tequilaOS/platform_hardware_interfaces
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Keystore 2.0: add convertStorageKeyToEphemeral() to IKeymintDevice" am: 38b3bcee7f am: d037d2a2c7

Browse source 
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1622545

Change-Id: I7aeba5e9d1d7cd48066677f9ed39c1aea47128fb
This commit is contained in:
Satya Tangirala 2021-03-24 05:02:26 +00:00 committed by Automerger Merge Worker
commit ae368b8c17
2 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
security/keymint/aidl/aidl_api/android.hardware.security.keymint/current/android/hardware/security/keymint/IKeyMintDevice.aidl
View file

@ -47,6 +47,7 @@ interface IKeyMintDevice {
android.hardware.security.keymint.BeginResult begin(in android.hardware.security.keymint.KeyPurpose purpose, in byte[] keyBlob, in android.hardware.security.keymint.KeyParameter[] params, in android.hardware.security.keymint.HardwareAuthToken authToken);
void deviceLocked(in boolean passwordOnly, in @nullable android.hardware.security.secureclock.TimeStampToken timestampToken);
void earlyBootEnded();
byte[] convertStorageKeyToEphemeral(in byte[] storageKeyBlob);
byte[] performOperation(in byte[] request);
const int AUTH_TOKEN_MAC_LENGTH = 32;
}

21
security/keymint/aidl/android/hardware/security/keymint/IKeyMintDevice.aidl
View file

@ -762,6 +762,27 @@ interface IKeyMintDevice {
*/
void earlyBootEnded();
/*
* Called by the client to get a wrapped per-boot ephemeral key from a wrapped storage key.
* Clients will then use the returned per-boot ephemeral key in place of the wrapped storage
* key. Whenever the hardware is presented with a per-boot ephemeral key for an operation, it
* must use the storage key associated with that ephemeral key to perform the requested
* operation.
*
* Implementations should return ErrorCode::UNIMPLEMENTED if they don't support wrapped storage
* keys.
*
* Implementations should return ErrorCode::INVALID_ARGUMENT (as a ServiceSpecificException)
* if the input key blob doesn't represent a valid long-lived wrapped storage key.
*
* @param storageKeyBlob is the wrapped storage key for which the client wants a per-boot
* ephemeral key
*
* @return a buffer containing the per-boot ephemeral keyblob that should henceforth be used in
* place of the input storageKeyBlob
*/
byte[] convertStorageKeyToEphemeral(in byte[] storageKeyBlob);
/**
* Called by the client to perform a KeyMint operation.
*