tequilaOS/platform_system_security
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_security/keystore
History
Eran Messeri 03fc4c8769 KeyStore: Limit the Attestation Application ID 
Limit the size of the Application ID attestation vector _prior_ to
sending it for attestation by Keymaster.
Previously, the Attestation Application ID vector would be DER-encoded
to contain all packages belonging to the caller UID, and only then
truncated to the max value that could be sent to Keymaster (1K),
potentially resulting in malformed DER-encoded data.

This makes clients' lives hard, as they would have to deal with
malformed DER, and breaks CTS tests that expect to parse this field in
the attestation record, when the device has too many packages running on
the system UID.

This change limits the size of the DER-encoded vector that would be
passed into Keymaster by estimating the encoded size and refraining from
adding any more package information into it if it'd exceed 1K when
encoded.

Also, cope with PackageManager failure to provide the list of packages.

Merged-In: I39ab9338922f7be358d27e1b2dae5d0a36009109

Test: keystore_unit_tests (adb pushed to /data/local/tmp, then: LD_LIBRARY_PATH=/data/local/tmp /data/local/tmp/keystore_unit_tests)
Test: runtest --path cts/tests/tests/keystore/src/android/keystore/cts/KeyAttestationTest.java
Test: atest com.android.cts.devicepolicy.MixedDeviceOwnerTest#testKeyManagement
Bug: 112179406
Bug: 112061724
Bug: 111260028
Change-Id: I0759a632fbf678814f6b1c258f0b2e2524edb85c
2018-08-16 18:53:15 +01:00
..
binder/android/security Add "unlocked device required" keystore API 2018-03-28 08:38:57 -07:00
include/keystore KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
tests KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
Android.bp KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
auth_token_table.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
auth_token_table.h Use libkeymaster4support in keystore. 2017-12-27 09:24:19 -08:00
authorization_set.cpp Use libkeymaster4support in keystore. 2017-12-27 09:24:19 -08:00
blob.cpp NIAP: Log key integrity failure to audit log. 2018-02-15 18:20:28 +00:00
blob.h KeyStore: use security level to chose keymaster device 2017-12-27 16:38:09 -08:00
confirmation_manager.cpp Implement rate limiting on a per app basis for confirmationui 2018-03-14 13:36:56 -07:00
confirmation_manager.h Implement rate limiting on a per app basis for confirmationui 2018-03-14 13:36:56 -07:00
confirmationui_rate_limiting.h Implement rate limiting on a per app basis for confirmationui 2018-03-14 13:36:56 -07:00
defaults.h Port to binderized keymaster HAL 2017-01-23 08:30:49 -07:00
entropy.cpp Refactor keystore. 2016-01-26 22:48:06 -07:00
entropy.h Refactor keystore. 2016-01-26 22:48:06 -07:00
grant_store.cpp Fix multiple issues with the keystore grant mechanism 2017-10-02 09:58:04 -07:00
grant_store.h Fix multiple issues with the keystore grant mechanism 2017-10-02 09:58:04 -07:00
key_config.proto Adding DropBox logging support for keystore functionality 2018-04-25 21:46:08 +00:00
key_proto_handler.cpp Adding DropBox logging support for keystore functionality 2018-04-25 21:46:08 +00:00
key_proto_handler.h Adding DropBox logging support for keystore functionality 2018-04-25 21:46:08 +00:00
key_store_service.cpp KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
key_store_service.h Track active user inside keystore service 2018-03-31 17:20:26 -07:00
KeyAttestationApplicationId.cpp KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
KeyAttestationPackageInfo.cpp Fix version code handling in attestation records 2017-12-28 22:14:52 +00:00
keyblob_utils.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
keymaster_enforcement.cpp Restore "Add "Unlocked device required" parameter to keys" 2018-03-28 08:38:57 -07:00
keymaster_enforcement.h Add "unlocked device required" keystore API 2018-03-28 08:38:57 -07:00
KeymasterArguments.cpp Move keystore to Keymaster4 2017-12-20 09:01:01 -07:00
KeyStore.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
KeyStore.h Move Keymaster wrappers to the KM4 support lib 2018-01-18 15:38:55 -07:00
keystore.rc Log key import, destruction and generation failure for audit. 2018-01-29 20:11:06 +00:00
keystore_aidl_hidl_marshalling_utils.cpp Move keystore to Keymaster4 2017-12-20 09:01:01 -07:00
keystore_aidl_hidl_marshalling_utils.h Use libkeymaster4support in keystore. 2017-12-27 09:24:19 -08:00
keystore_attestation_id.cpp KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
keystore_attestation_id.h KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
keystore_cli.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
keystore_cli_v2.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
keystore_client.proto Add encryption convenience methods to KeystoreClient. 2015-11-02 09:12:59 -08:00
keystore_client_impl.cpp KeyStore: use security level to chose keymaster device 2017-12-27 16:38:09 -08:00
keystore_get.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
keystore_get_wifi_hidl.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
keystore_keymaster_enforcement.h Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
keystore_main.cpp Move HMAC agreement to vold 2018-05-09 15:47:15 -06:00
keystore_utils.cpp NIAP: Log key integrity failure to audit log. 2018-02-15 18:20:28 +00:00
keystore_utils.h NIAP: Log key integrity failure to audit log. 2018-02-15 18:20:28 +00:00
KeystoreArguments.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
legacy_keymaster_device_wrapper.cpp Revert "Delegate auth token parsing to HAL." 2017-03-28 00:44:33 +00:00
legacy_keymaster_device_wrapper.h Revert "Delegate auth token parsing to HAL." 2017-03-28 00:44:33 +00:00
operation.cpp Fix StrongBox verification token support. 2018-05-22 17:00:26 -06:00
operation.h Fix StrongBox verification token support. 2018-05-22 17:00:26 -06:00
operation_config.proto Adding DropBox logging support for keystore functionality 2018-04-25 21:46:08 +00:00
operation_proto_handler.cpp Adding DropBox logging support for keystore functionality 2018-04-25 21:46:08 +00:00
operation_proto_handler.h Adding DropBox logging support for keystore functionality 2018-04-25 21:46:08 +00:00
operation_struct.h Fix StrongBox verification token support. 2018-05-22 17:00:26 -06:00
OperationResult.cpp Use libkeymaster4support in keystore. 2017-12-27 09:24:19 -08:00
permissions.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
permissions.h Fix multiple issues with the keystore grant mechanism 2017-10-02 09:58:04 -07:00
Signature.cpp KeyStore: Limit the Attestation Application ID 2018-08-16 18:53:15 +01:00
test-keystore Revive test script for keystore 2015-09-24 21:10:20 +03:00
user_state.cpp Modernize codebase by replacing NULL with nullptr 2018-07-30 01:40:01 -07:00
user_state.h Use AES-GCM to encrypt keystore blobs. 2017-05-23 20:16:04 -06:00