IIdentityCredential.updateCredential() - Add ProofOfBinding CBOR to AuthenticationKey X.509 certificate - Document which API versions new methods/features appeared in. - Mention need to declare android.hardware.identity_credential system feature (w/ feature version number) and do this for the default implementation. Bug: 170146643 Test: atest VtsHalIdentityTargetTest Change-Id: Ib47c7caa5f3d6fff6919f019eee44a735dba9cf8
2020-11-17identity: Fix attestation and documentation problems.David Zeuthen
- The docs said that IdentityCredential.createEphemeralKey() returned data encoded PKCS#8 which is wrong. It's supposed to be in DER format which is also what the VTS tests and credstore expects. - Clarify that createEphemeralKeyPair(), setReaderEphemeralPublicKey(), and createAuthChallenge() are all optional. - Avoid passing an invalid profile ID in the IdentityCredentialTests. verifyOneProfileAndEntryPass test. - Update requirements for which tags must be present in the attestation for CredentialKey as well as the requirements on expiration date and the issuer name. Update default implementation to satisfy these requirements. Update VTS tests to carefully verify these requrements are met. - Clarify requirements for X.509 cert for AuthenticationKey. Add VTS test to verify. - Mandate that TAG_IDENTITY_CREDENTIAL_KEY must not be set for test credentials. Add VTS test to verify this. - Make default implementation pretend to be implemented in a trusted environment and streamline VTS tests to not special-case for the default implementation. - Switch to using the attestation extension parser from the KM 4.1 support library instead of the one from system/keymaster. The latter one did not support the latest attestation extension and thus would fail for pretty much anything that wasn't the default HAL impl. - Fix a couple of bugs in keymaster::V4_1::parse_attestation_record(): - Report root_of_trust.security_level - Add support for Tag::IDENTITY_CREDENTIAL_KEY - Fix how EMacKey is calculated. - Add test vectors to verify how EMacKey and DeviceMac is calculated. Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Bug: 171745570 Change-Id: I2f8bd772de078556733f769cec2021918d1d7de6
2020-06-16Identity Credential: Add some support functions for mDL oem Hal.josephjang
Add following crypto APIs to for mDL oem Hal. ecPrivateKeyToKeyPair() signEcDsaDigest() certificateSignedByPublicKey() coseSignEcDsaWithSignature() ecdsaSignatureDerToCose() ecdsaSignatureCoseToDer() coseSignGetSignature() coseSignGetAlg() coseMacWithDigest() certificateFindPublicKey() certificateTbsCertificate() certificateFindSignature() createAttestationForEcPublicKey() Bug: 136506289 Test: atest VtsHalIdentityTargetTest Change-Id: Ib40de4a3ad7e791ff4d82f77292c621653c1a3f3
2020-06-05Update Identity Credential VTS tests.David Zeuthen
These updates are based on input/experiences implementing this HAL. There are no API changes. - Specify that the validity for credentialKey certificate shall be from current time and expire at the same time as the attestation batch certificate. - Require challenge passed to getAttestationCertificate() is non-empty. - Fix bug in VTS tests where the startPersonlization() result was not checked. - Remove verifyStartPersonalizationZero test since it cannot be completed. - Ensure secureUserId is non-zero if user authentication is needed. - Specify format for signingKeyBlob in generateSigningKeyPair() same way we do for credentialData in finishAddingEntries(). - Modify EndToEndTest to decrypt/unpack credentialData to obtain credentialPrivKey and storageKey and do cross-checks on these. - Modify EndToEndTest to decrypt/unpack signingKeyBlob to obtain signingKeyPriv and check it matches the public key in the returned certificate. - Add new VTS tests for user and reader authentication. - Relax unnecessary requirements about SessionTranscript structure - just require it has X and Y of the ephemeral key created earlier. - Allow calls in VTS tests to v2 HAL to fail - this should allow these VTS tests to pass on a compliant v1 HAL. Bug: 156911917 Bug: 158107945 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Merged-In: I11b79dbd57b1830609c70301fea9c99f9e5080cb Change-Id: I93003389012e69c6df23e1bcebeafde8281caf9c
2020-03-09Add attestation certificate generation and identity credential tags.Selene Huang
Bug: 149908474 Test: atest android.security.identity.cts.AttestationTest Test: atest VtsHalIdentityCredentialTargetTest Test: atest android.hardware.identity-support-lib-test Merged-In: I18c5d05d806d4157c9dce42a398cc89421e26907 Change-Id: Ifaffef3606a6398613e33982ff5db81ade1af0b2
2020-02-14Port IdentityCredential HAL to AIDL.David Zeuthen
This includes add a partial types-only HAL for KeyMaster for HardwareAuthToken. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I7a6254d33200bfd62269aed1957cbb2a84b16272
2020-01-15Add Identity Credential HAL, default implementation, and VTS tests.David Zeuthen
IIdentityCredentialStore provides an interface to a secure store for user identity documents. This HAL is deliberately fairly general and abstract. To the extent possible, specification of the message formats and semantics of communication with credential verification devices and issuing authorities (IAs) is out of scope for this HAL. It provides the interface with secure storage but a credential-specific Android application will be required to implement the presentation and verification protocols and processes appropriate for the specific credential type. Bug: 111446262 Test: VtsHalIdentityCredentialTargetTest Test: android.hardware.identity-support-lib-test Test: CtsIdentityTestCases Change-Id: I64eb50114d645dd475012ad1b889d2177aaf1d37
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 19:08:07 +0000