1 /*
2  * Copyright 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef SYSTEM_KEYMASTER_OPERATION_H_
18 #define SYSTEM_KEYMASTER_OPERATION_H_
19 
20 #include <assert.h>
21 #include <stdint.h>
22 #include <stdlib.h>
23 
24 #include <hardware/keymaster_defs.h>
25 #include <keymaster/android_keymaster_utils.h>
26 #include <keymaster/authorization_set.h>
27 #include <keymaster/logger.h>
28 
29 namespace keymaster {
30 
31 class AuthorizationSet;
32 class Key;
33 class Operation;
34 using OperationPtr = UniquePtr<Operation>;
35 
36 class OperationFactory {
37   public:
~OperationFactory()38     virtual ~OperationFactory() {}
39 
40     // Required for registry
41     struct KeyType {
KeyTypeKeyType42         KeyType(keymaster_algorithm_t alg, keymaster_purpose_t purp)
43             : algorithm(alg), purpose(purp) {}
44 
45         keymaster_algorithm_t algorithm;
46         keymaster_purpose_t purpose;
47 
48         bool operator==(const KeyType& rhs) const {
49             return algorithm == rhs.algorithm && purpose == rhs.purpose;
50         }
51     };
52     virtual KeyType registry_key() const = 0;
53 
54     // Factory methods
55     virtual OperationPtr CreateOperation(Key&& key, const AuthorizationSet& begin_params,
56                                          keymaster_error_t* error) = 0;
57 
58     // Informational methods.  The returned arrays reference static memory and must not be
59     // deallocated or modified.
SupportedPaddingModes(size_t * padding_count)60     virtual const keymaster_padding_t* SupportedPaddingModes(size_t* padding_count) const {
61         *padding_count = 0;
62         return nullptr;
63     }
SupportedBlockModes(size_t * block_mode_count)64     virtual const keymaster_block_mode_t* SupportedBlockModes(size_t* block_mode_count) const {
65         *block_mode_count = 0;
66         return nullptr;
67     }
SupportedDigests(size_t * digest_count)68     virtual const keymaster_digest_t* SupportedDigests(size_t* digest_count) const {
69         *digest_count = 0;
70         return nullptr;
71     }
72 
73     // Convenience methods
74     bool supported(keymaster_padding_t padding) const;
75     bool supported(keymaster_block_mode_t padding) const;
76     bool supported(keymaster_digest_t padding) const;
77 
78     bool is_public_key_operation() const;
79 
80     bool GetAndValidatePadding(const AuthorizationSet& begin_params, const Key& key,
81                                keymaster_padding_t* padding, keymaster_error_t* error) const;
82     bool GetAndValidateDigest(const AuthorizationSet& begin_params, const Key& key,
83                               keymaster_digest_t* digest, keymaster_error_t* error) const;
84     bool GetAndValidateDigest(const AuthorizationSet& begin_params, const Key& key,
85                               keymaster_digest_t* digest, keymaster_error_t* error,
86                               bool require_explicit_digest) const;
87 };
88 
89 /**
90  * Abstract base for all cryptographic operations.
91  */
92 class Operation {
93   public:
Operation(keymaster_purpose_t purpose,AuthorizationSet && hw_enforced,AuthorizationSet && sw_enforced)94     explicit Operation(keymaster_purpose_t purpose, AuthorizationSet&& hw_enforced,
95                        AuthorizationSet&& sw_enforced)
96         : purpose_(purpose), hw_enforced_(move(hw_enforced)), sw_enforced_(move(sw_enforced)) {}
~Operation()97     virtual ~Operation() {}
98 
99     Operation(const Operation&) = delete;
100     void operator=(const Operation&) = delete;
101 
purpose()102     keymaster_purpose_t purpose() const { return purpose_; }
103 
set_key_id(uint64_t key_id)104     void set_key_id(uint64_t key_id) { key_id_ = key_id; }
key_id()105     uint64_t key_id() const { return key_id_; }
operation_handle()106     virtual keymaster_operation_handle_t operation_handle() const { return operation_handle_; }
107 
authorizations()108     AuthProxy authorizations() const { return AuthProxy(hw_enforced_, sw_enforced_); }
109 
110     virtual keymaster_error_t Begin(const AuthorizationSet& input_params,
111                                     AuthorizationSet* output_params) = 0;
112     virtual keymaster_error_t Update(const AuthorizationSet& input_params, const Buffer& input,
113                                      AuthorizationSet* output_params, Buffer* output,
114                                      size_t* input_consumed) = 0;
115     virtual keymaster_error_t Finish(const AuthorizationSet& input_params, const Buffer& input,
116                                      const Buffer& signature, AuthorizationSet* output_params,
117                                      Buffer* output) = 0;
118     virtual keymaster_error_t Abort() = 0;
119 
120   protected:
121     // Helper function for implementing Finish() methods that need to call Update() to process
122     // input, but don't expect any output.
123     keymaster_error_t UpdateForFinish(const AuthorizationSet& input_params, const Buffer& input);
124     keymaster_operation_handle_t operation_handle_;
125 
126   private:
127     const keymaster_purpose_t purpose_;
128     AuthorizationSet hw_enforced_;
129     AuthorizationSet sw_enforced_;
130     uint64_t key_id_;
131 };
132 
133 }  // namespace keymaster
134 
135 #endif  // SYSTEM_KEYMASTER_OPERATION_H_
136