attestation id.
Get IMEI value from Telephony Service and use it as attestation id.
Bug: 261847629
Test: atest VtsAidlKeyMintTargetTest
Change-Id: I0212def48d761a45f514161e5576a954bf388c56
Updated the digest to SHA_2_256 in manaul key upgrade tests
so that these tests works for StrongBox as well.
Test: VtsAidlKeyMintTargetTest
Change-Id: I971f6e13272450d39537cc44c59f8ed8dbd19bf0
libcert_request_validator is now called libhwtrust so update the
references to match.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I3c73e2749996ef684da4567a3c86daf8b9c0fd09
Remove one of the DICE chain validation implementations and replace it
with a call to the libcert_request_validator library which has the most
complete validation and is planned to be the only implementation we
support.
VTS will now check both degenerate and proper DICE chain more completely
and will be consistent with other tools like `bcc_validator`. P-384 will
become a supported key type in the DICE chain.
The whole static library is included so that clients that statically
link remote_prov_utils don't need to be aware of the dependency.
Bug: 254510672
Bug: 265455904
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I067f7e8710e379a4b404ef9d2c04fe6410f73dc4
Clarify that the tag for the 2nd IMEI must denote an IMEI different to
the tag used for the first IMEI, and may be used independently of it.
Bug: 264979486
Test: N/A
Change-Id: I45a46d1052e45a965c8be391d11157cc4481545b
This made it easier to run libkeymint_remote_prov_support_test.
Bug: 264302050
Test: atest libkeymint_remote_prov_support_test
Change-Id: Ided4e9bb442274ea7711d283bc947c35f34ebc35
To help with error reporting on the RKP servers in the future it
will be helpful to be able to address CSRs by serial number when
possible.
Bug: 264302050
Test: libkeymint_remote_prov_support_test and sent JSON to server
Change-Id: I2808441c200d0679e618580abc464cd3c71c220e
It's not enough to verify that the system is running KeyMint 2+. We
also need to verify that the vendor partition has RKP support.
Since VSR 13+ requires KeyMint 2+, change the test assumption so that
we don't run the test against systems that may have shipped with an
older VSR chipset (which won't support RKP).
Bug: 263844771
Test: VtsAidlKeyMintTargetTest (on old and new device)
Change-Id: Iac15f69db1152851f5a92d3929cb258b1b1a6b02
Alternet device properties used for attestation on AOSP and GSI builds.
Attestation ids were different in AOSP/GSI builds than provisioned ids
in keymint. Hence additional properties used to make these ids identical
to provisioned ids.
Bug: 110779648
Bug: 259376922
Test: atest VtsAidlKeyMintTargetTest:PerInstance/NewKeyGenerationTest#EcdsaAttestationIdTags/0_android_hardware_security_keymint_IKeyMintDevice_default
Test: atest VtsAidlKeyMintTargetTest:PerInstance/NewKeyGenerationTest#EcdsaAttestationIdTags/1_android_hardware_security_keymint_IKeyMintDevice_strongbox
Test: atest CtsKeystoreTestCases:android.keystore.cts.KeyAttestationTest CtsKeystoreTestCases:DeviceOwnerKeyManagementTest
Change-Id: I4bb2e2ebba617972e29ad86ea477eb9b6f35d21a
This integration was technically a requirement on keymint v2, but we
weren't enforcing it with a test. So realistically we are only able
to start enforcing the test with keymint v3.
Test: atest VtsAidlKeyMintTargetTest
Change-Id: Ia4feb8ce4b7fd1e47a5c6c9b06ddb12276a9c5ee
Now that the RKP HAL AIDL has been moved to it's own directory, we
should keep the tests with the AIDL.
Test: atest VtsAidlKeyMintTargetTest
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Ia87d3ea0a1b9e6704f0dea8f98b0bbaa049472fe
As we've updated the KeyMint version to 3, update the default feature
version to 300. That allows external developers to tell which KeyMint
version is running on the device.
Bug: 244732345
Test: atest android.keystore.cts.DeviceOwnerKeyManagementTest
Change-Id: I9b333eeb77a62a79e8e664d40b5564767643aa3d
This add a cpp default so that the latest cpp code can be
used across the codebase. When this is changed we dont
need to bump versions across multiple files and can just
change it in this one file.
Test: Run and tested using `atest keystore2_test` for Rust test and CTS test with `atest CtsKeystoreTestCases`
Bug: 244730020
Change-Id: Ifae1c5f2403210c2dec1bc337553fbbde73ed4c8
Specifically, we want IRPC v3 to be able to serve old v2 clients. This
way we can ship parts IRPC v3 stack incrementally.
To that end, allow IRPC v3 to implement v2 behavior of
generateCertificateRequest and testMode.
Bug: 260920864
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I9e47697bd948c8fd6b82147165d0c67bdef9fbd3
Previous versions of VTS had to allow a Device ID attestation failure
to return INVALID_TAG even though this is inconsistent with the KeyMint
spec. This was due to previous KM implementations returning this before
the test was added to validate the precise error code being returned
from Device ID attestation.
For VSR-14 and newer devices, the test will now enforce that only
CANNOT_ATTEST_IDS is returned from a failed device ID attestation call.
Test: atest VtsAidlKeyMintTargetTest
Change-Id: I6acff3fd32f3f251f946e3603283535f36d99a5d
Update the comment describing the attestation record:
* KeyMint version bump to V3
* Inclusion of the 2nd IMEI.
Bug: 244732345
Test: That it builds
Change-Id: I19f89bc9936b747647dc690d4702c60d2bbe92c5
Rationale here is that many IRPC implementations are memory constrained.
We add a way for implementations to report the maximum number of
supported keys. This way we can guarantee consistent behavior across
different devices.
For implementation of IRPC version 3 and later we define the lowest
number of keys supported to be 20. This specific value was chosen
because the current implementation of RemoteProvisioner already combines
keys into batches of exactly 20.
Bug: 254137722
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: Ib6fb6d6ec7c74004524a5505a37aa82c9e44ef91
The key validity can be ignored when generatKey on Android-12 (S).
Bug: 257445538
Test: Pass on S builds
Change-Id: Iafd8d080f324c7d8d6affbb9d28d4f265f13e2ab
Conform to the latest CDDL changes. Organize parsing to observe the
AuthenticatedRequest structure.
Return the deserialized CSR payload rather than the DICE chain keys
because it simplified the return types. The return value is only used
by one VTS test that checks sequential CSRs consist of the same request.
The test was incomplete before and it now only looks as the CSR payload
whereas it previously only look at the DICE chain keys.
Bug: 250910137
Test: atest libkeymint_remote_prov_support_test librkp_factory_extraction_test
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I1ba2e0cec22e25312fb890923a4c93043e9046cd
Define a KeyMint tag for a second IMEI to be included in the attestation
record.
Also clarify that the IMEI tag is meant to include one, and only one,
IMEI.
Bug: 244732345
Test: android.keystore.cts.DeviceOwnerKeyManagementTest
Merged-In: I70ecbb0245ba2e517e5d0db0cfdce4525846f3e5
Change-Id: I70ecbb0245ba2e517e5d0db0cfdce4525846f3e5
Our old NetBSD regex implementation didn't care, but the current NetBSD
implementation rejects unquoted `{` and `}`s that aren't actually part
of a repetition. glibc shares this behavior.
Interestingly, the new NetBSD code was itself an sync with FreeBSD, so
although macOS right now allows this (as Android did), they may well
switch too.
Anyway, this way of writing the regular expressions is strictly correct,
so regardless of whether or not we can actually land this change to the
regex implementation without causing app compat chaos, we should fix
this test.
Bug: http://b/258469149
Test: treehugger
Change-Id: I85bf5d8f557a4fe5ac5ebeea565892d36da30b55
We are now checking the imports of frozen versions of interfaces and
need mark keystore2 as `frozen: false` so the aidl_interfaces that
import it will import the latest unfrozen version.
Test: hal_implementation_test
Bug: 257338648
Change-Id: Ibcb151abd2fc13e3f7dfbcf515d0f62839d1caf9
Execute only relevant benchmark tests for StrongBox.
Bug: b/229819550
Test: run VtsAidlKeyMintBenchmarkTest in the adb shell
Change-Id: I3bf95dc5d4bcd1da027e09b1bbde7e6173749481
"ImportWrappedKeyTest.WrongDigest" tried to wrap a keyBlob by one digest
type and unwrap it by another digest type.
It's been OK for KeyMint implementations to allow unsupported
parameters/characteristics at key generation time, and only police their
use, at begin() time. However if an implementation wants to secure it at
the key generation/importing time the first digest type must be
supported by all implementation.
Bug: 249276913
Test: VtsAidlKeyMintTargetTest
Change-Id: I6bc000026e9e4aec0aa82078a98c75e2d7c56847
Imported interfaces are versioned, i.e. bumping an interface version
necessiates bumping the version of importing interfaces.
Keystore and Identity import KM. We are uprevving KM, so all three need
to be bumped at the same time.
Test: m
Change-Id: I46b253e72f2f245bd628ed2ae1f2f4e0572827e7
Check against version of the interface reported by the HAL rather than
the one from generated code.
AIDL interface are meant to be backwards compatible. Having the HAL
report its version dynamically makes it easier to maintain legacy
behavior while evolving the interface, e.g. we bump IRPC to v3
across our codebase, but devices that already shipped may still behave
as v1/2 devices.
Bug: 235265072
Test: VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I49e3a09723590ac1a7c432b11450c1438563c787
The certificate signing request (CSR) CDDL schema comprises and
authentication wrapper and an inner payload containing details of the
request. Seperate these two parts more clearly in the schema with a view
to reusing the authentication wrapper for other messages.
The change of Csr to be defined in terms of the AuthenticatedMessage
generic type has no effective change on the schema.
A version field is added to CsrPayload, formerly SignedDataPayload, so
that the AuthenticatedMessage and CsrPayload schemas can evolve
independently.
The cert_type field of DeviceInfo is moved up a level into CsrPayload.
This means DeviceInfo only contains device information and not other
fields related to the CSR.
The payload of AuthenticatedMessage is not self-describing. The expected
schema of the payload will be inferred from context, for example the
server endpoint the message is sent to.
Bug: 250910137
Test: n/a - comments only
Change-Id: I2c981ec8fe63995779ce119168ad3d9b40d5b8c5
Change the cert_type field from an enum of strings to a tstr type with
the known types documented in comments. The types are part of the
protocol between the HAL implementation and the provisioning server that
is opaque to the Android platform, so there's not need to bump the HAL
version in order to add new certificate types.
Replace the undefined Dcc type/acronym with the term "DICE chain" for
smoother reading.
Make the behaviour of generateCertificateRequest() in the v3 HAL more
explicit by explaining that a ServiceSpecificException should be raised
with the same error code that is currently documented.
Bug: 240312857
Test: n/a - comments only
Change-Id: If5acc388b25fa24d240c936ddefd08943fc6dd8d
Changes:
- correct the sign of the timestamp comparison text
- make updateAad() and finish() refer to the auth text in begin()
- describe auth flows for keys with AUTH_TIMEOUT on devices without
a secure time source
Test: none, comment change only
Change-Id: Ia60a4a949e030a7a96772406e3b0f7b3211a0915
This way, rkp_factory_extraction_tool can reuse the code to perform a
test on the factory line if a partner so chooses.
Test: rkp_factory_extraction_tool --self_test
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Bug: 239839050
Change-Id: I3989ba606750be77f1945a50fe2307a631d19d11
rkp_factory_extraction_tool now reuses the VTS logic for validating the
DeviceInfo. This way, partners doing RKP testing can see locally if they
are getting bad DeviceInfo before they try to upload the data to the
google service.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Test: rkp_factory_extraction_tool
Bug: 239838563
Change-Id: I80fba3e624e1f5ab6da7aac889a0168f7cb8dbe4
This change gives additional context to the device info checks while.
Currently, an unprovisioned device will generate a massive spam of
failures which may be WAI for an early hardware revision device that
was not provisioned with attestation IDs.
Test: atest VtsHalRemotelyProvisionedComponentTest
Change-Id: I16069dba841a90aa55781148d3c268ced635e006
This change makes all of the changes to the HAL AIDL files, along with
corresponding documentation edits, to facilitate the definition for
version 3 of IRemotelyProvisionedComponent HAL.
The bulk of the changes are described within the RKP_CHANGELOG.md file
and will therefore not be discussed here within the commit message.
Bug: 240312857
Test: It is human readable and also builds.
Change-Id: I920550bdfe5a8f9ba677c4a4f67e975bcd3672ab
Commit 93c72cef92 ("KeyMint: sync all attestation tags",
http://aosp/1719302) removed various tags from the attestation that are
only applicable to symmetric keys, on the assumption that these are
irrelevant for the attestation extension that is generated for the
certificate holding asymmetric public keys.
However, that change did not take into account the fact that the
AuthorizationList ASN.1 schema is re-used elsewhere in the KeyMint API,
specifically as a way of describing the characteristics associated with
a key that is being securely imported via
IKeyMintDevice::importWrappedKey.
That import process may be used for symmetrics keys, and so the tags
that are specific to symmetric keys still need to be included in
AuthorizationList.
Similarly, USER_SECURE_ID values are never included in attestation
extensions because they have no meaning off-device, but they may be
needed as part of the import of a wrapped key.
Test: TreeHugger, comment change only
Bug: 244693617
Change-Id: Iaa941e120e3641a6e6c369b7c6a51f10b44df78a
The tag enum names can't be removed due to AIDL back-compatibility
requirements, and also it's useful to have the values present to avoid
inadvertent reuse.
Update the tag comment text to indicate that these tags are obsolete.
Bug: 191738660
Test: TreeHugger, comment change only
Change-Id: Icbd4c9cd0313f93bc491b49eb9077766d0f44e34
All attempts to use an EARLY_BOOT_ONLY key after earlyBootEnded()
is called must fail with Error::EARLY_BOOT_ENDED.
Test: run vts -m VtsAidlKeyMintTarget
Change-Id: Ic3d028ceb7f71e6e266993ec4e877770cd8e5c4a
Test size requirements for symmetric (Stream and Block) ciphers.
These tests are similar to CTS tests of symmetric ciphers.
For reference CTS test BlockCipherTestBase#testKatEncryptOneByteAtATime
for all its derived classes eg. AES128CBCNoPaddingCipherTest,
AES128CBCPKCS7PaddingCipherTest etc.
Bug: 226899425
Test: run vts -m VtsAidlKeyMintTargetTest
Change-Id: I78408071fbf5a360d89c5bbae479faffd7c6d935
KeyMint supports the specification of a separate MGF digest when
performing RSA-OAEP decryption, with a default value of SHA-1.
Test the expected behaviour here:
- SHA-1 is used if nothing specified in key characteristics.
- If something is specified in key characteristics, the operation
parameter value has to be one of those values.
Bug: 203688354
Test: VtsAidlKeyMintTargetTest
Change-Id: Ic2dd3641be732a273724faa20cf4edf8a1752506
This document is meant to provide a clear summation for vendors looking
for a reference of what has changed from release to release, as well as
documentation for those working on developing the
IRemotelyProvisionedComponent interface.
Bug: 227266513
Test: The document is readable.
Change-Id: I909e22a31a88856af911a80a52ec7eda263693db
- Remove KeyPurpose comments that refer to public key operations.
- Clarify/fix description of RSA_OAEP_MGF_DIGEST.
- Describe HMAC key requirements.
- Clarify RSA_PSS key length requirement
- Clarify when shared secret should change (on restart)
- Padding::NONE is not deprecated
- Fix typos
Test: none, just comment changes
Change-Id: If58e8d8644aac926a990e50f7a873dca74cd4896
This document goes a little more in depth on the motivating factors and
background mechanisms that occur with RKP, that are not appropriate for
direct inclusion in the HAL docs in the .aidl files.
Fixes: 234159998
Test: Readable
Merged-In: I141fb098c536a5468b1113af64dcf6185ea7ae9f
Change-Id: I141fb098c536a5468b1113af64dcf6185ea7ae9f
Some are still in VNDK because they are used in other VNDK libs.
Bug: 234181591
Test: m
Merged-In: If999df9c78a20df931177da11742b1c5de19bc08
Change-Id: If999df9c78a20df931177da11742b1c5de19bc08
Some are still in VNDK because they are used in other VNDK libs.
Ignore-AOSP-First: some libs are still in internal master only.
Bug: 234181591
Test: m
Merged-In: If999df9c78a20df931177da11742b1c5de19bc08
Change-Id: If999df9c78a20df931177da11742b1c5de19bc08
(cherry picked from commit 5527adfd7f)
This change syncs aosp/master with the change in http://aosp/2117528,
allowing devices that launched with the (incorrect) version of
ATTEST_KEY VTS tests in Android S to continue to pass the test.
Bug: 197096139
Bug: 230074335
Test: VtsAidlKeyMintTargetTest
Change-Id: If88642e238e64ca9ec80303a4a72f7171c63464f
Merged-In: If88642e238e64ca9ec80303a4a72f7171c63464f
This change syncs aosp/master with the change in http://aosp/2117528,
allowing devices that launched with the (incorrect) version of
ATTEST_KEY VTS tests in Android S to continue to pass the test.
Bug: 197096139
Bug: 230074335
Test: VtsAidlKeyMintTargetTest
Change-Id: If88642e238e64ca9ec80303a4a72f7171c63464f
This document goes a little more in depth on the motivating factors and
background mechanisms that occur with RKP, that are not appropriate for
direct inclusion in the HAL docs in the .aidl files.
Bug: 234159998
Test: Readable
Change-Id: I141fb098c536a5468b1113af64dcf6185ea7ae9f
Check if the zero input data with AES-CBC-[NONE|PKCS7] padding mode
generates correct output data and length.
Bug: 200553873
Test: VtsHalKeymasterV4_0TargetTest, VtsAidlKeyMintTargetTest
Merged-In: I729c2bad65e9d8b194422032346e5ee3c4b0dce5
Change-Id: I729c2bad65e9d8b194422032346e5ee3c4b0dce5
The identifier is to be used in telemetry to identify problematic
implementations. Thus, it needs to be globally consistent, at least
within a given device type.
Test: None -- doc only changes
Bug: 231495834
Change-Id: Ia55db336fa099d8e1196f6bfe2bafb6fa5ead329
Merged-In: Ia55db336fa099d8e1196f6bfe2bafb6fa5ead329
The identifier is to be used in telemetry to identify problematic
implementations. Thus, it needs to be globally consistent, at least
within a given device type.
Test: None -- doc only changes
Bug: 231495834
Change-Id: Ia55db336fa099d8e1196f6bfe2bafb6fa5ead329
Merged-In: Ia55db336fa099d8e1196f6bfe2bafb6fa5ead329
EC_CURVE is a mandatory tag which is specified in the keymint HAL when
generating EC keys.
Bug: 232056693
Change-Id: Ibe2b85744d7e555b7c7b48aa9e57ce45bb19ef89
The data for a key agreement operation should always send in the
SubjectPublicKeyInfo structure, not a raw key for X25519.
Test: VtsAidlKeyMintTargetTest
Bug: 231959070
Change-Id: Ib5157da6a986d957162fab60dbe927017cfdd703
Merged-In: Ib5157da6a986d957162fab60dbe927017cfdd703
The data for a key agreement operation should always send in the
SubjectPublicKeyInfo structure, not a raw key for X25519.
Test: VtsAidlKeyMintTargetTest
Bug: 231959070
Change-Id: Ib5157da6a986d957162fab60dbe927017cfdd703
- Fix up some minor CDDL formatting issues.
- Add more definition around the BCC, hopefully clearing up partner
confusion around how to implement it.
- Explain when BccPayload entries may be omitted in the case of a
"Degenerate BCC"
- Add a bit more description to the DKSignature format
Bug: 227350250
Test: N/A -- doc changes only
Change-Id: I28337a80e2b49661cc37876400d7ac3b8759ba01
Merged-In: I28337a80e2b49661cc37876400d7ac3b8759ba01
As the signature of the getKeyCharacteristics() does not
use Tag Mechanism for app_id and app_data, there is no way
to distinguish between appId / appData values that are
absent, vs values that are present but of zero length. Due to
this limitation a key with a zero-length app_id / app_data
cannot have its key characteristics retrieved using
getKeyCharacteristics()
Test: VtsAidlKeyMintTarget
Change-Id: I145dcba878171c174d48ad42fadeb49e045b5c55
The root of trust consists of a bitstring that must be derived
from the public key used by Verified Boot, from the lock state
and from the Verified Boot state of the device.
Test: VtsAidlKeyMintTarget
Change-Id: Ib20bf17066f087c6fc050a498cc7ed4a4cb08ae6
- Fix up some minor CDDL formatting issues.
- Add more definition around the BCC, hopefully clearing up partner
confusion around how to implement it.
- Explain when BccPayload entries may be omitted in the case of a
"Degenerate BCC"
- Add a bit more description to the DKSignature format
Bug: 227350250
Test: N/A -- doc changes only
Change-Id: I28337a80e2b49661cc37876400d7ac3b8759ba01
VTS tests were currently passing a challenge size of 32 in all cases.
However, the server currently sends a challenge of length 40, which may
or may not change in the future. A 64 byte upper limit provides a
standard size along with flexibility in case the challenge format
changes in the future.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I678bb915f139e4c23354180870a66ce33a9cfd8c
The AesEcbPkcs7PaddingCorrupted test has been incorrect since it was
originally introduced -- it was feeding the original message as input to
the decryption operation, rather than the corrupted ciphertext. As a
result, the expected error code was also wrong -- INVALID_INPUT_LENGTH
is appropriate for a too-short cipher text (length 1 in this case),
whereas a corrupt-but-correct-length cipher text should give
INVALID_ARGUMENT.
Fix the test, and add a separate test to cover what was inadvertently
being tested before. Add a sentence to the HAL spec to describe what
expected and tested by CTS/VTS.
Bug: 194126736
Test: VtsAidlKeyMintTargetTest, VtsHalKeymasterV4_0TargetTest
Change-Id: Iaa5e42768814197f373797831093cf344d342b77
* changes:
Implement getInterfaceHash/Version for SoundTrigger
Add -Wno-missing-permission-annotation for soundtrigger3
V3 is the latest version of keymaster HAL interface
Freeze AIDL APIs for TM
Added new VTS EcdsaMissingCurve to test if EC_CURVE not specified while
generating new EC Key, keyGeneration should fail.
Bug: 225135360
Test: run vts -m VtsAidlKeyMintTargetTest
Change-Id: I32bbba05ed5203690292f7150d14f9644c4be6df
Updated VTS testcases where Device IDs Attestation expected as optional
and made it mandatory if KeyMint version >= 2 or device first shipped
with api_level 33.
Bug: 221190197
Test: run vts -m VtsAidlKeyMintTargetTest
Change-Id: I8870a9301d36abdc4fa6585b9f8d62cc1cfd3d96
The signature is not CBOR-encoded, it's the raw bytes of the signature
encoded as specified for the specific algorithm.
I've made the references to PureEd25519() / ECDSA() into comments,
since I believe they're not actually legal CDDL but are aimed at
humans. And I've made the two occurrences consistent with each other.
Test: N/A
Change-Id: Ia42362ff3d0ce5458322663256cbd34d258afe76
This change makes sure the DeviceInfo CBOR map is canonicalized before
the signature check instead of just separately checking the
canonicalization in a separate call. Additionally, some ASSERTs have
been changed to EXPECTs in validation of the DeviceInfo map more
generally, where it makes sense to avoid failing immediately.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Change-Id: I69806c887656772ea6b5e2e3f0af50957e6b05e3
Change Id62fdce65131ee00c88e5849955a937f1c171748 split up the AES
incremental encryption tests into individual tests for each encryption
mode. This meant that each generated key is only valid for a single
mode, which in turn means that for non-GCM mode keys it is not valid
to specify MIN_MAC_LENGTH.
Bug: 223934835
Test: VtsAidlKeyMintTargetTest
Change-Id: I38f34f60116bde3d23f203365d62e5b25d7b254b
As the current KeyMint version is 2 (200), reflect that in the default
XML.
Devices that ship with older KeyMint/KeyMaster version should override
the default android.hardware.hardware_keystore.xml file with the
version they support.
Test: android.keystore.cts.KeyAttestationTest#testAttestationKmVersionMatchesFeatureVersion
Bug: 222406513
Bug: 216543583
Change-Id: I6f2229019929cff747cec3907fc2a9b8ebebdcf4
Don't run tests if the appropriate KeyMint device is not available (e.g.
on something that only has Keymaster). Move to use GTEST_SKIP
consistently.
Bug: 221909227
Test: VtsAidlKeyMintTargetTest
Change-Id: I5dab238519e57e6752b795f3a983681cf4337bdd
