1 /*
2  * Copyright 2015 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_
18 #define SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_
19 
20 #include <memory>
21 
22 #include <openssl/ec.h>
23 #include <openssl/engine.h>
24 #include <openssl/ex_data.h>
25 #include <openssl/rsa.h>
26 
27 #include <hardware/keymaster0.h>
28 #include <hardware/keymaster_defs.h>
29 
30 namespace keymaster {
31 
32 template<typename BlobType> struct TKeymasterBlob;
33 typedef TKeymasterBlob<keymaster_key_blob_t> KeymasterKeyBlob;
34 
35 /* Keymaster0Engine is a BoringSSL ENGINE that implements RSA & EC by forwarding the requested
36  * operations to a keymaster0 module. */
37 class Keymaster0Engine {
38   public:
39     /**
40      * Create a Keymaster0Engine, wrapping the provided keymaster0_device.  The engine takes
41      * ownership of the device, and will close it during destruction.
42      */
43     explicit Keymaster0Engine(const keymaster0_device_t* keymaster0_device);
44     ~Keymaster0Engine();
45 
supports_ec()46     bool supports_ec() const { return supports_ec_; }
47 
48     bool GenerateRsaKey(uint64_t public_exponent, uint32_t public_modulus,
49                         KeymasterKeyBlob* key_material) const;
50     bool GenerateEcKey(uint32_t key_size, KeymasterKeyBlob* key_material) const;
51 
52     bool ImportKey(keymaster_key_format_t key_format, const KeymasterKeyBlob& to_import,
53                    KeymasterKeyBlob* imported_key_material) const;
54     bool DeleteKey(const KeymasterKeyBlob& blob) const;
55     bool DeleteAllKeys() const;
56 
57     RSA* BlobToRsaKey(const KeymasterKeyBlob& blob) const;
58     EC_KEY* BlobToEcKey(const KeymasterKeyBlob& blob) const;
59 
60     const keymaster_key_blob_t* RsaKeyToBlob(const RSA* rsa) const;
61     const keymaster_key_blob_t* EcKeyToBlob(const EC_KEY* rsa) const;
62 
device()63     const keymaster0_device_t* device() { return keymaster0_device_; }
64 
65     EVP_PKEY* GetKeymaster0PublicKey(const KeymasterKeyBlob& blob) const;
66 
67   private:
68     Keymaster0Engine(const Keymaster0Engine&);  // Uncopyable
69     void operator=(const Keymaster0Engine&);    // Unassignable
70 
71     static int keyblob_dup(CRYPTO_EX_DATA* to, const CRYPTO_EX_DATA* from, void** from_d, int index,
72                            long argl, void* argp);
73     static void keyblob_free(void* parent, void* ptr, CRYPTO_EX_DATA* data, int index, long argl,
74                              void* argp);
75     static int rsa_private_transform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len);
76     static int ecdsa_sign(const uint8_t* digest, size_t digest_len, uint8_t* sig,
77                           unsigned int* sig_len, EC_KEY* ec_key);
78 
79     struct Malloc_Delete {
operatorMalloc_Delete80         void operator()(void* p) { free(p); }
81     };
82 
83     bool Keymaster0Sign(const void* signing_params, const keymaster_key_blob_t& key_blob,
84                         const uint8_t* data, const size_t data_length,
85                         std::unique_ptr<uint8_t[], Malloc_Delete>* signature,
86                         size_t* signature_length) const;
87 
88     int RsaPrivateTransform(RSA* rsa, uint8_t* out, const uint8_t* in, size_t len) const;
89     int EcdsaSign(const uint8_t* digest, size_t digest_len, uint8_t* sig, unsigned int* sig_len,
90                   EC_KEY* ec_key) const;
91 
92     const keymaster0_device_t* keymaster0_device_;
93     ENGINE* const engine_;
94     int rsa_index_, ec_key_index_;
95     bool supports_ec_;
96     RSA_METHOD rsa_method_;
97     ECDSA_METHOD ecdsa_method_;
98 
99     static Keymaster0Engine* instance_;
100 };
101 
102 }  // namespace keymaster
103 
104 #endif  // SYSTEM_KEYMASTER_KEYMASTER0_ENGINE_H_
105