tequilaOS/platform_system_security
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Flag for import of previously-emulated keys

Browse source 
Test: build
Bug: 283077822
Change-Id: I28f673b6eb905c2953fbb91f2658ff224ca0e21c
This commit is contained in:
David Drysdale 2023-11-09 08:32:02 +00:00
parent 746e1be8ef
commit 093811ef22
2 changed files with 15 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
keystore2/aconfig/flags.aconfig
View file

@ -15,3 +15,11 @@ flag {
bug: "307460850" bug: "307460850"
is_fixed_read_only: true is_fixed_read_only: true
} }
flag {
name: "import_previously_emulated_keys"
namespace: "hardware_backed_security"
description: "Include support for importing keys that were previously software-emulated into KeyMint"
bug: "283077822"
is_fixed_read_only: true
}

11
keystore2/src/utils.rs
View file

@ -367,7 +367,9 @@ where
km_op, km_op,
new_blob_handler, new_blob_handler,
) )
} else if key_blob.starts_with(km_compat::KEYMASTER_BLOB_SW_PREFIX) { } else if keystore2_flags::import_previously_emulated_keys()
&& key_blob.starts_with(km_compat::KEYMASTER_BLOB_SW_PREFIX)
{
// 2) The keyblob was created in software by the km_compat C++ code because a prior // 2) The keyblob was created in software by the km_compat C++ code because a prior
// Keymaster implementation did not support ECDH (which was only added in KeyMint). // Keymaster implementation did not support ECDH (which was only added in KeyMint).
// //
@ -386,9 +388,10 @@ where
km_op, km_op,
new_blob_handler, new_blob_handler,
) )
} else if let km_compat::KeyBlob::Wrapped(inner_keyblob) = } else if let (true, km_compat::KeyBlob::Wrapped(inner_keyblob)) = (
km_compat::unwrap_keyblob(key_blob) keystore2_flags::import_previously_emulated_keys(),
{ km_compat::unwrap_keyblob(key_blob),
) {
// 3) The keyblob was created in software by km_compat.rs because a prior KeyMint // 3) The keyblob was created in software by km_compat.rs because a prior KeyMint
// implementation did not support a feature present in the current KeyMint spec. // implementation did not support a feature present in the current KeyMint spec.
// (For example, a curve 25519 key created when the device only supported KeyMint // (For example, a curve 25519 key created when the device only supported KeyMint