diff options
Diffstat (limited to 'keystore/java')
16 files changed, 367 insertions, 418 deletions
diff --git a/keystore/java/android/security/AndroidKeyStore.java b/keystore/java/android/security/AndroidKeyStore.java index c259c25..ed91d70 100644 --- a/keystore/java/android/security/AndroidKeyStore.java +++ b/keystore/java/android/security/AndroidKeyStore.java @@ -529,27 +529,10 @@ public class AndroidKeyStore extends KeyStoreSpi { KeymasterUtils.getKeymasterPaddingsFromJcaSignaturePaddings( params.getSignaturePaddings())); args.addInts(KeymasterDefs.KM_TAG_PADDING, keymasterPaddings); - if (params.getUserAuthenticators() == 0) { - args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); - } else { - args.addInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, - KeyStoreKeyProperties.UserAuthenticator.allToKeymaster( - params.getUserAuthenticators())); - long secureUserId = GateKeeper.getSecureUserId(); - if (secureUserId == 0) { - throw new IllegalStateException("Secure lock screen must be enabled" - + " to import keys requiring user authentication"); - } - args.addLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, secureUserId); - } - if (params.isInvalidatedOnNewFingerprintEnrolled()) { - // TODO: Add the invalidate on fingerprint enrolled constraint once Keymaster supports - // that. - } - if (params.getUserAuthenticationValidityDurationSeconds() != -1) { - args.addInt(KeymasterDefs.KM_TAG_AUTH_TIMEOUT, - params.getUserAuthenticationValidityDurationSeconds()); - } + KeymasterUtils.addUserAuthArgs(args, + params.getContext(), + params.isUserAuthenticationRequired(), + params.getUserAuthenticationValidityDurationSeconds()); args.addDate(KeymasterDefs.KM_TAG_ACTIVE_DATETIME, (params.getKeyValidityStart() != null) ? params.getKeyValidityStart() : new Date(0)); diff --git a/keystore/java/android/security/GateKeeper.java b/keystore/java/android/security/GateKeeper.java index c9f06e9..5617836 100644 --- a/keystore/java/android/security/GateKeeper.java +++ b/keystore/java/android/security/GateKeeper.java @@ -15,13 +15,17 @@ public abstract class GateKeeper { private GateKeeper() {} public static IGateKeeperService getService() { - return IGateKeeperService.Stub.asInterface( + IGateKeeperService service = IGateKeeperService.Stub.asInterface( ServiceManager.getService("android.service.gatekeeper.IGateKeeperService")); + if (service == null) { + throw new IllegalStateException("Gatekeeper service not available"); + } + return service; } public static long getSecureUserId() throws IllegalStateException { try { - return GateKeeper.getService().getSecureUserId(UserHandle.myUserId()); + return getService().getSecureUserId(UserHandle.myUserId()); } catch (RemoteException e) { throw new IllegalStateException( "Failed to obtain secure user ID from gatekeeper", e); diff --git a/keystore/java/android/security/KeyGeneratorSpec.java b/keystore/java/android/security/KeyGeneratorSpec.java index 7ecc47e..8f135a6 100644 --- a/keystore/java/android/security/KeyGeneratorSpec.java +++ b/keystore/java/android/security/KeyGeneratorSpec.java @@ -51,9 +51,8 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { private final String[] mEncryptionPaddings; private final String[] mBlockModes; private final boolean mRandomizedEncryptionRequired; - private final @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; + private final boolean mUserAuthenticationRequired; private final int mUserAuthenticationValidityDurationSeconds; - private final boolean mInvalidatedOnNewFingerprintEnrolled; private KeyGeneratorSpec( Context context, @@ -67,9 +66,8 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { String[] encryptionPaddings, String[] blockModes, boolean randomizedEncryptionRequired, - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators, - int userAuthenticationValidityDurationSeconds, - boolean invalidatedOnNewFingerprintEnrolled) { + boolean userAuthenticationRequired, + int userAuthenticationValidityDurationSeconds) { if (context == null) { throw new IllegalArgumentException("context == null"); } else if (TextUtils.isEmpty(keyStoreAlias)) { @@ -92,9 +90,8 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(encryptionPaddings)); mBlockModes = ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(blockModes)); mRandomizedEncryptionRequired = randomizedEncryptionRequired; - mUserAuthenticators = userAuthenticators; + mUserAuthenticationRequired = userAuthenticationRequired; mUserAuthenticationValidityDurationSeconds = userAuthenticationValidityDurationSeconds; - mInvalidatedOnNewFingerprintEnrolled = invalidatedOnNewFingerprintEnrolled; } /** @@ -188,18 +185,17 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { } /** - * Gets the set of user authenticators which protect access to this key. The key can only be - * used iff the user has authenticated to at least one of these user authenticators. + * Returns {@code true} if user authentication is required for this key to be used. * - * @return user authenticators or {@code 0} if the key can be used without user authentication. + * @see #getUserAuthenticationValidityDurationSeconds() */ - public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() { - return mUserAuthenticators; + public boolean isUserAuthenticationRequired() { + return mUserAuthenticationRequired; } /** - * Gets the duration of time (seconds) for which this key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * Gets the duration of time (seconds) for which this key can be used after the user is + * successfully authenticated. * * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication * is required for every use of the key. @@ -209,17 +205,6 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { } /** - * Returns {@code true} if this key must be permanently invalidated once a new fingerprint is - * enrolled. This constraint only has effect if fingerprint reader is one of the user - * authenticators protecting access to this key. - * - * @see #getUserAuthenticators() - */ - public boolean isInvalidatedOnNewFingerprintEnrolled() { - return mInvalidatedOnNewFingerprintEnrolled; - } - - /** * Returns {@code true} if the key must be encrypted in the {@link java.security.KeyStore}. */ public boolean isEncryptionRequired() { @@ -238,9 +223,8 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { private String[] mEncryptionPaddings; private String[] mBlockModes; private boolean mRandomizedEncryptionRequired = true; - private @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; + private boolean mUserAuthenticationRequired; private int mUserAuthenticationValidityDurationSeconds = -1; - private boolean mInvalidatedOnNewFingerprintEnrolled; /** * Creates a new instance of the {@code Builder} with the given {@code context}. The @@ -416,32 +400,35 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { } /** - * Sets the user authenticators which protect access to this key. The key can only be used - * iff the user has authenticated to at least one of these user authenticators. + * Sets whether user authentication is required to use this key. * * <p>By default, the key can be used without user authentication. * - * @param userAuthenticators user authenticators or empty list if this key can be accessed - * without user authentication. + * <p>When user authentication is required, the user authorizes the use of the key by + * authenticating to this Android device using a subset of their secure lock screen + * credentials. Different authentication methods are used depending on whether the every + * use of the key must be authenticated (as specified by + * {@link #setUserAuthenticationValidityDurationSeconds(int)}). + * <a href="{@docRoot}training/articles/keystore.html#UserAuthentication">More + * information</a>. * * @see #setUserAuthenticationValidityDurationSeconds(int) */ - public Builder setUserAuthenticators( - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) { - mUserAuthenticators = userAuthenticators; + public Builder setUserAuthenticationRequired(boolean required) { + mUserAuthenticationRequired = required; return this; } /** - * Sets the duration of time (seconds) for which this key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * Sets the duration of time (seconds) for which this key can be used after the user is + * successfully authenticated. This has effect only if user authentication is required. * * <p>By default, the user needs to authenticate for every use of the key. * * @param seconds duration in seconds or {@code 0} if the user needs to authenticate for * every use of the key. * - * @see #setUserAuthenticators(int) + * @see #setUserAuthenticationRequired(boolean) */ public Builder setUserAuthenticationValidityDurationSeconds(int seconds) { mUserAuthenticationValidityDurationSeconds = seconds; @@ -449,20 +436,6 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { } /** - * Sets whether this key must be invalidated (permanently) once a new fingerprint is - * enrolled. This only has effect if fingerprint reader is one of the user authenticators - * protecting access to the key. - * - * <p>By default, enrolling a new fingerprint does not invalidate the key. - * - * @see #setUserAuthenticators(Set) - */ - public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) { - mInvalidatedOnNewFingerprintEnrolled = invalidated; - return this; - } - - /** * Builds a new instance instance of {@code KeyGeneratorSpec}. * * @throws IllegalArgumentException if a required field is missing or violates a constraint. @@ -479,9 +452,8 @@ public class KeyGeneratorSpec implements AlgorithmParameterSpec { mEncryptionPaddings, mBlockModes, mRandomizedEncryptionRequired, - mUserAuthenticators, - mUserAuthenticationValidityDurationSeconds, - mInvalidatedOnNewFingerprintEnrolled); + mUserAuthenticationRequired, + mUserAuthenticationValidityDurationSeconds); } } } diff --git a/keystore/java/android/security/KeyPairGeneratorSpec.java b/keystore/java/android/security/KeyPairGeneratorSpec.java index 5e5cf37..d6d3789 100644 --- a/keystore/java/android/security/KeyPairGeneratorSpec.java +++ b/keystore/java/android/security/KeyPairGeneratorSpec.java @@ -95,12 +95,10 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { private final boolean mRandomizedEncryptionRequired; - private final @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; + private final boolean mUserAuthenticationRequired; private final int mUserAuthenticationValidityDurationSeconds; - private final boolean mInvalidatedOnNewFingerprintEnrolled; - /** * Parameter specification for the "{@code AndroidKeyPairGenerator}" * instance of the {@link java.security.KeyPairGenerator} API. The @@ -145,9 +143,8 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { String[] signaturePaddings, String[] blockModes, boolean randomizedEncryptionRequired, - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators, - int userAuthenticationValidityDurationSeconds, - boolean invalidatedOnNewFingerprintEnrolled) { + boolean userAuthenticationRequired, + int userAuthenticationValidityDurationSeconds) { if (context == null) { throw new IllegalArgumentException("context == null"); } else if (TextUtils.isEmpty(keyStoreAlias)) { @@ -195,9 +192,8 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { mSignaturePaddings = ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(signaturePaddings)); mBlockModes = ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(blockModes)); mRandomizedEncryptionRequired = randomizedEncryptionRequired; - mUserAuthenticators = userAuthenticators; + mUserAuthenticationRequired = userAuthenticationRequired; mUserAuthenticationValidityDurationSeconds = userAuthenticationValidityDurationSeconds; - mInvalidatedOnNewFingerprintEnrolled = invalidatedOnNewFingerprintEnrolled; } /** @@ -227,9 +223,8 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { null, // signature paddings null, // block modes false, // randomized encryption required - 0, // user authenticators - -1, // user authentication validity duration (seconds) - false // invalidate on new fingerprint enrolled + false, // user authentication required + -1 // user authentication validity duration (seconds) ); } @@ -396,44 +391,34 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { } /** - * Gets the set of user authenticators which protect access to the private key. The key can only - * be used iff the user has authenticated to at least one of these user authenticators. + * Returns {@code true} if user authentication is required for this key to be used. * * <p>This restriction applies only to private key operations. Public key operations are not * restricted. * - * @return user authenticators or {@code 0} if the key can be used without user authentication. + * @see #getUserAuthenticationValidityDurationSeconds() */ - public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() { - return mUserAuthenticators; + public boolean isUserAuthenticationRequired() { + return mUserAuthenticationRequired; } /** * Gets the duration of time (seconds) for which the private key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * is successfully authenticated. * * <p>This restriction applies only to private key operations. Public key operations are not * restricted. * * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication * is required for every use of the key. + * + * @see #isUserAuthenticationRequired() */ public int getUserAuthenticationValidityDurationSeconds() { return mUserAuthenticationValidityDurationSeconds; } /** - * Returns {@code true} if this key must be permanently invalidated once a new fingerprint is - * enrolled. This constraint only has effect if fingerprint reader is one of the user - * authenticators protecting access to this key. - * - * @see #getUserAuthenticators() - */ - public boolean isInvalidatedOnNewFingerprintEnrolled() { - return mInvalidatedOnNewFingerprintEnrolled; - } - - /** * Builder class for {@link KeyPairGeneratorSpec} objects. * <p> * This will build a parameter spec for use with the <a href="{@docRoot} @@ -493,12 +478,10 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { private boolean mRandomizedEncryptionRequired = true; - private @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; + private boolean mUserAuthenticationRequired; private int mUserAuthenticationValidityDurationSeconds = -1; - private boolean mInvalidatedOnNewFingerprintEnrolled; - /** * Creates a new instance of the {@code Builder} with the given * {@code context}. The {@code context} passed in may be used to pop up @@ -774,28 +757,31 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { } /** - * Sets the user authenticators which protect access to this key. The key can only be used - * iff the user has authenticated to at least one of these user authenticators. + * Sets whether user authentication is required to use this key. * * <p>By default, the key can be used without user authentication. * + * <p>When user authentication is required, the user authorizes the use of the key by + * authenticating to this Android device using a subset of their secure lock screen + * credentials. Different authentication methods are used depending on whether the every + * use of the key must be authenticated (as specified by + * {@link #setUserAuthenticationValidityDurationSeconds(int)}). + * <a href="{@docRoot}training/articles/keystore.html#UserAuthentication">More + * information</a>. + * * <p>This restriction applies only to private key operations. Public key operations are not * restricted. * - * @param userAuthenticators user authenticators or {@code 0} if this key can be accessed - * without user authentication. - * * @see #setUserAuthenticationValidityDurationSeconds(int) */ - public Builder setUserAuthenticators( - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) { - mUserAuthenticators = userAuthenticators; + public Builder setUserAuthenticationRequired(boolean required) { + mUserAuthenticationRequired = required; return this; } /** - * Sets the duration of time (seconds) for which this key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * Sets the duration of time (seconds) for which this key can be used after the user is + * successfully authenticated. This has effect only if user authentication is required. * * <p>By default, the user needs to authenticate for every use of the key. * @@ -805,7 +791,7 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { * @param seconds duration in seconds or {@code 0} if the user needs to authenticate for * every use of the key. * - * @see #setUserAuthenticators(int) + * @see #setUserAuthenticationRequired(boolean) */ public Builder setUserAuthenticationValidityDurationSeconds(int seconds) { mUserAuthenticationValidityDurationSeconds = seconds; @@ -813,20 +799,6 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { } /** - * Sets whether this key must be invalidated (permanently) once a new fingerprint is - * enrolled. This only has effect if fingerprint reader is one of the user authenticators - * protecting access to the key. - * - * <p>By default, enrolling a new fingerprint does not invalidate the key. - * - * @see #setUserAuthenticators(Set) - */ - public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) { - mInvalidatedOnNewFingerprintEnrolled = invalidated; - return this; - } - - /** * Builds the instance of the {@code KeyPairGeneratorSpec}. * * @throws IllegalArgumentException if a required field is missing @@ -852,9 +824,8 @@ public final class KeyPairGeneratorSpec implements AlgorithmParameterSpec { mSignaturePaddings, mBlockModes, mRandomizedEncryptionRequired, - mUserAuthenticators, - mUserAuthenticationValidityDurationSeconds, - mInvalidatedOnNewFingerprintEnrolled); + mUserAuthenticationRequired, + mUserAuthenticationValidityDurationSeconds); } } } diff --git a/keystore/java/android/security/KeyPermanentlyInvalidatedException.java b/keystore/java/android/security/KeyPermanentlyInvalidatedException.java new file mode 100644 index 0000000..229eab0 --- /dev/null +++ b/keystore/java/android/security/KeyPermanentlyInvalidatedException.java @@ -0,0 +1,55 @@ +/* + * Copyright (C) 2015 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package android.security; + +import java.security.InvalidKeyException; + +/** + * Indicates that the key can no longer be used because it has been permanently invalidated. + * + * <p>This can currently occur only for keys that require user authentication. Such keys are + * permanently invalidated once the secure lock screen is disabled (i.e., reconfigured to None, + * Swipe or other mode which does not authenticate the user) or when the secure lock screen is + * forcibly reset (e.g., by Device Admin). Additionally, keys configured to require user + * authentication for every use of the key are also permanently invalidated once a new fingerprint + * is enrolled or once no more fingerprints are enrolled. + */ +public class KeyPermanentlyInvalidatedException extends InvalidKeyException { + + /** + * Constructs a new {@code KeyPermanentlyInvalidatedException} without detail message and cause. + */ + public KeyPermanentlyInvalidatedException() { + super("Key permanently invalidated"); + } + + /** + * Constructs a new {@code KeyPermanentlyInvalidatedException} with the provided detail message + * and no cause. + */ + public KeyPermanentlyInvalidatedException(String message) { + super(message); + } + + /** + * Constructs a new {@code KeyPermanentlyInvalidatedException} with the provided detail message + * and cause. + */ + public KeyPermanentlyInvalidatedException(String message, Throwable cause) { + super(message, cause); + } +} diff --git a/keystore/java/android/security/KeyStore.java b/keystore/java/android/security/KeyStore.java index 8c49ff0..1563863 100644 --- a/keystore/java/android/security/KeyStore.java +++ b/keystore/java/android/security/KeyStore.java @@ -18,6 +18,8 @@ package android.security; import com.android.org.conscrypt.NativeConstants; +import android.content.Context; +import android.hardware.fingerprint.IFingerprintService; import android.os.Binder; import android.os.IBinder; import android.os.RemoteException; @@ -31,6 +33,7 @@ import android.security.keymaster.OperationResult; import android.util.Log; import java.security.InvalidKeyException; +import java.util.List; import java.util.Locale; /** @@ -53,6 +56,14 @@ public class KeyStore { public static final int UNDEFINED_ACTION = 9; public static final int WRONG_PASSWORD = 10; + /** + * Per operation authentication is needed before this operation is valid. + * This is returned from {@link #begin} when begin succeeds but the operation uses + * per-operation authentication and must authenticate before calling {@link #update} or + * {@link #finish}. + */ + public static final int OP_AUTH_NEEDED = 15; + // Used for UID field to indicate the calling UID. public static final int UID_SELF = -1; @@ -482,7 +493,8 @@ public class KeyStore { /** * Check if the operation referenced by {@code token} is currently authorized. * - * @param token An operation token returned by a call to {@link KeyStore.begin}. + * @param token An operation token returned by a call to + * {@link #begin(String, int, boolean, KeymasterArguments, byte[], KeymasterArguments) begin}. */ public boolean isOperationAuthorized(IBinder token) { try { @@ -531,6 +543,8 @@ public class KeyStore { return new KeyStoreException(errorCode, "Key not found"); case VALUE_CORRUPTED: return new KeyStoreException(errorCode, "Key blob corrupted"); + case OP_AUTH_NEEDED: + return new KeyStoreException(errorCode, "Operation requires authorization"); default: return new KeyStoreException(errorCode, String.valueOf(errorCode)); } @@ -553,27 +567,81 @@ public class KeyStore { * Returns an {@link InvalidKeyException} corresponding to the provided * {@link KeyStoreException}. */ - static InvalidKeyException getInvalidKeyException(KeyStoreException e) { + InvalidKeyException getInvalidKeyException(String keystoreKeyAlias, KeyStoreException e) { switch (e.getErrorCode()) { case KeymasterDefs.KM_ERROR_KEY_EXPIRED: return new KeyExpiredException(); case KeymasterDefs.KM_ERROR_KEY_NOT_YET_VALID: return new KeyNotYetValidException(); case KeymasterDefs.KM_ERROR_KEY_USER_NOT_AUTHENTICATED: - return new UserNotAuthenticatedException(); - // TODO: Handle TBD Keymaster error code "invalid key: new fingerprint enrolled" - // case KeymasterDefs.KM_ERROR_TBD - // return new NewFingerprintEnrolledException(); + case OP_AUTH_NEEDED: + { + // We now need to determine whether the key/operation can become usable if user + // authentication is performed, or whether it can never become usable again. + // User authentication requirements are contained in the key's characteristics. We + // need to check whether these requirements can be be satisfied by asking the user + // to authenticate. + KeyCharacteristics keyCharacteristics = new KeyCharacteristics(); + int getKeyCharacteristicsErrorCode = + getKeyCharacteristics(keystoreKeyAlias, null, null, keyCharacteristics); + if (getKeyCharacteristicsErrorCode != NO_ERROR) { + return new InvalidKeyException( + "Failed to obtained key characteristics", + getKeyStoreException(getKeyCharacteristicsErrorCode)); + } + List<Long> keySids = + keyCharacteristics.getLongs(KeymasterDefs.KM_TAG_USER_SECURE_ID); + if (keySids.isEmpty()) { + // Key is not bound to any SIDs -- no amount of authentication will help here. + return new KeyPermanentlyInvalidatedException(); + } + long rootSid = GateKeeper.getSecureUserId(); + if ((rootSid != 0) && (keySids.contains(Long.valueOf(rootSid)))) { + // One of the key's SIDs is the current root SID -- user can be authenticated + // against that SID. + return new UserNotAuthenticatedException(); + } + + long fingerprintOnlySid = getFingerprintOnlySid(); + if ((fingerprintOnlySid != 0) + && (keySids.contains(Long.valueOf(fingerprintOnlySid)))) { + // One of the key's SIDs is the current fingerprint SID -- user can be + // authenticated against that SID. + return new UserNotAuthenticatedException(); + } + + // None of the key's SIDs can ever be authenticated + return new KeyPermanentlyInvalidatedException(); + } default: return new InvalidKeyException("Keystore operation failed", e); } } + private static long getFingerprintOnlySid() { + IFingerprintService service = IFingerprintService.Stub.asInterface( + ServiceManager.getService(Context.FINGERPRINT_SERVICE)); + if (service == null) { + return 0; + } + + try { + long deviceId = 0; // TODO: plumb hardware id to FPMS + if (!service.isHardwareDetected(deviceId)) { + return 0; + } + + return service.getAuthenticatorId(); + } catch (RemoteException e) { + throw new IllegalStateException("Failed to communicate with fingerprint service", e); + } + } + /** * Returns an {@link InvalidKeyException} corresponding to the provided keystore/keymaster error * code. */ - static InvalidKeyException getInvalidKeyException(int errorCode) { - return getInvalidKeyException(getKeyStoreException(errorCode)); + InvalidKeyException getInvalidKeyException(String keystoreKeyAlias, int errorCode) { + return getInvalidKeyException(keystoreKeyAlias, getKeyStoreException(errorCode)); } } diff --git a/keystore/java/android/security/KeyStoreCipherSpi.java b/keystore/java/android/security/KeyStoreCipherSpi.java index 3b13e83..917f716 100644 --- a/keystore/java/android/security/KeyStoreCipherSpi.java +++ b/keystore/java/android/security/KeyStoreCipherSpi.java @@ -298,17 +298,20 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry mAdditionalEntropyForBegin = null; if (opResult == null) { throw new KeyStoreConnectException(); - } else if (opResult.resultCode != KeyStore.NO_ERROR) { + } else if ((opResult.resultCode != KeyStore.NO_ERROR) + && (opResult.resultCode != KeyStore.OP_AUTH_NEEDED)) { switch (opResult.resultCode) { case KeymasterDefs.KM_ERROR_INVALID_NONCE: throw new InvalidAlgorithmParameterException("Invalid IV"); } - throw KeyStore.getInvalidKeyException(opResult.resultCode); + throw mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode); } if (opResult.token == null) { throw new IllegalStateException("Keystore returned null operation token"); } + // The operation handle/token is now either valid for use immediately or needs to be + // authorized through user authentication (if the error code was OP_AUTH_NEEDED). mOperationToken = opResult.token; mOperationHandle = opResult.operationHandle; loadAlgorithmSpecificParametersFromBeginResult(keymasterOutputArgs); @@ -317,6 +320,16 @@ public abstract class KeyStoreCipherSpi extends CipherSpi implements KeyStoreCry mMainDataStreamer = new KeyStoreCryptoOperationChunkedStreamer( new KeyStoreCryptoOperationChunkedStreamer.MainDataStream( mKeyStore, opResult.token)); + + if (opResult.resultCode != KeyStore.NO_ERROR) { + // The operation requires user authentication. Check whether such authentication is + // possible (e.g., the key may have been permanently invalidated). + InvalidKeyException e = + mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode); + if (!(e instanceof UserNotAuthenticatedException)) { + throw e; + } + } } @Override diff --git a/keystore/java/android/security/KeyStoreHmacSpi.java b/keystore/java/android/security/KeyStoreHmacSpi.java index 175369c..4590b9c 100644 --- a/keystore/java/android/security/KeyStoreHmacSpi.java +++ b/keystore/java/android/security/KeyStoreHmacSpi.java @@ -168,17 +168,31 @@ public abstract class KeyStoreHmacSpi extends MacSpi implements KeyStoreCryptoOp new KeymasterArguments()); if (opResult == null) { throw new KeyStoreConnectException(); - } else if (opResult.resultCode != KeyStore.NO_ERROR) { - throw KeyStore.getInvalidKeyException(opResult.resultCode); + } else if ((opResult.resultCode != KeyStore.NO_ERROR) + && (opResult.resultCode != KeyStore.OP_AUTH_NEEDED)) { + throw mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode); } + if (opResult.token == null) { throw new IllegalStateException("Keystore returned null operation token"); } + // The operation handle/token is now either valid for use immediately or needs to be + // authorized through user authentication (if the error code was OP_AUTH_NEEDED). mOperationToken = opResult.token; mOperationHandle = opResult.operationHandle; mChunkedStreamer = new KeyStoreCryptoOperationChunkedStreamer( new KeyStoreCryptoOperationChunkedStreamer.MainDataStream( mKeyStore, mOperationToken)); + + if (opResult.resultCode != KeyStore.NO_ERROR) { + // The operation requires user authentication. Check whether such authentication is + // possible (e.g., the key may have been permanently invalidated). + InvalidKeyException e = + mKeyStore.getInvalidKeyException(mKey.getAlias(), opResult.resultCode); + if (!(e instanceof UserNotAuthenticatedException)) { + throw e; + } + } } @Override diff --git a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java index 293c4c9..20f6042 100644 --- a/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java +++ b/keystore/java/android/security/KeyStoreKeyGeneratorSpi.java @@ -161,27 +161,10 @@ public abstract class KeyStoreKeyGeneratorSpi extends KeyGeneratorSpi { KeymasterDefs.KM_TAG_PADDING, KeymasterUtils.getKeymasterPaddingsFromJcaEncryptionPaddings( spec.getEncryptionPaddings())); - if (spec.getUserAuthenticators() == 0) { - args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); - } else { - args.addInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, - KeyStoreKeyProperties.UserAuthenticator.allToKeymaster( - spec.getUserAuthenticators())); - long secureUserId = GateKeeper.getSecureUserId(); - if (secureUserId == 0) { - throw new IllegalStateException("Secure lock screen must be enabled" - + " to generate keys requiring user authentication"); - } - args.addLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, secureUserId); - } - if (spec.isInvalidatedOnNewFingerprintEnrolled()) { - // TODO: Add the invalidate on fingerprint enrolled constraint once Keymaster supports - // that. - } - if (spec.getUserAuthenticationValidityDurationSeconds() != -1) { - args.addInt(KeymasterDefs.KM_TAG_AUTH_TIMEOUT, - spec.getUserAuthenticationValidityDurationSeconds()); - } + KeymasterUtils.addUserAuthArgs(args, + spec.getContext(), + spec.isUserAuthenticationRequired(), + spec.getUserAuthenticationValidityDurationSeconds()); args.addDate(KeymasterDefs.KM_TAG_ACTIVE_DATETIME, (spec.getKeyValidityStart() != null) ? spec.getKeyValidityStart() : new Date(0)); diff --git a/keystore/java/android/security/KeyStoreKeyProperties.java b/keystore/java/android/security/KeyStoreKeyProperties.java index 206103f..b85ec53 100644 --- a/keystore/java/android/security/KeyStoreKeyProperties.java +++ b/keystore/java/android/security/KeyStoreKeyProperties.java @@ -122,101 +122,6 @@ public abstract class KeyStoreKeyProperties { } @Retention(RetentionPolicy.SOURCE) - @IntDef(flag = true, - value = {UserAuthenticator.LOCK_SCREEN, UserAuthenticator.FINGERPRINT_READER}) - public @interface UserAuthenticatorEnum {} - - /** - * User authenticators which can be used to restrict/protect access to keys. - */ - public static abstract class UserAuthenticator { - private UserAuthenticator() {} - - /** Lock screen. */ - public static final int LOCK_SCREEN = 1 << 0; - - /** Fingerprint reader/sensor. */ - public static final int FINGERPRINT_READER = 1 << 1; - - /** - * @hide - */ - public static int toKeymaster(@UserAuthenticatorEnum int userAuthenticator) { - switch (userAuthenticator) { - case LOCK_SCREEN: - return KeymasterDefs.HW_AUTH_PASSWORD; - case FINGERPRINT_READER: - return KeymasterDefs.HW_AUTH_FINGERPRINT; - default: - throw new IllegalArgumentException( - "Unknown user authenticator: " + userAuthenticator); - } - } - - /** - * @hide - */ - public static @UserAuthenticatorEnum int fromKeymaster(int userAuthenticator) { - switch (userAuthenticator) { - case KeymasterDefs.HW_AUTH_PASSWORD: - return LOCK_SCREEN; - case KeymasterDefs.HW_AUTH_FINGERPRINT: - return FINGERPRINT_READER; - default: - throw new IllegalArgumentException( - "Unknown user authenticator: " + userAuthenticator); - } - } - - /** - * @hide - */ - public static int allToKeymaster(@UserAuthenticatorEnum int userAuthenticators) { - int result = 0; - int userAuthenticator = 1; - while (userAuthenticators != 0) { - if ((userAuthenticators & 1) != 0) { - result |= toKeymaster(userAuthenticator); - } - userAuthenticators >>>= 1; - userAuthenticator <<= 1; - } - return result; - } - - /** - * @hide - */ - public static @UserAuthenticatorEnum int allFromKeymaster(int userAuthenticators) { - @UserAuthenticatorEnum int result = 0; - int userAuthenticator = 1; - while (userAuthenticators != 0) { - if ((userAuthenticators & 1) != 0) { - result |= fromKeymaster(userAuthenticator); - } - userAuthenticators >>>= 1; - userAuthenticator <<= 1; - } - return result; - } - - /** - * @hide - */ - public static String toString(@UserAuthenticatorEnum int userAuthenticator) { - switch (userAuthenticator) { - case LOCK_SCREEN: - return "LOCK_SCREEN"; - case FINGERPRINT_READER: - return "FINGERPRINT_READER"; - default: - throw new IllegalArgumentException( - "Unknown user authenticator: " + userAuthenticator); - } - } - } - - @Retention(RetentionPolicy.SOURCE) @IntDef({Origin.GENERATED, Origin.IMPORTED, Origin.UNKNOWN}) public @interface OriginEnum {} diff --git a/keystore/java/android/security/KeyStoreKeySpec.java b/keystore/java/android/security/KeyStoreKeySpec.java index a89e4dd..96d58d8 100644 --- a/keystore/java/android/security/KeyStoreKeySpec.java +++ b/keystore/java/android/security/KeyStoreKeySpec.java @@ -36,10 +36,9 @@ public class KeyStoreKeySpec implements KeySpec { private final String[] mSignaturePaddings; private final String[] mDigests; private final String[] mBlockModes; - private final @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; - private final @KeyStoreKeyProperties.UserAuthenticatorEnum int mTeeEnforcedUserAuthenticators; + private final boolean mUserAuthenticationRequired; private final int mUserAuthenticationValidityDurationSeconds; - private final boolean mInvalidatedOnNewFingerprintEnrolled; + private final boolean mUserAuthenticationRequirementTeeEnforced; /** * @hide @@ -56,10 +55,9 @@ public class KeyStoreKeySpec implements KeySpec { String[] signaturePaddings, String[] digests, String[] blockModes, - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators, - @KeyStoreKeyProperties.UserAuthenticatorEnum int teeEnforcedUserAuthenticators, + boolean userAuthenticationRequired, int userAuthenticationValidityDurationSeconds, - boolean invalidatedOnNewFingerprintEnrolled) { + boolean userAuthenticationRequirementTeeEnforced) { mKeystoreAlias = keystoreKeyAlias; mTeeBacked = teeBacked; mOrigin = origin; @@ -74,10 +72,9 @@ public class KeyStoreKeySpec implements KeySpec { ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(signaturePaddings)); mDigests = ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(digests)); mBlockModes = ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(blockModes)); - mUserAuthenticators = userAuthenticators; - mTeeEnforcedUserAuthenticators = teeEnforcedUserAuthenticators; + mUserAuthenticationRequired = userAuthenticationRequired; mUserAuthenticationValidityDurationSeconds = userAuthenticationValidityDurationSeconds; - mInvalidatedOnNewFingerprintEnrolled = invalidatedOnNewFingerprintEnrolled; + mUserAuthenticationRequirementTeeEnforced = userAuthenticationRequirementTeeEnforced; } /** @@ -172,43 +169,34 @@ public class KeyStoreKeySpec implements KeySpec { } /** - * Gets the set of user authenticators which protect access to the key. The key can only be used - * iff the user has authenticated to at least one of these user authenticators. + * Returns {@code true} if user authentication is required for this key to be used. * - * @return user authenticators or {@code 0} if the key can be used without user authentication. + * @see #getUserAuthenticationValidityDurationSeconds() */ - public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() { - return mUserAuthenticators; + public boolean isUserAuthenticationRequired() { + return mUserAuthenticationRequired; } /** - * Gets the set of user authenticators for which the TEE enforces access restrictions for this - * key. This is a subset of the user authentications returned by - * {@link #getUserAuthenticators()}. - */ - public @KeyStoreKeyProperties.UserAuthenticatorEnum int getTeeEnforcedUserAuthenticators() { - return mTeeEnforcedUserAuthenticators; - } - - /** - * Gets the duration of time (seconds) for which the key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * Gets the duration of time (seconds) for which this key can be used after the user is + * successfully authenticated. * * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication * is required for every use of the key. + * + * @see #isUserAuthenticationRequired() */ public int getUserAuthenticationValidityDurationSeconds() { return mUserAuthenticationValidityDurationSeconds; } /** - * Returns {@code true} if this key will be permanently invalidated once a new fingerprint is - * enrolled. This constraint only has effect if fingerprint reader is one of the user - * authenticators protecting access to this key. + * Returns {@code true} if the requirement that this key can only be used if the user has been + * authenticated if enforced by the TEE. * - * @see #getUserAuthenticators() + * @see #isUserAuthenticationRequired() */ - public boolean isInvalidatedOnNewFingerprintEnrolled() { - return mInvalidatedOnNewFingerprintEnrolled; + public boolean isUserAuthenticationRequirementTeeEnforced() { + return mUserAuthenticationRequirementTeeEnforced; } } diff --git a/keystore/java/android/security/KeyStoreParameter.java b/keystore/java/android/security/KeyStoreParameter.java index c24b74f..b4747e9 100644 --- a/keystore/java/android/security/KeyStoreParameter.java +++ b/keystore/java/android/security/KeyStoreParameter.java @@ -39,7 +39,8 @@ import javax.crypto.Cipher; * {@code KeyStore}. */ public final class KeyStoreParameter implements ProtectionParameter { - private int mFlags; + private final Context mContext; + private final int mFlags; private final Date mKeyValidityStart; private final Date mKeyValidityForOriginationEnd; private final Date mKeyValidityForConsumptionEnd; @@ -49,11 +50,12 @@ public final class KeyStoreParameter implements ProtectionParameter { private final String[] mDigests; private final String[] mBlockModes; private final boolean mRandomizedEncryptionRequired; - private final @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; + private final boolean mUserAuthenticationRequired; private final int mUserAuthenticationValidityDurationSeconds; - private final boolean mInvalidatedOnNewFingerprintEnrolled; - private KeyStoreParameter(int flags, + private KeyStoreParameter( + Context context, + int flags, Date keyValidityStart, Date keyValidityForOriginationEnd, Date keyValidityForConsumptionEnd, @@ -63,15 +65,17 @@ public final class KeyStoreParameter implements ProtectionParameter { String[] digests, String[] blockModes, boolean randomizedEncryptionRequired, - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators, - int userAuthenticationValidityDurationSeconds, - boolean invalidatedOnNewFingerprintEnrolled) { - if ((userAuthenticationValidityDurationSeconds < 0) + boolean userAuthenticationRequired, + int userAuthenticationValidityDurationSeconds) { + if (context == null) { + throw new IllegalArgumentException("context == null"); + } else if ((userAuthenticationValidityDurationSeconds < 0) && (userAuthenticationValidityDurationSeconds != -1)) { throw new IllegalArgumentException( "userAuthenticationValidityDurationSeconds must not be negative"); } + mContext = context; mFlags = flags; mKeyValidityStart = keyValidityStart; mKeyValidityForOriginationEnd = keyValidityForOriginationEnd; @@ -84,9 +88,15 @@ public final class KeyStoreParameter implements ProtectionParameter { mDigests = ArrayUtils.cloneIfNotEmpty(digests); mBlockModes = ArrayUtils.cloneIfNotEmpty(ArrayUtils.nullToEmpty(blockModes)); mRandomizedEncryptionRequired = randomizedEncryptionRequired; - mUserAuthenticators = userAuthenticators; + mUserAuthenticationRequired = userAuthenticationRequired; mUserAuthenticationValidityDurationSeconds = userAuthenticationValidityDurationSeconds; - mInvalidatedOnNewFingerprintEnrolled = invalidatedOnNewFingerprintEnrolled; + } + + /** + * Gets the Android context used for operations with this instance. + */ + public Context getContext() { + return mContext; } /** @@ -198,18 +208,17 @@ public final class KeyStoreParameter implements ProtectionParameter { } /** - * Gets the set of user authenticators which protect access to this key. The key can only be - * used iff the user has authenticated to at least one of these user authenticators. + * Returns {@code true} if user authentication is required for this key to be used. * - * @return user authenticators or {@code 0} if the key can be used without user authentication. + * @see #getUserAuthenticationValidityDurationSeconds() */ - public @KeyStoreKeyProperties.UserAuthenticatorEnum int getUserAuthenticators() { - return mUserAuthenticators; + public boolean isUserAuthenticationRequired() { + return mUserAuthenticationRequired; } /** - * Gets the duration of time (seconds) for which this key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * Gets the duration of time (seconds) for which this key can be used after the user is + * successfully authenticated. * * @return duration in seconds or {@code -1} if not restricted. {@code 0} means authentication * is required for every use of the key. @@ -219,17 +228,6 @@ public final class KeyStoreParameter implements ProtectionParameter { } /** - * Returns {@code true} if this key must be permanently invalidated once a new fingerprint is - * enrolled. This constraint only has effect if fingerprint reader is one of the user - * authenticators protecting access to this key. - * - * @see #getUserAuthenticators() - */ - public boolean isInvalidatedOnNewFingerprintEnrolled() { - return mInvalidatedOnNewFingerprintEnrolled; - } - - /** * Builder class for {@link KeyStoreParameter} objects. * <p> * This will build protection parameters for use with the @@ -247,6 +245,7 @@ public final class KeyStoreParameter implements ProtectionParameter { * </pre> */ public final static class Builder { + private final Context mContext; private int mFlags; private Date mKeyValidityStart; private Date mKeyValidityForOriginationEnd; @@ -257,9 +256,8 @@ public final class KeyStoreParameter implements ProtectionParameter { private String[] mDigests; private String[] mBlockModes; private boolean mRandomizedEncryptionRequired = true; - private @KeyStoreKeyProperties.UserAuthenticatorEnum int mUserAuthenticators; + private boolean mUserAuthenticationRequired; private int mUserAuthenticationValidityDurationSeconds = -1; - private boolean mInvalidatedOnNewFingerprintEnrolled; /** * Creates a new instance of the {@code Builder} with the given @@ -271,8 +269,7 @@ public final class KeyStoreParameter implements ProtectionParameter { if (context == null) { throw new NullPointerException("context == null"); } - - // Context is currently not used, but will be in the future. + mContext = context; } /** @@ -440,32 +437,35 @@ public final class KeyStoreParameter implements ProtectionParameter { } /** - * Sets the user authenticators which protect access to this key. The key can only be used - * iff the user has authenticated to at least one of these user authenticators. + * Sets whether user authentication is required to use this key. * * <p>By default, the key can be used without user authentication. * - * @param userAuthenticators user authenticators or {@code 0} if this key can be accessed - * without user authentication. + * <p>When user authentication is required, the user authorizes the use of the key by + * authenticating to this Android device using a subset of their secure lock screen + * credentials. Different authentication methods are used depending on whether the every + * use of the key must be authenticated (as specified by + * {@link #setUserAuthenticationValidityDurationSeconds(int)}). + * <a href="{@docRoot}training/articles/keystore.html#UserAuthentication">More + * information</a>. * * @see #setUserAuthenticationValidityDurationSeconds(int) */ - public Builder setUserAuthenticators( - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators) { - mUserAuthenticators = userAuthenticators; + public Builder setUserAuthenticationRequired(boolean required) { + mUserAuthenticationRequired = required; return this; } /** - * Sets the duration of time (seconds) for which this key can be used after the user - * successfully authenticates to one of the associated user authenticators. + * Sets the duration of time (seconds) for which this key can be used after the user is + * successfully authenticated. This has effect only if user authentication is required. * * <p>By default, the user needs to authenticate for every use of the key. * * @param seconds duration in seconds or {@code 0} if the user needs to authenticate for * every use of the key. * - * @see #setUserAuthenticators(int) + * @see #setUserAuthenticationRequired(boolean) */ public Builder setUserAuthenticationValidityDurationSeconds(int seconds) { mUserAuthenticationValidityDurationSeconds = seconds; @@ -473,27 +473,15 @@ public final class KeyStoreParameter implements ProtectionParameter { } /** - * Sets whether this key must be invalidated (permanently) whenever a new fingerprint is - * enrolled. This only has effect if fingerprint reader is one of the user authenticators - * protecting access to the key. - * - * <p>By default, enrolling a new fingerprint does not invalidate the key. - * - * @see #setUserAuthenticators(Set) - */ - public Builder setInvalidatedOnNewFingerprintEnrolled(boolean invalidated) { - mInvalidatedOnNewFingerprintEnrolled = invalidated; - return this; - } - - /** * Builds the instance of the {@code KeyStoreParameter}. * * @throws IllegalArgumentException if a required field is missing * @return built instance of {@code KeyStoreParameter} */ public KeyStoreParameter build() { - return new KeyStoreParameter(mFlags, + return new KeyStoreParameter( + mContext, + mFlags, mKeyValidityStart, mKeyValidityForOriginationEnd, mKeyValidityForConsumptionEnd, @@ -503,9 +491,8 @@ public final class KeyStoreParameter implements ProtectionParameter { mDigests, mBlockModes, mRandomizedEncryptionRequired, - mUserAuthenticators, - mUserAuthenticationValidityDurationSeconds, - mInvalidatedOnNewFingerprintEnrolled); + mUserAuthenticationRequired, + mUserAuthenticationValidityDurationSeconds); } } } diff --git a/keystore/java/android/security/KeyStoreSecretKeyFactorySpi.java b/keystore/java/android/security/KeyStoreSecretKeyFactorySpi.java index 4be0638..bfe09e3 100644 --- a/keystore/java/android/security/KeyStoreSecretKeyFactorySpi.java +++ b/keystore/java/android/security/KeyStoreSecretKeyFactorySpi.java @@ -81,8 +81,8 @@ public class KeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { String[] encryptionPaddings; String[] digests; String[] blockModes; - @KeyStoreKeyProperties.UserAuthenticatorEnum int userAuthenticators; - @KeyStoreKeyProperties.UserAuthenticatorEnum int teeEnforcedUserAuthenticators; + int keymasterSwEnforcedUserAuthenticators; + int keymasterHwEnforcedUserAuthenticators; try { if (keyCharacteristics.hwEnforced.containsTag(KeymasterDefs.KM_TAG_ORIGIN)) { teeBacked = true; @@ -122,21 +122,10 @@ public class KeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { keyCharacteristics.getInts(KeymasterDefs.KM_TAG_DIGEST)); blockModes = KeymasterUtils.getJcaBlockModesFromKeymasterBlockModes( keyCharacteristics.getInts(KeymasterDefs.KM_TAG_BLOCK_MODE)); - - @KeyStoreKeyProperties.UserAuthenticatorEnum - int swEnforcedKeymasterUserAuthenticators = + keymasterSwEnforcedUserAuthenticators = keyCharacteristics.swEnforced.getInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, 0); - @KeyStoreKeyProperties.UserAuthenticatorEnum - int hwEnforcedKeymasterUserAuthenticators = + keymasterHwEnforcedUserAuthenticators = keyCharacteristics.hwEnforced.getInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, 0); - @KeyStoreKeyProperties.UserAuthenticatorEnum - int keymasterUserAuthenticators = - swEnforcedKeymasterUserAuthenticators | hwEnforcedKeymasterUserAuthenticators; - userAuthenticators = KeyStoreKeyProperties.UserAuthenticator.allFromKeymaster( - keymasterUserAuthenticators); - teeEnforcedUserAuthenticators = - KeyStoreKeyProperties.UserAuthenticator.allFromKeymaster( - hwEnforcedKeymasterUserAuthenticators); } catch (IllegalArgumentException e) { throw new InvalidKeySpecException("Unsupported key characteristic", e); } @@ -157,11 +146,13 @@ public class KeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { && (keyValidityForConsumptionEnd.getTime() == Long.MAX_VALUE)) { keyValidityForConsumptionEnd = null; } + boolean userAuthenticationRequired = + !keyCharacteristics.getBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); int userAuthenticationValidityDurationSeconds = keyCharacteristics.getInt(KeymasterDefs.KM_TAG_AUTH_TIMEOUT, -1); - - // TODO: Populate the value below from key characteristics once Keymaster is ready. - boolean invalidatedOnNewFingerprintEnrolled = false; + boolean userAuthenticationRequirementEnforcedInTee = (userAuthenticationRequired) + && (keymasterHwEnforcedUserAuthenticators != 0) + && (keymasterSwEnforcedUserAuthenticators == 0); return new KeyStoreKeySpec(entryAlias, teeBacked, @@ -175,10 +166,9 @@ public class KeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { EmptyArray.STRING, // no signature paddings -- this is symmetric crypto digests, blockModes, - userAuthenticators, - teeEnforcedUserAuthenticators, + userAuthenticationRequired, userAuthenticationValidityDurationSeconds, - invalidatedOnNewFingerprintEnrolled); + userAuthenticationRequirementEnforcedInTee); } @Override diff --git a/keystore/java/android/security/KeymasterUtils.java b/keystore/java/android/security/KeymasterUtils.java index 67f75c2..3ccb588 100644 --- a/keystore/java/android/security/KeymasterUtils.java +++ b/keystore/java/android/security/KeymasterUtils.java @@ -16,6 +16,9 @@ package android.security; +import android.content.Context; +import android.hardware.fingerprint.FingerprintManager; +import android.security.keymaster.KeymasterArguments; import android.security.keymaster.KeymasterDefs; import libcore.util.EmptyArray; @@ -339,4 +342,58 @@ public abstract class KeymasterUtils { } return result; } + + /** + * Adds keymaster arguments to express the key's authorization policy supported by user + * authentication. + * + * @param userAuthenticationRequired whether user authentication is required to authorize the + * use of the key. + * @param userAuthenticationValidityDurationSeconds duration of time (seconds) for which user + * authentication is valid as authorization for using the key or {@code -1} if every + * use of the key needs authorization. + */ + public static void addUserAuthArgs(KeymasterArguments args, + Context context, + boolean userAuthenticationRequired, + int userAuthenticationValidityDurationSeconds) { + if (!userAuthenticationRequired) { + args.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED); + return; + } + + if (userAuthenticationValidityDurationSeconds == -1) { + // Every use of this key needs to be authorized by the user. This currently means + // fingerprint-only auth. + FingerprintManager fingerprintManager = + context.getSystemService(FingerprintManager.class); + if ((fingerprintManager == null) || (!fingerprintManager.isHardwareDetected())) { + throw new IllegalStateException( + "This device does not support keys which require authentication for every" + + " use -- this requires fingerprint authentication which is not" + + " available on this device"); + } + long fingerprintOnlySid = fingerprintManager.getAuthenticatorId(); + if (fingerprintOnlySid == 0) { + throw new IllegalStateException( + "At least one fingerprint must be enrolled to create keys requiring user" + + " authentication for every use"); + } + args.addLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, fingerprintOnlySid); + args.addInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, KeymasterDefs.HW_AUTH_FINGERPRINT); + } else { + // The key is authorized for use for the specified amount of time after the user has + // authenticated. Whatever unlocks the secure lock screen should authorize this key. + long rootSid = GateKeeper.getSecureUserId(); + if (rootSid == 0) { + throw new IllegalStateException("Secure lock screen must be enabled" + + " to create keys requiring user authentication"); + } + args.addLong(KeymasterDefs.KM_TAG_USER_SECURE_ID, rootSid); + args.addInt(KeymasterDefs.KM_TAG_USER_AUTH_TYPE, + KeymasterDefs.HW_AUTH_PASSWORD | KeymasterDefs.HW_AUTH_FINGERPRINT); + args.addInt(KeymasterDefs.KM_TAG_AUTH_TIMEOUT, + userAuthenticationValidityDurationSeconds); + } + } } diff --git a/keystore/java/android/security/NewFingerprintEnrolledException.java b/keystore/java/android/security/NewFingerprintEnrolledException.java deleted file mode 100644 index 4fe210b..0000000 --- a/keystore/java/android/security/NewFingerprintEnrolledException.java +++ /dev/null @@ -1,41 +0,0 @@ -/* - * Copyright (C) 2015 The Android Open Source Project - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ - -package android.security; - -import java.security.InvalidKeyException; - -/** - * Indicates that a cryptographic operation could not be performed because the key used by the - * operation is permanently invalid because a new fingerprint was enrolled. - */ -public class NewFingerprintEnrolledException extends InvalidKeyException { - - /** - * Constructs a new {@code NewFingerprintEnrolledException} without detail message and cause. - */ - public NewFingerprintEnrolledException() { - super("Invalid key: new fingerprint enrolled"); - } - - /** - * Constructs a new {@code NewFingerprintEnrolledException} with the provided detail message and - * no cause. - */ - public NewFingerprintEnrolledException(String message) { - super(message); - } -} diff --git a/keystore/java/android/security/UserNotAuthenticatedException.java b/keystore/java/android/security/UserNotAuthenticatedException.java index 66f4dd8..2954fa7 100644 --- a/keystore/java/android/security/UserNotAuthenticatedException.java +++ b/keystore/java/android/security/UserNotAuthenticatedException.java @@ -20,7 +20,7 @@ import java.security.InvalidKeyException; /** * Indicates that a cryptographic operation could not be performed because the user has not been - * authenticated recently enough. + * authenticated recently enough. Authenticating the user will resolve this issue. */ public class UserNotAuthenticatedException extends InvalidKeyException { |