27407a5743
The root of the problem is that in some cases credstore would
pass auth- and verification-tokens to the Identity Credential
HAL without first having obtained a challenge via
IIdentityCredential.createAuthChallenge(). This makes it
impossible for the TA to validate the verification token for
freshness.
This is easily fixed by simply ensuring createAuthChallenge()
is called (and the returned challenge is used in the requested
verification token) whenever dealing with ACPs using user
authentication.
Additional issues / changes:
- During Android 12 development, an use-after-free bug was
introduced in Credential.cpp L120.
- keystore's getTokensForCredstore() had some bugs in how to
select an auth-token, in particular mixing authTokenAgeMillis
(milliseconds) with time_t values (seconds)
- as a result, keystore would sometimes return tokens older
than what credstore requested. This wasn't actually problem
because the TA would check it anyway.
- we now precisely define semantics in IKeystoreService.aidl
- Another potential use-after-free bug was found in
Credential.cpp L767
None of the fixes for these bugs affect CTS or VTS tests.
Bug: 181893400
Test: atest android.security.identity.cts on emulator
Test: atest android.security.identity.cts on crosshatch (w/ Android 11 era HAL)
Test: CtsVerifier's Identity Credential Authentication test crosshatch (w/ Android 11 era HAL)
Change-Id: I45a3fd16eff3b6a232d8b8c88f2e3dd3619a9c03
86 lines
2.9 KiB
C++
86 lines
2.9 KiB
C++
/*
|
|
* Copyright (c) 2019, The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#ifndef SYSTEM_SECURITY_WRITABLE_CREDENTIAL_H_
|
|
#define SYSTEM_SECURITY_WRITABLE_CREDENTIAL_H_
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include <android/security/identity/BnWritableCredential.h>
|
|
|
|
#include <android/hardware/identity/IIdentityCredentialStore.h>
|
|
|
|
#include "Credential.h"
|
|
|
|
namespace android {
|
|
namespace security {
|
|
namespace identity {
|
|
|
|
using ::android::binder::Status;
|
|
using ::android::hardware::identity::HardwareInformation;
|
|
using ::android::hardware::identity::IWritableIdentityCredential;
|
|
using ::std::string;
|
|
using ::std::vector;
|
|
|
|
class WritableCredential : public BnWritableCredential {
|
|
public:
|
|
WritableCredential(const string& dataPath, const string& credentialName, const string& docType,
|
|
bool isUpdate, HardwareInformation hwInfo,
|
|
sp<IWritableIdentityCredential> halBinder);
|
|
~WritableCredential();
|
|
|
|
// Used when updating a credential
|
|
void setAttestationCertificate(const vector<uint8_t>& attestationCertificate);
|
|
void setAvailableAuthenticationKeys(int keyCount, int maxUsesPerKey);
|
|
|
|
// Used by Credential::update()
|
|
void setCredentialToReloadWhenUpdated(sp<Credential> credential);
|
|
|
|
// IWritableCredential overrides
|
|
Status getCredentialKeyCertificateChain(const vector<uint8_t>& challenge,
|
|
vector<uint8_t>* _aidl_return) override;
|
|
|
|
Status personalize(const vector<AccessControlProfileParcel>& accessControlProfiles,
|
|
const vector<EntryNamespaceParcel>& entryNamespaces, int64_t secureUserId,
|
|
vector<uint8_t>* _aidl_return) override;
|
|
|
|
private:
|
|
string dataPath_;
|
|
string credentialName_;
|
|
string docType_;
|
|
bool isUpdate_;
|
|
HardwareInformation hwInfo_;
|
|
sp<IWritableIdentityCredential> halBinder_;
|
|
|
|
vector<uint8_t> attestationCertificate_;
|
|
int keyCount_ = 0;
|
|
int maxUsesPerKey_ = 1;
|
|
|
|
sp<Credential> credentialToReloadWhenUpdated_;
|
|
|
|
ssize_t calcExpectedProofOfProvisioningSize(
|
|
const vector<AccessControlProfileParcel>& accessControlProfiles,
|
|
const vector<EntryNamespaceParcel>& entryNamespaces);
|
|
|
|
Status ensureAttestationCertificateExists(const vector<uint8_t>& challenge);
|
|
};
|
|
|
|
} // namespace identity
|
|
} // namespace security
|
|
} // namespace android
|
|
|
|
#endif // SYSTEM_SECURITY_WRITABLE_CREDENTIAL_H_
|