1 /*
2  * Copyright (C) 2020 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 /******************************************************************************
17  *
18  *  The original Work has been changed by NXP.
19  *
20  *  Licensed under the Apache License, Version 2.0 (the "License");
21  *  you may not use this file except in compliance with the License.
22  *  You may obtain a copy of the License at
23  *
24  *  http://www.apache.org/licenses/LICENSE-2.0
25  *
26  *  Unless required by applicable law or agreed to in writing, software
27  *  distributed under the License is distributed on an "AS IS" BASIS,
28  *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
29  *  See the License for the specific language governing permissions and
30  *  limitations under the License.
31  *
32  *  Copyright 2023 NXP
33  *
34  ******************************************************************************/
35 
36 #include "JavacardKeyMintUtils.h"
37 #include <android-base/logging.h>
38 #include <cppbor.h>
39 
40 namespace aidl::android::hardware::security::keymint::km_utils {
41 
42 keymaster_key_param_t kInvalidTag{.tag = KM_TAG_INVALID, .integer = 0};
43 
kmEnumParam2Aidl(const keymaster_key_param_t & param)44 KeyParameter kmEnumParam2Aidl(const keymaster_key_param_t& param) {
45     switch (param.tag) {
46     case KM_TAG_PURPOSE:
47         return KeyParameter{Tag::PURPOSE, KeyParameterValue::make<KeyParameterValue::keyPurpose>(
48                                               static_cast<KeyPurpose>(param.enumerated))};
49     case KM_TAG_ALGORITHM:
50         return KeyParameter{Tag::ALGORITHM, KeyParameterValue::make<KeyParameterValue::algorithm>(
51                                                 static_cast<Algorithm>(param.enumerated))};
52     case KM_TAG_BLOCK_MODE:
53         return KeyParameter{Tag::BLOCK_MODE, KeyParameterValue::make<KeyParameterValue::blockMode>(
54                                                  static_cast<BlockMode>(param.enumerated))};
55     case KM_TAG_DIGEST:
56         return KeyParameter{Tag::DIGEST, KeyParameterValue::make<KeyParameterValue::digest>(
57                                              static_cast<Digest>(param.enumerated))};
58     case KM_TAG_RSA_OAEP_MGF_DIGEST:
59         return KeyParameter{Tag::RSA_OAEP_MGF_DIGEST,
60                             KeyParameterValue::make<KeyParameterValue::digest>(
61                                 static_cast<Digest>(param.enumerated))};
62     case KM_TAG_PADDING:
63         return KeyParameter{Tag::PADDING, KeyParameterValue::make<KeyParameterValue::paddingMode>(
64                                               static_cast<PaddingMode>(param.enumerated))};
65     case KM_TAG_EC_CURVE:
66         return KeyParameter{Tag::EC_CURVE, KeyParameterValue::make<KeyParameterValue::ecCurve>(
67                                                static_cast<EcCurve>(param.enumerated))};
68     case KM_TAG_USER_AUTH_TYPE:
69         return KeyParameter{Tag::USER_AUTH_TYPE,
70                             KeyParameterValue::make<KeyParameterValue::hardwareAuthenticatorType>(
71                                 static_cast<HardwareAuthenticatorType>(param.enumerated))};
72     case KM_TAG_ORIGIN:
73         return KeyParameter{Tag::ORIGIN, KeyParameterValue::make<KeyParameterValue::origin>(
74                                              static_cast<KeyOrigin>(param.enumerated))};
75     case KM_TAG_BLOB_USAGE_REQUIREMENTS:
76     case KM_TAG_KDF:
77     default:
78         return KeyParameter{Tag::INVALID, false};
79     }
80 }
81 
82 
kmParam2Aidl(const keymaster_key_param_t & param)83 KeyParameter kmParam2Aidl(const keymaster_key_param_t& param) {
84     auto tag = legacy_enum_conversion(param.tag);
85     switch (typeFromTag(param.tag)) {
86     case KM_ENUM:
87     case KM_ENUM_REP:
88         return kmEnumParam2Aidl(param);
89         break;
90 
91     case KM_UINT:
92     case KM_UINT_REP:
93         return KeyParameter{tag,
94                             KeyParameterValue::make<KeyParameterValue::integer>(param.integer)};
95 
96     case KM_ULONG:
97     case KM_ULONG_REP:
98         return KeyParameter{
99             tag, KeyParameterValue::make<KeyParameterValue::longInteger>(param.long_integer)};
100         break;
101 
102     case KM_DATE:
103         return KeyParameter{tag,
104                             KeyParameterValue::make<KeyParameterValue::dateTime>(param.date_time)};
105         break;
106 
107     case KM_BOOL:
108         return KeyParameter{tag, param.boolean};
109         break;
110 
111     case KM_BIGNUM:
112     case KM_BYTES:
113         return {tag, KeyParameterValue::make<KeyParameterValue::blob>(
114                          std::vector(param.blob.data, param.blob.data + param.blob.data_length))};
115         break;
116 
117     case KM_INVALID:
118     default:
119         CHECK(false) << "Unknown or unused tag type: Something is broken";
120         return KeyParameter{Tag::INVALID, false};
121         break;
122     }
123 }
124 
kmParamSet2Aidl(const keymaster_key_param_set_t & set)125 vector<KeyParameter> kmParamSet2Aidl(const keymaster_key_param_set_t& set) {
126     vector<KeyParameter> result;
127     if (set.length == 0 || set.params == nullptr) return result;
128 
129     result.reserve(set.length);
130     for (size_t i = 0; i < set.length; ++i) {
131         result.push_back(kmParam2Aidl(set.params[i]));
132     }
133     return result;
134 }
135 
136 template <KeyParameterValue::Tag aidl_tag>
aidlEnumVal2Km(keymaster_tag_t km_tag,const KeyParameterValue & value)137 keymaster_key_param_t aidlEnumVal2Km(keymaster_tag_t km_tag, const KeyParameterValue& value) {
138     return value.getTag() == aidl_tag
139                ? keymaster_param_enum(km_tag, static_cast<uint32_t>(value.get<aidl_tag>()))
140                : kInvalidTag;
141 }
142 
aidlEnumParam2Km(const KeyParameter & param)143 keymaster_key_param_t aidlEnumParam2Km(const KeyParameter& param) {
144     auto tag = legacy_enum_conversion(param.tag);
145     switch (tag) {
146     case KM_TAG_PURPOSE:
147         return aidlEnumVal2Km<KeyParameterValue::keyPurpose>(tag, param.value);
148     case KM_TAG_ALGORITHM:
149         return aidlEnumVal2Km<KeyParameterValue::algorithm>(tag, param.value);
150     case KM_TAG_BLOCK_MODE:
151         return aidlEnumVal2Km<KeyParameterValue::blockMode>(tag, param.value);
152     case KM_TAG_DIGEST:
153     case KM_TAG_RSA_OAEP_MGF_DIGEST:
154         return aidlEnumVal2Km<KeyParameterValue::digest>(tag, param.value);
155     case KM_TAG_PADDING:
156         return aidlEnumVal2Km<KeyParameterValue::paddingMode>(tag, param.value);
157     case KM_TAG_EC_CURVE:
158         return aidlEnumVal2Km<KeyParameterValue::ecCurve>(tag, param.value);
159     case KM_TAG_USER_AUTH_TYPE:
160         return aidlEnumVal2Km<KeyParameterValue::hardwareAuthenticatorType>(tag, param.value);
161     case KM_TAG_ORIGIN:
162         return aidlEnumVal2Km<KeyParameterValue::origin>(tag, param.value);
163     case KM_TAG_BLOB_USAGE_REQUIREMENTS:
164     case KM_TAG_KDF:
165     default:
166         CHECK(false) << "Unknown or unused enum tag: Something is broken";
167         return keymaster_param_enum(tag, false);
168     }
169 }
170 
171 
172 
legacyHardwareAuthToken(const HardwareAuthToken & aidlToken,LegacyHardwareAuthToken * legacyToken)173 keymaster_error_t legacyHardwareAuthToken(const HardwareAuthToken& aidlToken,
174                                           LegacyHardwareAuthToken* legacyToken) {
175     legacyToken->challenge = aidlToken.challenge;
176     legacyToken->user_id = aidlToken.userId;
177     legacyToken->authenticator_id = aidlToken.authenticatorId;
178     legacyToken->authenticator_type =
179         static_cast<hw_authenticator_type_t>(aidlToken.authenticatorType);
180     legacyToken->timestamp = aidlToken.timestamp.milliSeconds;
181     Vec2KmBlob(aidlToken.mac, &legacyToken->mac);
182     return KM_ERROR_OK;
183 }
184 
encodeTimestampToken(const TimeStampToken & timestampToken,vector<uint8_t> * encodedToken)185 keymaster_error_t encodeTimestampToken(const TimeStampToken& timestampToken,
186                                        vector<uint8_t>* encodedToken) {
187     cppbor::Array array;
188     ::keymaster::TimestampToken token;
189     array.add(static_cast<uint64_t>(timestampToken.challenge));
190     array.add(static_cast<uint64_t>(timestampToken.timestamp.milliSeconds));
191     array.add(timestampToken.mac);
192     *encodedToken = array.encode();
193     return KM_ERROR_OK;
194 }
195 
aidlKeyParams2Km(const vector<KeyParameter> & keyParams)196 keymaster_key_param_set_t aidlKeyParams2Km(const vector<KeyParameter>& keyParams) {
197     keymaster_key_param_set_t set;
198 
199     set.params = static_cast<keymaster_key_param_t*>(
200         malloc(keyParams.size() * sizeof(keymaster_key_param_t)));
201     set.length = keyParams.size();
202 
203     for (size_t i = 0; i < keyParams.size(); ++i) {
204         const auto& param = keyParams[i];
205         auto tag = legacy_enum_conversion(param.tag);
206         switch (typeFromTag(tag)) {
207 
208         case KM_ENUM:
209         case KM_ENUM_REP:
210             set.params[i] = aidlEnumParam2Km(param);
211             break;
212 
213         case KM_UINT:
214         case KM_UINT_REP:
215             set.params[i] =
216                 param.value.getTag() == KeyParameterValue::integer
217                     ? keymaster_param_int(tag, param.value.get<KeyParameterValue::integer>())
218                     : kInvalidTag;
219             break;
220 
221         case KM_ULONG:
222         case KM_ULONG_REP:
223             set.params[i] =
224                 param.value.getTag() == KeyParameterValue::longInteger
225                     ? keymaster_param_long(tag, param.value.get<KeyParameterValue::longInteger>())
226                     : kInvalidTag;
227             break;
228 
229         case KM_DATE:
230             set.params[i] =
231                 param.value.getTag() == KeyParameterValue::dateTime
232                     ? keymaster_param_date(tag, param.value.get<KeyParameterValue::dateTime>())
233                     : kInvalidTag;
234             break;
235 
236         case KM_BOOL:
237             set.params[i] = keymaster_param_bool(tag);
238             break;
239 
240         case KM_BIGNUM:
241         case KM_BYTES:
242             if (param.value.getTag() == KeyParameterValue::blob) {
243                 const auto& value = param.value.get<KeyParameterValue::blob>();
244                 uint8_t* copy = static_cast<uint8_t*>(malloc(value.size()));
245                 std::copy(value.begin(), value.end(), copy);
246                 set.params[i] = keymaster_param_blob(tag, copy, value.size());
247             } else {
248                 set.params[i] = kInvalidTag;
249             }
250             break;
251 
252         case KM_INVALID:
253         default:
254             CHECK(false) << "Invalid tag: Something is broken";
255             set.params[i].tag = KM_TAG_INVALID;
256             /* just skip */
257             break;
258         }
259     }
260 
261     return set;
262 }
263 
264 }  // namespace aidl::android::hardware::security::keymint
265