From 744a37115a0a0e30fb84806ab2c320a6b744298c Mon Sep 17 00:00:00 2001 From: Shawn Willden Date: Mon, 15 Apr 2019 05:51:37 -0600 Subject: [PATCH] Correct IKeymasterDevice documentation. Bug: 129931913 Bug: 130144003 Test: ./update-makefiles.sh (checks hashes) Change-Id: Ia8101f8410a728b28653416300c1a3eb480eb469 --- current.txt | 2 +- keymaster/4.0/IKeymasterDevice.hal | 16 +++++++--------- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/current.txt b/current.txt index 4c6337c07b..44ed2ca9f2 100644 --- a/current.txt +++ b/current.txt @@ -475,4 +475,4 @@ d8e7717e8187dd7453d4142f8f331e7c325e7a6f9e8d44ac0d52b3be502bfe83 android.hardwar b53ac9d61c24efb16a2d63a861cef20680f6d57adb244a03b9778c675550628b android.hardware.secure_element@1.1::ISecureElementHalCallback # ABI preserving changes to HALs during Android R -# none yet +b69a7615c508acf5c5201efd1bfa3262167874fc3594e2db5a3ff93addd8ac75 android.hardware.keymaster@4.0::IKeymasterDevice diff --git a/keymaster/4.0/IKeymasterDevice.hal b/keymaster/4.0/IKeymasterDevice.hal index c867ab0c9c..3475f79dd0 100644 --- a/keymaster/4.0/IKeymasterDevice.hal +++ b/keymaster/4.0/IKeymasterDevice.hal @@ -624,7 +624,7 @@ interface IKeymasterDevice { /** * Exports a public key, returning the key in the specified format. * - * @parm keyFormat The format used for export. See KeyFormat in types.hal. + * @parm keyFormat The format used for export. Must be KeyFormat::X509. * * @param keyBlob The opaque descriptor returned by generateKey() or importKey(). The * referenced key must be asymmetric. @@ -639,7 +639,7 @@ interface IKeymasterDevice { * value, it must be computationally infeasible for the secure hardware to obtain the key * material. * - * @return keyMaterial The public key material in PKCS#8 format. + * @return keyMaterial The public key material in X.509 format. */ exportKey(KeyFormat keyFormat, vec keyBlob, vec clientId, vec appData) generates (ErrorCode error, vec keyMaterial); @@ -1005,13 +1005,11 @@ interface IKeymasterDevice { * * -- EC Keys -- * - * EC key operations must specify exactly one padding mode in inParams. If unspecified or - * specified more than once, begin() must return ErrorCode::UNSUPPORTED_PADDING_MODE. - * - * Private key operations (KeyPurpose::SIGN) need authorization of digest and padding, which - * means that the key authorizations must contain the specified values. If not, begin() must - * return ErrorCode::INCOMPATIBLE_DIGEST. Public key operations (KeyPurpose::VERIFY) are - * permitted with unauthorized digest or padding. + * EC private key operations must specify exactly one digest in inParams. If unspecified or + * specified more than once, begin() must return ErrorCode::UNSUPPORTED_DIGEST. For private key + * operations, (KeyPurpose::SIGN), if the specified digest is not in the key's authorization + * list, begin() must return ErrorCode::INCOMPATIBLE_DIGEST. Public key operations + * (KeyPurpose::VERIFY) are permitted with unauthorized digest. * * -- AES Keys -- *