Merge "Key upgrading for FDE."

am: 997e605563

Change-Id: If2ca4a6bd3b7a2b36b6c092975bcfdde8e063a3e

1 files changed, 66 insertions, 49 deletions

diff --git a/Keymaster.cpp b/Keymaster.cpp
index 1bbeb61..4d055c2 100644
--- a/Keymaster.cpp
+++ b/Keymaster.cpp
@@ -203,71 +203,83 @@ int keymaster_compatibility_cryptfs_scrypt() {
     return dev.isSecure();
 }
 
-int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size,
-                                            uint64_t rsa_exponent,
-                                            uint32_t ratelimit,
-                                            uint8_t* key_buffer,
-                                            uint32_t key_buffer_size,
-                                            uint32_t* key_out_size)
-{
-    Keymaster dev;
-    std::string key;
-    if (!dev) {
-        LOG(ERROR) << "Failed to initiate keymaster session";
-        return -1;
+static bool write_string_to_buf(const std::string& towrite, uint8_t* buffer, uint32_t buffer_size,
+                                uint32_t* out_size) {
+    if (!buffer || !out_size) {
+        LOG(ERROR) << "Missing target pointers";
+        return false;
     }
-    if (!key_buffer || !key_out_size) {
-        LOG(ERROR) << __FILE__ << ":" << __LINE__ << ":Invalid argument";
-        return -1;
+    *out_size = towrite.size();
+    if (buffer_size < towrite.size()) {
+        LOG(ERROR) << "Buffer too small " << buffer_size << " < " << towrite.size();
+        return false;
     }
+    memset(buffer, '\0', buffer_size);
+    std::copy(towrite.begin(), towrite.end(), buffer);
+    return true;
+}
+
+static AuthorizationSet keyParams(uint32_t rsa_key_size, uint64_t rsa_exponent, uint32_t ratelimit) {
+    return AuthorizationSetBuilder()
+        .Authorization(TAG_ALGORITHM, Algorithm::RSA)
+        .Authorization(TAG_KEY_SIZE, rsa_key_size)
+        .Authorization(TAG_RSA_PUBLIC_EXPONENT, rsa_exponent)
+        .Authorization(TAG_PURPOSE, KeyPurpose::SIGN)
+        .Authorization(TAG_PADDING, PaddingMode::NONE)
+        .Authorization(TAG_DIGEST, Digest::NONE)
+        .Authorization(TAG_BLOB_USAGE_REQUIREMENTS, KeyBlobUsageRequirements::STANDALONE)
+        .Authorization(TAG_NO_AUTH_REQUIRED)
+        .Authorization(TAG_MIN_SECONDS_BETWEEN_OPS, ratelimit);
+}
+
+int keymaster_create_key_for_cryptfs_scrypt(uint32_t rsa_key_size, uint64_t rsa_exponent,
+                                            uint32_t ratelimit, uint8_t* key_buffer,
+                                            uint32_t key_buffer_size, uint32_t* key_out_size) {
     if (key_out_size) {
         *key_out_size = 0;
     }
-
-    auto paramBuilder = AuthorizationSetBuilder()
-                            .Authorization(TAG_ALGORITHM, Algorithm::RSA)
-                            .Authorization(TAG_KEY_SIZE, rsa_key_size)
-                            .Authorization(TAG_RSA_PUBLIC_EXPONENT, rsa_exponent)
-                            .Authorization(TAG_PURPOSE, KeyPurpose::SIGN)
-                            .Authorization(TAG_PADDING, PaddingMode::NONE)
-                            .Authorization(TAG_DIGEST, Digest::NONE)
-                            .Authorization(TAG_BLOB_USAGE_REQUIREMENTS,
-                                    KeyBlobUsageRequirements::STANDALONE)
-                            .Authorization(TAG_NO_AUTH_REQUIRED)
-                            .Authorization(TAG_MIN_SECONDS_BETWEEN_OPS, ratelimit);
-
-    if (!dev.generateKey(paramBuilder, &key)) {
+    Keymaster dev;
+    if (!dev) {
+        LOG(ERROR) << "Failed to initiate keymaster session";
         return -1;
     }
+    std::string key;
+    if (!dev.generateKey(keyParams(rsa_key_size, rsa_exponent, ratelimit), &key)) return -1;
+    if (!write_string_to_buf(key, key_buffer, key_buffer_size, key_out_size)) return -1;
+    return 0;
+}
 
+int keymaster_upgrade_key_for_cryptfs_scrypt(uint32_t rsa_key_size, uint64_t rsa_exponent,
+                                             uint32_t ratelimit, const uint8_t* key_blob,
+                                             size_t key_blob_size, uint8_t* key_buffer,
+                                             uint32_t key_buffer_size, uint32_t* key_out_size) {
     if (key_out_size) {
-        *key_out_size = key.size();
+        *key_out_size = 0;
     }
-
-    if (key_buffer_size < key.size()) {
+    Keymaster dev;
+    if (!dev) {
+        LOG(ERROR) << "Failed to initiate keymaster session";
         return -1;
     }
-
-    std::copy(key.data(), key.data() + key.size(), key_buffer);
+    std::string old_key(reinterpret_cast<const char*>(key_blob), key_blob_size);
+    std::string new_key;
+    if (!dev.upgradeKey(old_key, keyParams(rsa_key_size, rsa_exponent, ratelimit), &new_key))
+        return -1;
+    if (!write_string_to_buf(new_key, key_buffer, key_buffer_size, key_out_size)) return -1;
     return 0;
 }
 
-int keymaster_sign_object_for_cryptfs_scrypt(const uint8_t* key_blob,
-                                             size_t key_blob_size,
-                                             uint32_t ratelimit,
-                                             const uint8_t* object,
-                                             const size_t object_size,
-                                             uint8_t** signature_buffer,
-                                             size_t* signature_buffer_size)
-{
+KeymasterSignResult keymaster_sign_object_for_cryptfs_scrypt(
+    const uint8_t* key_blob, size_t key_blob_size, uint32_t ratelimit, const uint8_t* object,
+    const size_t object_size, uint8_t** signature_buffer, size_t* signature_buffer_size) {
     Keymaster dev;
     if (!dev) {
         LOG(ERROR) << "Failed to initiate keymaster session";
-        return -1;
+        return KeymasterSignResult::error;
     }
     if (!key_blob || !object || !signature_buffer || !signature_buffer_size) {
         LOG(ERROR) << __FILE__ << ":" << __LINE__ << ":Invalid argument";
-        return -1;
+        return KeymasterSignResult::error;
     }
 
     AuthorizationSet outParams;
@@ -288,28 +300,33 @@ int keymaster_sign_object_for_cryptfs_scrypt(const uint8_t* key_blob,
         } else break;
     }
 
+    if (op.errorCode() == ErrorCode::KEY_REQUIRES_UPGRADE) {
+        LOG(ERROR) << "Keymaster key requires upgrade";
+        return KeymasterSignResult::upgrade;
+    }
+
     if (op.errorCode() != ErrorCode::OK) {
         LOG(ERROR) << "Error starting keymaster signature transaction: " << int32_t(op.errorCode());
-        return -1;
+        return KeymasterSignResult::error;
     }
 
     if (!op.updateCompletely(input, &output)) {
         LOG(ERROR) << "Error sending data to keymaster signature transaction: "
                    << uint32_t(op.errorCode());
-        return -1;
+        return KeymasterSignResult::error;
     }
 
     if (!op.finish(&output)) {
         LOG(ERROR) << "Error finalizing keymaster signature transaction: " << int32_t(op.errorCode());
-        return -1;
+        return KeymasterSignResult::error;
     }
 
     *signature_buffer = reinterpret_cast<uint8_t*>(malloc(output.size()));
     if (*signature_buffer == nullptr) {
         LOG(ERROR) << "Error allocation buffer for keymaster signature";
-        return -1;
+        return KeymasterSignResult::error;
     }
     *signature_buffer_size = output.size();
     std::copy(output.data(), output.data() + output.size(), *signature_buffer);
-    return 0;
+    return KeymasterSignResult::ok;
 }