summaryrefslogtreecommitdiff
path: root/identity/support/src
AgeCommit message (Collapse)Author
2022-02-23Export extractDerSubjectFromCertificate() utility API for oem Hal usageJoseph Jang
mDL oem Hal may need X509 utility API to extract subject name from certificate. Bug: 218613398 Change-Id: I6316dfb3f1c50394af2d3d35c95d616bd6a2106b
2022-01-25Revert^2 "Refactor IC support for RKP"Seth Moore
201e6abbd0999ea4afb7e9ef825fc12af359f999 Change-Id: I52171d7d5253b415cdcdfcf09061629e9a20ee1a
2022-01-25Revert "Refactor IC support for RKP"Seth Moore
Revert "Add dependency on keymint cpp lib" Revert "Allow default identity service to call keymint" Revert submission 1956689-add rkp to identity-default Reason for revert: Broke git-master. Will resubmit later. Reverted Changes: I96dcf3027:Add remote key provisioning to the IC HAL Id686ac33a:Add dependency on keymint cpp lib Ib368a2a00:Log to logd in the default identity service I7d2906de0:Refactor IC support for RKP Iae0f14f1c:Fix formatting of identity credential aidl I01d086a4b:Allow default identity service to call keymint Change-Id: I0bbce79b86e1bbbc2526288072289478744d7613
2022-01-24Refactor IC support for RKPSeth Moore
Remote key provisioning means that attestation keys and certs are passed in, and not pulled directly from the factory-provisioned data. In anticipation of RKP support, parameterize/refactor some existing functions so that we can pass keys to them. Also new extern functions for generating an RKP-attested key as well as keypair/cert for testing. Test: VtsHalIdentityTargetTest Bug: 194696876 Change-Id: I7d2906de04835906682455952ebe238c3fa57321
2021-06-01identity: Fix VTS test failure caused by unrelated change to system/keymaster.David Zeuthen
Bug: 189447009 Test: atest VtsHalIdentityTargetTest Test: atest CtsIdentityTestCases Change-Id: I58426f1551efa920909c759cf5e10f44c6cfc5d4
2021-04-09Transitioning identity to external_libcppborMax Bires
This change removes hardware/interfaces/identity's dependency on its own libcppbor copy. The copy can not be fully removed until various vendor dependencies are cleaned up. Superficial changes are made to the VTS tests to match the slightly altered namespace on some of the functions. This migration is a prerequisite for getting the IRemotelyProvisionedComponent functionality into system/keymaster. Without migrating to the same library, the build system runs into issues since there are "two" libcppbor libraries with conflicting namespaces otherwise. Bug: 182445123 Test: atest VtsHalIdentityTargetTest Change-Id: I854ffa31c4adb5a3d1df06539fe66075ccc4625d
2021-02-25follows the advice of -Wsign-compareChristopher Di Bella
Bug: 181177782 Test: None Change-Id: I480e1a35bcac682467d0ff7a97cccfcf78a0a402
2021-02-17Add KeyPurpose::ATTEST_KEY.Shawn Willden
This allows applications to generate their own attestation keys and then use them to attest other application-generated keys. Bug: 171845652 Test: VtsAidlKeyMintTargetTest Change-Id: I32add16dcc2d1b29665a88024610f7bef7e50200
2021-02-11Identity: Fix breakage caused by recent changes in libsoft_attestation_cert.David Zeuthen
CL:1566356 changed the notBefore and notAfter fields in the X.509 attestation certificate returned by generate_attestation_from_EVP(). This broke the default implementation of the Identity Credential HAL. Fixed by setting TAG_CERTIFICATE_NOT_BEFORE and TAG_CERTIFICATE_NOT_AFTER to the expected values. Test: atest VtsHalIdentityTargetTest Bug: 179933300 Change-Id: I2dbca41c1e905c17cd2bc565d2e987945b86273a
2021-01-23Identity Credential changes for Android 12David Zeuthen
- Add IIdentityCredential.deleteCredentialWithChallenge() - Deprecate IIdentityCredential.deleteCredential() - Add IIdentityCredential.proveOwership() - Add IIdentityCredential.updateCredential() - Add ProofOfBinding CBOR to AuthenticationKey X.509 certificate - Document which API versions new methods/features appeared in. - Mention need to declare android.hardware.identity_credential system feature (w/ feature version number) and do this for the default implementation. Bug: 170146643 Test: atest VtsHalIdentityTargetTest Change-Id: Ib47c7caa5f3d6fff6919f019eee44a735dba9cf8
2020-12-22Change KM attestation generation to managed cert type.Shawn Willden
Bug: 171846199 Test: atest VtsHalIdentityTargetTest Change-Id: I03c55f74a21d24b3db8460b85816a4da5939c4ed
2020-11-23Update to support keymaster's configurable version.Shawn Willden
Test: VtsHalIdentityTargetTest Bug: b/173577355 Change-Id: Ia7c1a46edec12047c51ed4888788386dcfe11ca9
2020-11-20identity: Change Identitial Credential to pass in subject bySelene Huang
attestation params instead of making another function in attestation_utils. Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: I67f5f584875a1baefc5a3d1a1fc46d605febbf33
2020-11-17identity: Fix attestation and documentation problems.David Zeuthen
- The docs said that IdentityCredential.createEphemeralKey() returned data encoded PKCS#8 which is wrong. It's supposed to be in DER format which is also what the VTS tests and credstore expects. - Clarify that createEphemeralKeyPair(), setReaderEphemeralPublicKey(), and createAuthChallenge() are all optional. - Avoid passing an invalid profile ID in the IdentityCredentialTests. verifyOneProfileAndEntryPass test. - Update requirements for which tags must be present in the attestation for CredentialKey as well as the requirements on expiration date and the issuer name. Update default implementation to satisfy these requirements. Update VTS tests to carefully verify these requrements are met. - Clarify requirements for X.509 cert for AuthenticationKey. Add VTS test to verify. - Mandate that TAG_IDENTITY_CREDENTIAL_KEY must not be set for test credentials. Add VTS test to verify this. - Make default implementation pretend to be implemented in a trusted environment and streamline VTS tests to not special-case for the default implementation. - Switch to using the attestation extension parser from the KM 4.1 support library instead of the one from system/keymaster. The latter one did not support the latest attestation extension and thus would fail for pretty much anything that wasn't the default HAL impl. - Fix a couple of bugs in keymaster::V4_1::parse_attestation_record(): - Report root_of_trust.security_level - Add support for Tag::IDENTITY_CREDENTIAL_KEY - Fix how EMacKey is calculated. - Add test vectors to verify how EMacKey and DeviceMac is calculated. Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Bug: 171745570 Change-Id: I2f8bd772de078556733f769cec2021918d1d7de6
2020-08-28Merge Android R (rvc-dev-plus-aosp-without-vendor@6692709)Xin Li
Bug: 166295507 Merged-In: I6502829205ede2de914b27e6c2c5c42916af2b39 Change-Id: I7cb06511e43bd1fffd5f80a11dbdf5b1314cfe8e
2020-08-26Avoid unnecessary access of BoringSSL structs.David Benjamin
Checking cert_info->key->algor->algorithm is redundant with the checks following it. If the public key is an EC key, that was the OID. Remove the check so this code does not break when BoringSSL makes the X509 structures opaque in the future. While we're not particularly aiming to make ECDSA_SIG opaque, getters exist, so go ahead and use them. Test: mm, treehugger Change-Id: I1b37fef2290b7697a6e821f20ba702b3da5ef18d
2020-06-16Identity Credential: Add some support functions for mDL oem Hal.josephjang
Add following crypto APIs to for mDL oem Hal. ecPrivateKeyToKeyPair() signEcDsaDigest() certificateSignedByPublicKey() coseSignEcDsaWithSignature() ecdsaSignatureDerToCose() ecdsaSignatureCoseToDer() coseSignGetSignature() coseSignGetAlg() coseMacWithDigest() certificateFindPublicKey() certificateTbsCertificate() certificateFindSignature() createAttestationForEcPublicKey() Bug: 136506289 Test: atest VtsHalIdentityTargetTest Change-Id: Ib40de4a3ad7e791ff4d82f77292c621653c1a3f3
2020-06-05Update Identity Credential VTS tests.David Zeuthen
These updates are based on input/experiences implementing this HAL. There are no API changes. - Specify that the validity for credentialKey certificate shall be from current time and expire at the same time as the attestation batch certificate. - Require challenge passed to getAttestationCertificate() is non-empty. - Fix bug in VTS tests where the startPersonlization() result was not checked. - Remove verifyStartPersonalizationZero test since it cannot be completed. - Ensure secureUserId is non-zero if user authentication is needed. - Specify format for signingKeyBlob in generateSigningKeyPair() same way we do for credentialData in finishAddingEntries(). - Modify EndToEndTest to decrypt/unpack credentialData to obtain credentialPrivKey and storageKey and do cross-checks on these. - Modify EndToEndTest to decrypt/unpack signingKeyBlob to obtain signingKeyPriv and check it matches the public key in the returned certificate. - Add new VTS tests for user and reader authentication. - Relax unnecessary requirements about SessionTranscript structure - just require it has X and Y of the ephemeral key created earlier. - Allow calls in VTS tests to v2 HAL to fail - this should allow these VTS tests to pass on a compliant v1 HAL. Bug: 156911917 Bug: 158107945 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Merged-In: I11b79dbd57b1830609c70301fea9c99f9e5080cb Change-Id: I93003389012e69c6df23e1bcebeafde8281caf9c
2020-06-04Update Identity Credential VTS tests.David Zeuthen
These updates are based on input/experiences implementing this HAL. There are no API changes. - Specify that the validity for credentialKey certificate shall be from current time and expire at the same time as the attestation batch certificate. - Require challenge passed to getAttestationCertificate() is non-empty. - Fix bug in VTS tests where the startPersonlization() result was not checked. - Remove verifyStartPersonalizationZero test since it cannot be completed. - Ensure secureUserId is non-zero if user authentication is needed. - Specify format for signingKeyBlob in generateSigningKeyPair() same way we do for credentialData in finishAddingEntries(). - Modify EndToEndTest to decrypt/unpack credentialData to obtain credentialPrivKey and storageKey and do cross-checks on these. - Modify EndToEndTest to decrypt/unpack signingKeyBlob to obtain signingKeyPriv and check it matches the public key in the returned certificate. - Add new VTS tests for user and reader authentication. - Relax unnecessary requirements about SessionTranscript structure - just require it has X and Y of the ephemeral key created earlier. - Allow calls in VTS tests to v2 HAL to fail - this should allow these VTS tests to pass on a compliant v1 HAL. Bug: 156911917 Bug: 158107945 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: I11b79dbd57b1830609c70301fea9c99f9e5080cb
2020-04-27Fix IC vts bugs and add tests for IC IWritableIdentityCredential.aidl interface.Selene Huang
Fixed following bugs in WritableIdentityCredential.cpp - Do not allow startPersonalization to be called more than once per aidl. - Do not preceed with beginAddEntry if addAccessControlProfile and startPersonalization profile count mismatch. - Verify access control profile ids are unique. - Do not let empty name space to mess up beginAddEntry. - Do not allow beginAddEntry to add entries interleaving namespace groupings. Enforce all entries must be added in namespace "groups" per aidl. - Fix counting error that allowed one entries to be added per name space than startPersonalization limit. - Do not approve finishAddingEntries if there are more profiles or entries to be added than startPersonalization set accounting. - Add testing utilities library for identity credential. - Refactored end to end tests. Bug: 154909726 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Merged-In: I51902681776c6230e49589fc75a8145e79d7d1a6 Change-Id: Ib7c108f67c61125edba6177dcac61cfbf58da671
2020-04-24Fix IC vts bugs and add tests for IC IWritableIdentityCredential.aidl interface.Selene Huang
Fixed following bugs in WritableIdentityCredential.cpp - Do not allow startPersonalization to be called more than once per aidl. - Do not preceed with beginAddEntry if addAccessControlProfile and startPersonalization profile count mismatch. - Verify access control profile ids are unique. - Do not let empty name space to mess up beginAddEntry. - Do not allow beginAddEntry to add entries interleaving namespace groupings. Enforce all entries must be added in namespace "groups" per aidl. - Fix counting error that allowed one entries to be added per name space than startPersonalization limit. - Do not approve finishAddingEntries if there are more profiles or entries to be added than startPersonalization set accounting. - Add testing utilities library for identity credential. - Refactored end to end tests. Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: I51902681776c6230e49589fc75a8145e79d7d1a6
2020-03-09Add attestation certificate generation and identity credential tags.Selene Huang
Bug: 149908474 Test: atest android.security.identity.cts.AttestationTest Test: atest VtsHalIdentityCredentialTargetTest Test: atest android.hardware.identity-support-lib-test Merged-In: I18c5d05d806d4157c9dce42a398cc89421e26907 Change-Id: Ifaffef3606a6398613e33982ff5db81ade1af0b2
2020-02-21Add attestation certificate generation and identity credential tags.Selene Huang
Bug: 149908474 Test: atest android.security.identity.cts.AttestationTest Test: atest VtsHalIdentityCredentialTargetTest Test: atest android.hardware.identity-support-lib-test Change-Id: I18c5d05d806d4157c9dce42a398cc89421e26907
2020-02-14Port IdentityCredential HAL to AIDL.David Zeuthen
This includes add a partial types-only HAL for KeyMaster for HardwareAuthToken. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I7a6254d33200bfd62269aed1957cbb2a84b16272
2020-01-15Add Identity Credential HAL, default implementation, and VTS tests.David Zeuthen
IIdentityCredentialStore provides an interface to a secure store for user identity documents. This HAL is deliberately fairly general and abstract. To the extent possible, specification of the message formats and semantics of communication with credential verification devices and issuing authorities (IAs) is out of scope for this HAL. It provides the interface with secure storage but a credential-specific Android application will be required to implement the presentation and verification protocols and processes appropriate for the specific credential type. Bug: 111446262 Test: VtsHalIdentityCredentialTargetTest Test: android.hardware.identity-support-lib-test Test: CtsIdentityTestCases Change-Id: I64eb50114d645dd475012ad1b889d2177aaf1d37
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 22:37:15 +0000