tequilaOS/platform_hardware_interfaces
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "KeyMint VTS: re-order auth failure arms" into main

Browse source
This commit is contained in:
David Drysdale 2023-09-15 10:36:47 +00:00 committed by Gerrit Code Review
commit 2ef3749cba
1 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
security/keymint/aidl/vts/functional/AuthTest.cpp
View file

@ -350,14 +350,14 @@ TEST_P(AuthTest, TimeoutAuthentication) {
// Wait for long enough that the hardware auth token expires.
sleep(timeout_secs + 1);
if (!timestamp_token_required_) {
// KeyMint implementation has its own clock, and can immediately detect timeout.
EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
} else {
// KeyMint implementation has no clock, so only detects timeout via timestamp token provided
// on update()/finish().
ASSERT_EQ(ErrorCode::OK, Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat));
auto begin_result = Begin(KeyPurpose::ENCRYPT, keyblob, params, &out_params, hat);
if (begin_result == ErrorCode::OK) {
// If begin() succeeds despite the out-of-date HAT, that must mean that the KeyMint
// device doesn't have its own clock. In that case, it only detects timeout via a
// timestamp token provided on update()/finish()
ASSERT_TRUE(timestamp_token_required_);
secureclock::TimeStampToken time_token;
EXPECT_EQ(ErrorCode::OK,
GetReturnErrorCode(clock_->generateTimeStamp(challenge_, &time_token)));
@ -365,6 +365,9 @@ TEST_P(AuthTest, TimeoutAuthentication) {
string output;
EXPECT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED,
Finish(message, {} /* signature */, &output, hat, time_token));
} else {
// The KeyMint implementation may have its own clock that can immediately detect timeout.
ASSERT_EQ(ErrorCode::KEY_USER_NOT_AUTHENTICATED, begin_result);
}
}