summaryrefslogtreecommitdiff
path: root/security/keymint/aidl/vts/functional/KeyMintTest.cpp
AgeCommit message (Collapse)Author
2021-10-29KeyMint VTS: check INCLUDE_UNIQUE_ID worksDavid Drysdale
Bug: 202487002 Test: atest VtsAidlKeyMintTargetTest (on CF, O6) Change-Id: I8bc674b47549aa1133f816c510289774db752e04
2021-10-14Merge "KeyMint VTS: improve ATTESTATION_ID_ tests" am: f46b2d5402 am: ↵David Drysdale
0ce446e730 am: c39a694e01 am: 3867a0d821 am: 88f4b59923 Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1853954 Change-Id: I081f3feb529a259ddcb8fdb4cbbdbe65667ae810
2021-10-14Merge "KeyMint VTS: improve ATTESTATION_ID_ tests"David Drysdale
2021-10-14KeyMint VTS: improve ATTESTATION_ID_ testsDavid Drysdale
Existing comment is incorrect: the ATTESTATION_ID_* values that the test provided are rejected because they do not match the device values, not because the tags are specific to device-unique attestation. Fix the test comment (and make the values more obviously wrong), and add a separate test that includes correct values of ATTESTATION_ID_* values. Test: VtsAidlKeyMintTargetTest Change-Id: I5c5f5ef6a228990c9e46f90727e0f135dfc2c528
2021-10-14Merge "KeyMint VTS: use GTEST_SKIP for optional fn" am: c8520ad895 am: ↵David Drysdale
dfce78b011 am: 61180078f2 am: 4ceb5911a3 am: f76f261862 Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1853955 Change-Id: Id3b3d344e9648c7c4d884f82dafe68927df1c602
2021-10-13Merge "Keymint: Update ClearOperationsTest.TooManyOperations parameter"TreeHugger Robot
2021-10-13Keymint: Update ClearOperationsTest.TooManyOperations parameterTommy Chiu
Keymint is not supposed to support public key operations. Update the parameter to reflect that. Bug: 202928979 Test: VtsAidlKeyMintTargetTest Change-Id: Id746953f5c68be6730beb3a7340e075ef28039c2
2021-10-12KeyMint VTS: use GTEST_SKIP for optional fnDavid Drysdale
When a KeyMint VTS exercises optional functionality, where possible use GTEST_SKIP() when that functionality is absent, so the test summary includes information about what is present and what isn't. This should not affect the overall test result. Test: VtsAidlKeyMintTargetTest Change-Id: I62d244d2e4ecc67737906009575e64b50450d4c4
2021-10-05Merge "KeyMint VTS: enable patchlevel checks" am: 8fb4a1c82e am: 22a5ccd132 ↵David Drysdale
am: a9bedb53da am: 3d6cd17f1b am: 70da8310a1 Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1840175 Change-Id: Ie9893cc4775fe860e6833032b23359181d9ef4c2
2021-10-05Merge "Add EncryptionOperationsTest.AesCbcZeroInputSuccess"TreeHugger Robot
2021-09-29Add EncryptionOperationsTest.AesCbcZeroInputSuccessTommy Chiu
Check if the zero input data with AES-CBC-[NONE|PKCS7] padding mode generates correct output data and length. Bug: 200553873 Test: VtsHalKeymasterV4_0TargetTest, VtsAidlKeyMintTargetTest Change-Id: I729c2bad65e9d8b194422032346e5ee3c4b0dce5
2021-09-27KeyMint VTS: enable patchlevel checksDavid Drysdale
Believe that all KeyMint implementations are now in compliance with the HAL specification and so we can enable the checks that all generated keys include vendor and boot patchlevel. Test: VtsAidlKeyMintTargetTest Change-Id: I99741af308023fe12268e9875e252470fbaaaf9e
2021-09-08Disable KeyMint -> IRemotelyProvisionedComponent test am: 11860f2984David Drysdale
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/15787697 Change-Id: I4ccd90ddad225c6a0b3db4c39f0eca08c985dcb0
2021-09-08Disable KeyMint -> IRemotelyProvisionedComponent testDavid Drysdale
Not required yet. Test: VtsAidlKeyMintTargetTest Bug: 186586864 Change-Id: Ie8fecc4ea4795d7fa4fd6bcf0e6d8013c15f50e5 Merged-In: Ie8fecc4ea4795d7fa4fd6bcf0e6d8013c15f50e5
2021-09-08Disable KeyMint -> IRemotelyProvisionedComponent testDavid Drysdale
Not required yet. Test: VtsAidlKeyMintTargetTest Change-Id: Ie8fecc4ea4795d7fa4fd6bcf0e6d8013c15f50e5 Bug: 186586864
2021-08-19KeyMint VTS: add missing purpose/algoDavid Drysdale
Test was producing an invalid set of parameters in a different way than intended. Bug: 197222749 Test: VtsAidlKeyMintTargetTest Merged-In: I07f706fec81d91e8eee9c0561428142559c54f12 Change-Id: I07f706fec81d91e8eee9c0561428142559c54f12 Ignore-AOSP-First: this is a manual cross-merge
2021-08-19KeyMint VTS: add missing purpose/algoDavid Drysdale
Test was producing an invalid set of parameters in a different way than intended. Bug: 197222749 Test: VtsAidlKeyMintTargetTest Change-Id: I07f706fec81d91e8eee9c0561428142559c54f12
2021-08-12Fix KeyDeletionTest.DeleteAllKeysShawn Willden
Test failed to set default key validity, which caused keygen to fail. Wasn't noticed because this test is typically disarmed. Note: This test will destroy all user data on the device (which is why it is typically disarmed). Bug: 187105270 Test: VtsAidlKeyMintTargetTest --arm_deleteAllKeys Change-Id: I67e317fdfca15c95c6420918948d1416e97de482 Merged-In: I67e317fdfca15c95c6420918948d1416e97de482
2021-07-13Don't fail if TAG_ALLOW_WHILE_ON_BODY is missingSeth Moore
The TAG_ALLOW_WHILE_ON_BODY authorization is not required to be supported, and if it is not supported it's a noop. Don't expect the tag to fail with UNSUPPORTED_TAG on devices that don't support it. Test: VtsAidlKeyMintTargetTest Bug: 192222727 Change-Id: I2e80ca59151e79f595a65cae94ac966b4ba7020d Merged-In: I2e80ca59151e79f595a65cae94ac966b4ba7020d
2021-07-12Don't fail if TAG_ALLOW_WHILE_ON_BODY is missingSeth Moore
The TAG_ALLOW_WHILE_ON_BODY authorization is not required to be supported, and if it is not supported it's a noop. Don't expect the tag to fail with UNSUPPORTED_TAG on devices that don't support it. Test: VtsAidlKeyMintTargetTest Bug: 192222727 Change-Id: I2e80ca59151e79f595a65cae94ac966b4ba7020d
2021-06-24Fix flaky corrupted padding testsSeth Moore
It's possible that corrupted ciphertext decrypts just fine. e.g. the output ends with "0x01". However, the chances of this happening are relatively low (roughly 1/256). Corrupt the ciphertext up to 8 times, ensuring that the likelihood of multiple successful decryptions is so miniscule that it's effectively impossible. Test: Ran *PaddingCorrupted tests 50000 times Change-Id: If40ecd7817819921c020ea9b86ada18c4c77ea55
2021-06-21KeyMint VTS: require curve for ECDSA keysDavid Drysdale
The KeyMint AIDL spec requires that "Tag::EC_CURVE must be provided to generate an ECDSA key". Move the VTS tests to always create ECDSA keys by curve not key size. Bug: 188672564 Test: VtsAidlKeyMintTargetTest Merged-In: I33036387c243b21ab0ecd49221b7e7757598913e Change-Id: I33036387c243b21ab0ecd49221b7e7757598913e Ignore-AOSP-First: already merged in aosp/master
2021-06-21KeyMint VTS: more attestation info testsDavid Drysdale
Try all tags in attestion extension one by one Test: VtsAidlKeyMintTargetTest on CF Bug: 186735514 Merged-In: I63ca8d298d2d16f707f2437ab48aaa69c1d7563d Change-Id: I63ca8d298d2d16f707f2437ab48aaa69c1d7563d Ignore-AOSP-First: already merged in aosp/master
2021-06-18KeyMint VTS: require curve for ECDSA keysDavid Drysdale
The KeyMint AIDL spec requires that "Tag::EC_CURVE must be provided to generate an ECDSA key". Move the VTS tests to always create ECDSA keys by curve not key size. Bug: 188672564 Test: VtsAidlKeyMintTargetTest Change-Id: I33036387c243b21ab0ecd49221b7e7757598913e
2021-06-18KeyMint VTS: more attestation info testsDavid Drysdale
Try all tags in attestion extension one by one Test: VtsAidlKeyMintTargetTest on CF Bug: 186735514 Change-Id: I63ca8d298d2d16f707f2437ab48aaa69c1d7563d
2021-06-08KeyMint VTS: better early boot key testsDavid Drysdale
Add a check that the TAG_EARLY_BOOT_ONLY is included in the returned key characteristics. Bug: 188672564 Test: VtsAidlKeyMintTargetTest Merged-In: I200c61f34888c720c47f6289d79cd21d78436b58 Change-Id: I200c61f34888c720c47f6289d79cd21d78436b58 Ignore-AOSP-First: already merged in aosp/master
2021-06-07KeyMint VTS: test getKeyCharacteristics()David Drysdale
Bug: 186685601 Bug: 188855306 Test: VtsAidlKeyMintTargetTest Merged-In: Icf400533b0ded98b9338f2d782d95d90c7efbff4 Change-Id: Icf400533b0ded98b9338f2d782d95d90c7efbff4 Ignore-AOSP-First: already merged in aosp/master
2021-06-04KeyMint VTS: better early boot key testsDavid Drysdale
Add a check that the TAG_EARLY_BOOT_ONLY is included in the returned key characteristics. Bug: 188672564 Test: VtsAidlKeyMintTargetTest Change-Id: I200c61f34888c720c47f6289d79cd21d78436b58
2021-05-25KeyMint VTS: test getKeyCharacteristics()David Drysdale
Bug: 186685601 Bug: 188855306 Test: VtsAidlKeyMintTargetTest Change-Id: Icf400533b0ded98b9338f2d782d95d90c7efbff4
2021-05-21Merge "KeyMint: improve HAL spec and tests" into sc-devDavid Drysdale
2021-05-21KeyMint: improve HAL spec and testsDavid Drysdale
- clarify & test BIGNUM spec - allow alternative return codes when requesting device unique attestation - use specific error for early boot import failure - test more early boot key scenarios (in post-early-boot mode) Bug: 188672564 Test: VtsAidlKeyMintTargetTest Merged-In: I70a342084a29144aef1ed0ff80fec02cc06ffbc0 Change-Id: I70a342084a29144aef1ed0ff80fec02cc06ffbc0
2021-05-21Merge "KeyMint vts: Correct the EC curve parameter and some return code" ↵TreeHugger Robot
into sc-dev
2021-05-19KeyMint: improve HAL spec and testsDavid Drysdale
- clarify & test BIGNUM spec - allow alternative return codes when requesting device unique attestation - use specific error for early boot import failure - test more early boot key scenarios (in post-early-boot mode) Test: VtsAidlKeyMintTargetTest Change-Id: I70a342084a29144aef1ed0ff80fec02cc06ffbc0
2021-05-18KeyMint vts: Correct the EC curve parameter and some return codeTommy Chiu
Strongbox doens't support p-224. Change the curve to p-256 for better compatibility. Also update the tags to be filtered on the hw-enforcement list. Bug: 186735514 Test: VtsAidlKeyMintTargetTest Change-Id: I3f587c5471ca68b88a565ee9ec2e27d1e9e11b17 Merged-In: Ia8eb4c8e28810de5f37295abd8baed6f01b19a3c
2021-05-17Merge changes I10c4beea,I0efc30f3David Drysdale
* changes: KeyMint VTS: local RSA encryption KeyMint VTS: local asymmetric verification
2021-05-17KeyMint VTS: local RSA encryptionDavid Drysdale
Change RSA encryption (with public key) so it happens locally in the test, rather than by invoking an ENCRYPT operation against KeyMint. - Specify MGF1 digest for OAEP mode as (now) required by AIDL spec. - Drop tests for too-long encryption inputs. - Adjust test comments to reflect decryption-only nature. - Change parameter checking tests to do so on DECRYPT rather than ENCRYPT. Bug: 188385353 Test: VtsAidlKeyMintTargetTest Merged-In: I10c4beea28387eecfd0bc7c5dfd59a1b66fec21e Change-Id: I10c4beea28387eecfd0bc7c5dfd59a1b66fec21e
2021-05-17KeyMint VTS: local asymmetric verificationDavid Drysdale
Change verification of ECDSA and RSA signatures so it happens locally in the test, rather than by invoking a VERIFY operation against KeyMint. Bug: 188385353 Test: VtsAidlKeyMintTargetTest Merged-In: I0efc30f3c96cd70ac636d34718eff53cc23f1480 Change-Id: I0efc30f3c96cd70ac636d34718eff53cc23f1480
2021-05-15Merge "KeyMint vts: Correct the EC curve parameter and some return code"Tommy Chiu
2021-05-12KeyMint VTS: local RSA encryptionDavid Drysdale
Change RSA encryption (with public key) so it happens locally in the test, rather than by invoking an ENCRYPT operation against KeyMint. - Specify MGF1 digest for OAEP mode as (now) required by AIDL spec. - Drop tests for too-long encryption inputs. - Adjust test comments to reflect decryption-only nature. - Change parameter checking tests to do so on DECRYPT rather than ENCRYPT. Test: VtsAidlKeyMintTargetTest Change-Id: I10c4beea28387eecfd0bc7c5dfd59a1b66fec21e
2021-05-12KeyMint vts: Correct the EC curve parameter and some return codeTommy Chiu
Strongbox doens't support p-224. Change the curve to p-256 for better compatibility. Also update the tags to be filtered on the hw-enforcement list. Change-Id: I3f587c5471ca68b88a565ee9ec2e27d1e9e11b17
2021-05-12KeyMint VTS: local asymmetric verificationDavid Drysdale
Change verification of ECDSA and RSA signatures so it happens locally in the test, rather than by invoking a VERIFY operation against KeyMint. Test: VtsAidlKeyMintTargetTest Change-Id: I0efc30f3c96cd70ac636d34718eff53cc23f1480
2021-05-10KeyMint VTS: fix 3DES key sizesDavid Drysdale
DES key size is 7/8 of what's provided. Test: VtsAidlKeyMintTargetTest Change-Id: I645c1df11646d129a9421630cb6e5ed86edb8899
2021-05-05KeyMint VTS: symmetric import test with bad keylenDavid Drysdale
Test: VtsAidlKeyMintTargetTest Change-Id: I32ad8ad2ca2b18d3279ebe77ba63b34457ab888d
2021-05-05Merge "vts: Correct the parameters on strongbox"Tommy Chiu
2021-05-04vts: Correct the parameters on strongboxTommy Chiu
If GenerateKey() with user-provide key_blob, it needs to be specified in the following begin() operations as well. Update the test case just to take key_blob from private member instead of creating a local one. Note: - Remove redudent TAG_NO_AUTH_REQUIRED in DeviceUniqueAttestationTest Change-Id: I81860294e1e7e01a57e66e08e75507a8292ec0c3
2021-04-30More KeyMint VTS testcasesDavid Drysdale
Tests for: - non-prime RSA exponent (fails with CF KeyMint) - RSA exponent value of 3 - key size > 512 for `STRONGBOX` - unknown tag inclusion - CBC input size not block size multiple - challenge omitted for attestation (fails with CF KeyMint) - import RSA key with implicit params - vestigial upgradeKey test - importWrappedKey errors - importWrappedKey sids ignored - duplicate/missing params on begin() - more tests for incompatible params on begin() - HMAC size not multiple of 8 (fails with CF KeyMint) - wrong size caller IV for 3DES rejected - too large MIN_MAC_LENGTH for HMAC - invalid AES-GCM minimum MAC length values - check failed updateAad() cancels operation - check that auto-generated nonces are distinct - (DISABLED_) invoke destroyAttestationIds() - omitting optional RSA keygen tags Also add commenting to illustrate the ASN.1 structure of hex data. Test: VtsKeyMintAidlTargetTest Change-Id: I4663c42671cbb094ffe8d603e0352ffa9f1dbf2e
2021-04-30Test for patchlevels and too much entropyDavid Drysdale
Add tests for: - Too much entropy should be rejected with INVALID_INPUT_LENGTH - All authorization lists should include a vendor and boot patchlevel. These requirements are in both the KeyMint and the KeyMaster 4.0 AIDL specificications, but have never been policed before. Currently disabled with a command-line flag because CF does not have the patchlevels and so fails lots of tests. Test: VtsKeyMintAidlTargetTest Change-Id: Ic9622ef3f1b80e013a34059218e3e029f392eb72
2021-04-30Add more symmetric KeyMint testsDavid Drysdale
Also fix some test name comments along the way. Test: VtsKeyMintAidlTargetTest Change-Id: I828acfaa676e1b9fa2e3c6f184f9dafb936b0e82
2021-04-27Merge "Align KeyMint AIDL with usage"David Drysdale
2021-04-22Added vts tests for certificate subject and serial for variousSelene Huang
algorithms and self sign or non-self sign certificates. Test: atest VtsAidlKeyMintTargetTest Change-Id: I4e9d8db7be500f165c3a9f240ea2dfe00c2a70d1
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-03 15:04:45 +0000