p71924506
/
aosp12
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
aosp12/system/keymaster/tests/android_keymaster_test.cpp

4202 lines
187 KiB
C++
Raw Permalink Blame History

/*
* Copyright (C) 2014 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include <fstream>
#include <memory>
#include <string>
#include <vector>
#include <openssl/evp.h>
#include <openssl/x509.h>
#include <keymaster/android_keymaster.h>
#include <keymaster/contexts/pure_soft_keymaster_context.h>
#include <keymaster/contexts/soft_keymaster_context.h>
#include <keymaster/key_factory.h>
#include <keymaster/km_openssl/attestation_record.h>
#include <keymaster/km_openssl/hmac_key.h>
#include <keymaster/km_openssl/openssl_utils.h>
#include <keymaster/km_openssl/soft_keymaster_enforcement.h>
#include <keymaster/soft_keymaster_device.h>
#include "android_keymaster_test_utils.h"
#include "test_keys.h"
using std::ifstream;
using std::istreambuf_iterator;
using std::ofstream;
using std::string;
using std::unique_ptr;
using std::vector;
extern "C" {
int __android_log_print(int prio, const char* tag, const char* fmt);
int __android_log_print(int prio, const char* tag, const char* fmt) {
(void)prio, (void)tag, (void)fmt;
return 0;
}
} // extern "C"
namespace {
// For some reason std::make_unique isn't available. Define make_unique.
template <typename T, typename... Args> std::unique_ptr<T> make_unique(Args&&... args) {
return std::unique_ptr<T>(new T(std::forward<Args>(args)...));
}
} // namespace
namespace keymaster {
namespace test {
const uint32_t kOsVersion = 060000;
const uint32_t kOsPatchLevel = 201603;
StdoutLogger logger;
template <typename T> vector<T> make_vector(const T* array, size_t len) {
return vector<T>(array, array + len);
}
/**
* KeymasterEnforcement class for use in testing. It's permissive in the sense that it doesn't
* check cryptoperiods, but restrictive in the sense that the clock never advances (so rate-limited
* keys will only work once).
*/
class TestKeymasterEnforcement : public SoftKeymasterEnforcement {
public:
TestKeymasterEnforcement() : SoftKeymasterEnforcement(3, 3) {}
virtual bool activation_date_valid(uint64_t /* activation_date */) const { return true; }
virtual bool expiration_date_passed(uint64_t /* expiration_date */) const { return false; }
virtual bool auth_token_timed_out(const hw_auth_token_t& /* token */,
uint32_t /* timeout */) const {
return false;
}
virtual uint32_t get_current_time() const { return 0; }
virtual bool ValidateTokenSignature(const hw_auth_token_t& /* token */) const { return true; }
};
/**
* Variant of SoftKeymasterContext that provides a TestKeymasterEnforcement.
*/
class TestKeymasterContext : public SoftKeymasterContext {
public:
TestKeymasterContext() : SoftKeymasterContext(kCurrentKmVersion) {}
TestKeymasterContext(KmVersion version) : SoftKeymasterContext(version) {}
explicit TestKeymasterContext(const string& root_of_trust)
: SoftKeymasterContext(kCurrentKmVersion, root_of_trust) {}
explicit TestKeymasterContext(KmVersion version, const string& root_of_trust)
: SoftKeymasterContext(version, root_of_trust) {}
KeymasterEnforcement* enforcement_policy() override { return &test_policy_; }
private:
TestKeymasterEnforcement test_policy_;
};
/**
* Test instance creator that builds a pure software keymaster2 implementation.
*/
class SoftKeymasterTestInstanceCreator : public Keymaster2TestInstanceCreator {
public:
keymaster2_device_t* CreateDevice() const override {
std::cerr << "Creating software-only device" << std::endl;
context_ = new TestKeymasterContext(KmVersion::KEYMASTER_4_1);
SoftKeymasterDevice* device = new SoftKeymasterDevice(context_);
AuthorizationSet version_info(AuthorizationSetBuilder()
.Authorization(TAG_OS_VERSION, kOsVersion)
.Authorization(TAG_OS_PATCHLEVEL, kOsPatchLevel));
device->keymaster2_device()->configure(device->keymaster2_device(), &version_info);
return device->keymaster2_device();
}
bool is_keymaster1_hw() const override { return false; }
KeymasterContext* keymaster_context() const override { return context_; }
string name() const override { return "Soft Keymaster2"; }
KmVersion km_version() const override { return KmVersion::KEYMASTER_4_1; }
private:
mutable TestKeymasterContext* context_;
};
/**
* Test instance creator that builds a SoftKeymasterDevice which wraps a fake hardware keymaster1
* instance, with minimal digest support.
*/
class Sha256OnlyKeymaster1TestInstanceCreator : public Keymaster2TestInstanceCreator {
keymaster2_device_t* CreateDevice() const override {
std::cerr << "Creating keymaster1-backed device that supports only SHA256";
// fake_device doesn't leak because device (below) takes ownership of it.
keymaster1_device_t* fake_device =
make_device_sha256_only((new SoftKeymasterDevice(new TestKeymasterContext(
KmVersion::KEYMASTER_4_1, "PseudoHW")))
->keymaster_device());
// device doesn't leak; it's cleaned up by device->keymaster_device()->common.close().
context_ = new TestKeymasterContext(KmVersion::KEYMASTER_4_1);
SoftKeymasterDevice* device = new SoftKeymasterDevice(context_);
device->SetHardwareDevice(fake_device);
AuthorizationSet version_info(AuthorizationSetBuilder()
.Authorization(TAG_OS_VERSION, kOsVersion)
.Authorization(TAG_OS_PATCHLEVEL, kOsPatchLevel));
device->keymaster2_device()->configure(device->keymaster2_device(), &version_info);
return device->keymaster2_device();
}
int minimal_digest_set() const override { return true; }
bool is_keymaster1_hw() const override { return true; }
KeymasterContext* keymaster_context() const override { return context_; }
string name() const override { return "Wrapped fake keymaster1 w/minimal digests"; }
KmVersion km_version() const override { return KmVersion::KEYMASTER_4_1; }
private:
mutable TestKeymasterContext* context_;
};
/**
* Test instance creator that builds a SoftKeymasterDevice which wraps a fake hardware keymaster1
* instance, with full digest support
*/
class Keymaster1TestInstanceCreator : public Keymaster2TestInstanceCreator {
keymaster2_device_t* CreateDevice() const override {
std::cerr << "Creating keymaster1-backed device";
// fake_device doesn't leak because device (below) takes ownership of it.
keymaster1_device_t* fake_device = (new SoftKeymasterDevice(new TestKeymasterContext(
KmVersion::KEYMASTER_4_1, "PseudoHW")))
->keymaster_device();
// device doesn't leak; it's cleaned up by device->keymaster_device()->common.close().
context_ = new TestKeymasterContext(KmVersion::KEYMASTER_4_1);
SoftKeymasterDevice* device = new SoftKeymasterDevice(context_);
device->SetHardwareDevice(fake_device);
AuthorizationSet version_info(AuthorizationSetBuilder()
.Authorization(TAG_OS_VERSION, kOsVersion)
.Authorization(TAG_OS_PATCHLEVEL, kOsPatchLevel));
device->keymaster2_device()->configure(device->keymaster2_device(), &version_info);
return device->keymaster2_device();
}
int minimal_digest_set() const override { return false; }
bool is_keymaster1_hw() const override { return true; }
KeymasterContext* keymaster_context() const override { return context_; }
string name() const override { return "Wrapped fake keymaster1 w/full digests"; }
KmVersion km_version() const override { return KmVersion::KEYMASTER_4_1; }
private:
mutable TestKeymasterContext* context_;
};
static auto test_params =
testing::Values(InstanceCreatorPtr(new SoftKeymasterTestInstanceCreator),
InstanceCreatorPtr(new Keymaster1TestInstanceCreator),
InstanceCreatorPtr(new Sha256OnlyKeymaster1TestInstanceCreator));
class NewKeyGeneration : public Keymaster2Test {
protected:
void CheckBaseParams() {
AuthorizationSet auths = sw_enforced();
EXPECT_GT(auths.SerializedSize(), 12U);
EXPECT_TRUE(contains(auths, TAG_PURPOSE, KM_PURPOSE_SIGN));
EXPECT_TRUE(contains(auths, TAG_PURPOSE, KM_PURPOSE_VERIFY));
EXPECT_TRUE(contains(auths, TAG_USER_ID, 7));
EXPECT_TRUE(contains(auths, TAG_USER_AUTH_TYPE, HW_AUTH_PASSWORD));
EXPECT_TRUE(contains(auths, TAG_AUTH_TIMEOUT, 300));
// Verify that App ID, App data and ROT are NOT included.
EXPECT_FALSE(contains(auths, TAG_ROOT_OF_TRUST));
EXPECT_FALSE(contains(auths, TAG_APPLICATION_ID));
EXPECT_FALSE(contains(auths, TAG_APPLICATION_DATA));
// Just for giggles, check that some unexpected tags/values are NOT present.
EXPECT_FALSE(contains(auths, TAG_PURPOSE, KM_PURPOSE_ENCRYPT));
EXPECT_FALSE(contains(auths, TAG_PURPOSE, KM_PURPOSE_DECRYPT));
EXPECT_FALSE(contains(auths, TAG_AUTH_TIMEOUT, 301));
// Now check that unspecified, defaulted tags are correct.
EXPECT_TRUE(contains(auths, KM_TAG_CREATION_DATETIME));
if (GetParam()->is_keymaster1_hw()) {
// If the underlying (faked) HW is KM1, it will not have version info.
EXPECT_FALSE(auths.Contains(TAG_OS_VERSION));
EXPECT_FALSE(auths.Contains(TAG_OS_PATCHLEVEL));
} else {
// In all othe cases; SoftKeymasterDevice keys, or keymaster0 keys wrapped by
// SoftKeymasterDevice, version information will be present and up to date.
EXPECT_TRUE(contains(auths, TAG_OS_VERSION, kOsVersion));
EXPECT_TRUE(contains(auths, TAG_OS_PATCHLEVEL, kOsPatchLevel));
}
}
};
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, NewKeyGeneration, test_params);
TEST_P(NewKeyGeneration, Rsa) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
CheckBaseParams();
// Check specified tags are all present, and in the right set.
AuthorizationSet crypto_params;
AuthorizationSet non_crypto_params;
EXPECT_EQ(0U, hw_enforced().size());
EXPECT_NE(0U, sw_enforced().size());
crypto_params.push_back(sw_enforced());
EXPECT_TRUE(contains(crypto_params, TAG_ALGORITHM, KM_ALGORITHM_RSA));
EXPECT_FALSE(contains(non_crypto_params, TAG_ALGORITHM, KM_ALGORITHM_RSA));
EXPECT_TRUE(contains(crypto_params, TAG_KEY_SIZE, 256));
EXPECT_FALSE(contains(non_crypto_params, TAG_KEY_SIZE, 256));
EXPECT_TRUE(contains(crypto_params, TAG_RSA_PUBLIC_EXPONENT, 3));
EXPECT_FALSE(contains(non_crypto_params, TAG_RSA_PUBLIC_EXPONENT, 3));
EXPECT_EQ(KM_ERROR_OK, DeleteKey());
}
TEST_P(NewKeyGeneration, RsaDefaultSize) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_KEY_SIZE,
GenerateKey(AuthorizationSetBuilder()
.Authorization(TAG_ALGORITHM, KM_ALGORITHM_RSA)
.Authorization(TAG_RSA_PUBLIC_EXPONENT, 3)
.SigningKey()));
}
TEST_P(NewKeyGeneration, Ecdsa) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(KM_DIGEST_NONE)));
CheckBaseParams();
// Check specified tags are all present, and in the right set.
AuthorizationSet crypto_params;
AuthorizationSet non_crypto_params;
EXPECT_EQ(0U, hw_enforced().size());
EXPECT_NE(0U, sw_enforced().size());
crypto_params.push_back(sw_enforced());
EXPECT_TRUE(contains(crypto_params, TAG_ALGORITHM, KM_ALGORITHM_EC));
EXPECT_FALSE(contains(non_crypto_params, TAG_ALGORITHM, KM_ALGORITHM_EC));
EXPECT_TRUE(contains(crypto_params, TAG_KEY_SIZE, 224));
EXPECT_FALSE(contains(non_crypto_params, TAG_KEY_SIZE, 224));
}
TEST_P(NewKeyGeneration, EcdsaDefaultSize) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_KEY_SIZE,
GenerateKey(AuthorizationSetBuilder()
.Authorization(TAG_ALGORITHM, KM_ALGORITHM_EC)
.SigningKey()
.Digest(KM_DIGEST_NONE)));
}
TEST_P(NewKeyGeneration, EcdsaInvalidSize) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_KEY_SIZE,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(190).Digest(KM_DIGEST_NONE)));
}
TEST_P(NewKeyGeneration, EcdsaMismatchKeySize) {
ASSERT_EQ(KM_ERROR_INVALID_ARGUMENT,
GenerateKey(AuthorizationSetBuilder()
.EcdsaSigningKey(224)
.Authorization(TAG_EC_CURVE, KM_EC_CURVE_P_256)
.Digest(KM_DIGEST_NONE)));
}
TEST_P(NewKeyGeneration, EcdsaAllValidSizes) {
size_t valid_sizes[] = {224, 256, 384, 521};
for (size_t size : valid_sizes) {
EXPECT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(size).Digest(
KM_DIGEST_NONE)))
<< "Failed to generate size: " << size;
}
}
TEST_P(NewKeyGeneration, HmacSha256) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 256)));
}
TEST_P(NewKeyGeneration, CheckKeySizes) {
for (size_t key_size = 0; key_size <= kMaxHmacKeyLengthBits + 10; ++key_size) {
if (key_size < kMinHmacKeyLengthBits || key_size > kMaxHmacKeyLengthBits ||
key_size % 8 != 0) {
EXPECT_EQ(KM_ERROR_UNSUPPORTED_KEY_SIZE,
GenerateKey(AuthorizationSetBuilder()
.HmacKey(key_size)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 256)))
<< "HMAC key size " << key_size << " invalid.";
} else {
EXPECT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(key_size)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 256)));
}
}
}
TEST_P(NewKeyGeneration, HmacMultipleDigests) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_DIGEST,
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA1)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
}
TEST_P(NewKeyGeneration, HmacDigestNone) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_DIGEST,
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
}
TEST_P(NewKeyGeneration, HmacSha256TooShortMacLength) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH,
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 48)));
}
TEST_P(NewKeyGeneration, HmacSha256NonIntegralOctetMacLength) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH,
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 130)));
}
TEST_P(NewKeyGeneration, HmacSha256TooLongMacLength) {
ASSERT_EQ(KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH,
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 384)));
}
typedef Keymaster2Test GetKeyCharacteristics;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, GetKeyCharacteristics, test_params);
TEST_P(GetKeyCharacteristics, SimpleRsa) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
AuthorizationSet original(sw_enforced());
ASSERT_EQ(KM_ERROR_OK, GetCharacteristics());
EXPECT_EQ(original, sw_enforced());
}
typedef Keymaster2Test SigningOperationsTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, SigningOperationsTest, test_params);
TEST_P(SigningOperationsTest, RsaSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE, KM_PAD_NONE);
}
TEST_P(SigningOperationsTest, RsaPssSha256Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(768, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PSS)));
// Use large message, which won't work without digesting.
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PSS);
}
TEST_P(SigningOperationsTest, RsaPaddingNoneDoesNotAllowOther) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string signature;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_SIGN);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_PADDING_MODE, BeginOperation(KM_PURPOSE_SIGN, begin_params));
}
TEST_P(SigningOperationsTest, RsaPkcs1Sha256Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN)));
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PKCS1_1_5_SIGN);
}
TEST_P(SigningOperationsTest, RsaPkcs1NoDigestSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN)));
string message(53, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE, KM_PAD_RSA_PKCS1_1_5_SIGN);
}
TEST_P(SigningOperationsTest, RsaPkcs1NoDigestTooLarge) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN)));
string message(54, 'a');
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_SIGN);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_SIGN, begin_params));
string result;
string signature;
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, FinishOperation(message, "", &signature));
}
TEST_P(SigningOperationsTest, RsaPssSha256TooSmallKey) {
// Key must be at least 10 bytes larger than hash, to provide eight bytes of random salt, so
// verify that nine bytes larger than hash won't work.
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256 + 9 * 8, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PSS)));
string message(1024, 'a');
string signature;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PSS);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_DIGEST, BeginOperation(KM_PURPOSE_SIGN, begin_params));
}
TEST_P(SigningOperationsTest, RsaNoPaddingHugeData) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN)));
string message(64 * 1024, 'a');
string signature;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_SIGN);
ASSERT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_SIGN, begin_params));
string result;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, UpdateOperation(message, &result, &input_consumed));
}
TEST_P(SigningOperationsTest, RsaAbort) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
ASSERT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_SIGN, begin_params));
EXPECT_EQ(KM_ERROR_OK, AbortOperation());
// Another abort should fail
EXPECT_EQ(KM_ERROR_INVALID_OPERATION_HANDLE, AbortOperation());
}
TEST_P(SigningOperationsTest, RsaUnsupportedPadding) {
GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_SHA_2_256 /* supported digest */)
.Padding(KM_PAD_PKCS7));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PADDING_MODE, BeginOperation(KM_PURPOSE_SIGN, begin_params));
}
TEST_P(SigningOperationsTest, RsaNoDigest) {
// PSS requires a digest.
GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_RSA_PSS));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PSS);
ASSERT_EQ(KM_ERROR_INCOMPATIBLE_DIGEST, BeginOperation(KM_PURPOSE_SIGN, begin_params));
}
TEST_P(SigningOperationsTest, RsaNoPadding) {
// Padding must be specified
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().RsaKey(256, 3).SigningKey().Digest(
KM_DIGEST_NONE)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PADDING_MODE, BeginOperation(KM_PURPOSE_SIGN, begin_params));
}
TEST_P(SigningOperationsTest, RsaTooShortMessage) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string message = "1234567890123456789012345678901";
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE, KM_PAD_NONE);
}
TEST_P(SigningOperationsTest, RsaSignWithEncryptionKey) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
ASSERT_EQ(KM_ERROR_INCOMPATIBLE_PURPOSE, BeginOperation(KM_PURPOSE_SIGN, begin_params));
}
TEST_P(SigningOperationsTest, RsaSignTooLargeMessage) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string message(256 / 8, static_cast<char>(0xff));
string signature;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
ASSERT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_SIGN, begin_params));
string result;
size_t input_consumed;
ASSERT_EQ(KM_ERROR_OK, UpdateOperation(message, &result, &input_consumed));
ASSERT_EQ(message.size(), input_consumed);
string output;
ASSERT_EQ(KM_ERROR_INVALID_ARGUMENT, FinishOperation(&output));
}
TEST_P(SigningOperationsTest, EcdsaSuccess) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(KM_DIGEST_NONE)));
string message(224 / 8, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE);
}
TEST_P(SigningOperationsTest, EcdsaSha256Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(
KM_DIGEST_SHA_2_256)));
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256);
}
TEST_P(SigningOperationsTest, EcdsaSha384Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(
KM_DIGEST_SHA_2_384)));
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_384);
}
TEST_P(SigningOperationsTest, EcdsaNoPaddingHugeData) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(KM_DIGEST_NONE)));
string message(64 * 1024, 'a');
string signature;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
ASSERT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_SIGN, begin_params));
string result;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(message, &result, &input_consumed));
}
TEST_P(SigningOperationsTest, EcdsaAllSizesAndHashes) {
vector<int> key_sizes = {224, 256, 384, 521};
vector<keymaster_digest_t> digests = {
KM_DIGEST_SHA1, KM_DIGEST_SHA_2_224, KM_DIGEST_SHA_2_256,
KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512,
};
for (int key_size : key_sizes) {
for (keymaster_digest_t digest : digests) {
ASSERT_EQ(
KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(key_size).Digest(digest)));
string message(1024, 'a');
string signature;
if (digest == KM_DIGEST_NONE) message.resize(key_size / 8);
SignMessage(message, &signature, digest);
}
}
}
TEST_P(SigningOperationsTest, AesEcbSign) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().AesEncryptionKey(128).Authorization(
TAG_BLOCK_MODE, KM_MODE_ECB)));
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PURPOSE, BeginOperation(KM_PURPOSE_SIGN));
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PURPOSE, BeginOperation(KM_PURPOSE_VERIFY));
}
TEST_P(SigningOperationsTest, HmacSha1Success) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA1)
.Authorization(TAG_MIN_MAC_LENGTH, 160));
string message = "12345678901234567890123456789012";
string signature;
MacMessage(message, &signature, 160);
ASSERT_EQ(20U, signature.size());
}
TEST_P(SigningOperationsTest, HmacSha224Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_224)
.Authorization(TAG_MIN_MAC_LENGTH, 160)));
string message = "12345678901234567890123456789012";
string signature;
MacMessage(message, &signature, 224);
ASSERT_EQ(28U, signature.size());
}
TEST_P(SigningOperationsTest, HmacSha256Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 256)));
string message = "12345678901234567890123456789012";
string signature;
MacMessage(message, &signature, 256);
ASSERT_EQ(32U, signature.size());
}
TEST_P(SigningOperationsTest, HmacSha384Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_384)
.Authorization(TAG_MIN_MAC_LENGTH, 384)));
string message = "12345678901234567890123456789012";
string signature;
MacMessage(message, &signature, 384);
ASSERT_EQ(48U, signature.size());
}
TEST_P(SigningOperationsTest, HmacSha512Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_512)
.Authorization(TAG_MIN_MAC_LENGTH, 384)));
string message = "12345678901234567890123456789012";
string signature;
MacMessage(message, &signature, 512);
ASSERT_EQ(64U, signature.size());
}
TEST_P(SigningOperationsTest, HmacLengthInKey) {
// TODO(swillden): unified API should generate an error on key generation.
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string message = "12345678901234567890123456789012";
string signature;
MacMessage(message, &signature, 160);
ASSERT_EQ(20U, signature.size());
}
TEST_P(SigningOperationsTest, HmacRfc4231TestCase3) {
string key(20, 0xaa);
string message(50, 0xdd);
uint8_t sha_224_expected[] = {
0x7f, 0xb3, 0xcb, 0x35, 0x88, 0xc6, 0xc1, 0xf6, 0xff, 0xa9, 0x69, 0x4d, 0x7d, 0x6a,
0xd2, 0x64, 0x93, 0x65, 0xb0, 0xc1, 0xf6, 0x5d, 0x69, 0xd1, 0xec, 0x83, 0x33, 0xea,
};
uint8_t sha_256_expected[] = {
0x77, 0x3e, 0xa9, 0x1e, 0x36, 0x80, 0x0e, 0x46, 0x85, 0x4d, 0xb8,
0xeb, 0xd0, 0x91, 0x81, 0xa7, 0x29, 0x59, 0x09, 0x8b, 0x3e, 0xf8,
0xc1, 0x22, 0xd9, 0x63, 0x55, 0x14, 0xce, 0xd5, 0x65, 0xfe,
};
uint8_t sha_384_expected[] = {
0x88, 0x06, 0x26, 0x08, 0xd3, 0xe6, 0xad, 0x8a, 0x0a, 0xa2, 0xac, 0xe0,
0x14, 0xc8, 0xa8, 0x6f, 0x0a, 0xa6, 0x35, 0xd9, 0x47, 0xac, 0x9f, 0xeb,
0xe8, 0x3e, 0xf4, 0xe5, 0x59, 0x66, 0x14, 0x4b, 0x2a, 0x5a, 0xb3, 0x9d,
0xc1, 0x38, 0x14, 0xb9, 0x4e, 0x3a, 0xb6, 0xe1, 0x01, 0xa3, 0x4f, 0x27,
};
uint8_t sha_512_expected[] = {
0xfa, 0x73, 0xb0, 0x08, 0x9d, 0x56, 0xa2, 0x84, 0xef, 0xb0, 0xf0, 0x75, 0x6c,
0x89, 0x0b, 0xe9, 0xb1, 0xb5, 0xdb, 0xdd, 0x8e, 0xe8, 0x1a, 0x36, 0x55, 0xf8,
0x3e, 0x33, 0xb2, 0x27, 0x9d, 0x39, 0xbf, 0x3e, 0x84, 0x82, 0x79, 0xa7, 0x22,
0xc8, 0x06, 0xb4, 0x85, 0xa4, 0x7e, 0x67, 0xc8, 0x07, 0xb9, 0x46, 0xa3, 0x37,
0xbe, 0xe8, 0x94, 0x26, 0x74, 0x27, 0x88, 0x59, 0xe1, 0x32, 0x92, 0xfb,
};
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_224, make_string(sha_224_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_256, make_string(sha_256_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_384, make_string(sha_384_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_512, make_string(sha_512_expected));
}
TEST_P(SigningOperationsTest, HmacRfc4231TestCase4) {
uint8_t key_data[25] = {
0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d,
0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19,
};
string key = make_string(key_data);
string message(50, 0xcd);
uint8_t sha_224_expected[] = {
0x6c, 0x11, 0x50, 0x68, 0x74, 0x01, 0x3c, 0xac, 0x6a, 0x2a, 0xbc, 0x1b, 0xb3, 0x82,
0x62, 0x7c, 0xec, 0x6a, 0x90, 0xd8, 0x6e, 0xfc, 0x01, 0x2d, 0xe7, 0xaf, 0xec, 0x5a,
};
uint8_t sha_256_expected[] = {
0x82, 0x55, 0x8a, 0x38, 0x9a, 0x44, 0x3c, 0x0e, 0xa4, 0xcc, 0x81,
0x98, 0x99, 0xf2, 0x08, 0x3a, 0x85, 0xf0, 0xfa, 0xa3, 0xe5, 0x78,
0xf8, 0x07, 0x7a, 0x2e, 0x3f, 0xf4, 0x67, 0x29, 0x66, 0x5b,
};
uint8_t sha_384_expected[] = {
0x3e, 0x8a, 0x69, 0xb7, 0x78, 0x3c, 0x25, 0x85, 0x19, 0x33, 0xab, 0x62,
0x90, 0xaf, 0x6c, 0xa7, 0x7a, 0x99, 0x81, 0x48, 0x08, 0x50, 0x00, 0x9c,
0xc5, 0x57, 0x7c, 0x6e, 0x1f, 0x57, 0x3b, 0x4e, 0x68, 0x01, 0xdd, 0x23,
0xc4, 0xa7, 0xd6, 0x79, 0xcc, 0xf8, 0xa3, 0x86, 0xc6, 0x74, 0xcf, 0xfb,
};
uint8_t sha_512_expected[] = {
0xb0, 0xba, 0x46, 0x56, 0x37, 0x45, 0x8c, 0x69, 0x90, 0xe5, 0xa8, 0xc5, 0xf6,
0x1d, 0x4a, 0xf7, 0xe5, 0x76, 0xd9, 0x7f, 0xf9, 0x4b, 0x87, 0x2d, 0xe7, 0x6f,
0x80, 0x50, 0x36, 0x1e, 0xe3, 0xdb, 0xa9, 0x1c, 0xa5, 0xc1, 0x1a, 0xa2, 0x5e,
0xb4, 0xd6, 0x79, 0x27, 0x5c, 0xc5, 0x78, 0x80, 0x63, 0xa5, 0xf1, 0x97, 0x41,
0x12, 0x0c, 0x4f, 0x2d, 0xe2, 0xad, 0xeb, 0xeb, 0x10, 0xa2, 0x98, 0xdd,
};
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_224, make_string(sha_224_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_256, make_string(sha_256_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_384, make_string(sha_384_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_512, make_string(sha_512_expected));
}
TEST_P(SigningOperationsTest, HmacRfc4231TestCase5) {
string key(20, 0x0c);
string message = "Test With Truncation";
uint8_t sha_224_expected[] = {
0x0e, 0x2a, 0xea, 0x68, 0xa9, 0x0c, 0x8d, 0x37,
0xc9, 0x88, 0xbc, 0xdb, 0x9f, 0xca, 0x6f, 0xa8,
};
uint8_t sha_256_expected[] = {
0xa3, 0xb6, 0x16, 0x74, 0x73, 0x10, 0x0e, 0xe0,
0x6e, 0x0c, 0x79, 0x6c, 0x29, 0x55, 0x55, 0x2b,
};
uint8_t sha_384_expected[] = {
0x3a, 0xbf, 0x34, 0xc3, 0x50, 0x3b, 0x2a, 0x23,
0xa4, 0x6e, 0xfc, 0x61, 0x9b, 0xae, 0xf8, 0x97,
};
uint8_t sha_512_expected[] = {
0x41, 0x5f, 0xad, 0x62, 0x71, 0x58, 0x0a, 0x53,
0x1d, 0x41, 0x79, 0xbc, 0x89, 0x1d, 0x87, 0xa6,
};
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_224, make_string(sha_224_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_256, make_string(sha_256_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_384, make_string(sha_384_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_512, make_string(sha_512_expected));
}
TEST_P(SigningOperationsTest, HmacRfc4231TestCase6) {
string key(131, 0xaa);
string message = "Test Using Larger Than Block-Size Key - Hash Key First";
uint8_t sha_224_expected[] = {
0x95, 0xe9, 0xa0, 0xdb, 0x96, 0x20, 0x95, 0xad, 0xae, 0xbe, 0x9b, 0x2d, 0x6f, 0x0d,
0xbc, 0xe2, 0xd4, 0x99, 0xf1, 0x12, 0xf2, 0xd2, 0xb7, 0x27, 0x3f, 0xa6, 0x87, 0x0e,
};
uint8_t sha_256_expected[] = {
0x60, 0xe4, 0x31, 0x59, 0x1e, 0xe0, 0xb6, 0x7f, 0x0d, 0x8a, 0x26,
0xaa, 0xcb, 0xf5, 0xb7, 0x7f, 0x8e, 0x0b, 0xc6, 0x21, 0x37, 0x28,
0xc5, 0x14, 0x05, 0x46, 0x04, 0x0f, 0x0e, 0xe3, 0x7f, 0x54,
};
uint8_t sha_384_expected[] = {
0x4e, 0xce, 0x08, 0x44, 0x85, 0x81, 0x3e, 0x90, 0x88, 0xd2, 0xc6, 0x3a,
0x04, 0x1b, 0xc5, 0xb4, 0x4f, 0x9e, 0xf1, 0x01, 0x2a, 0x2b, 0x58, 0x8f,
0x3c, 0xd1, 0x1f, 0x05, 0x03, 0x3a, 0xc4, 0xc6, 0x0c, 0x2e, 0xf6, 0xab,
0x40, 0x30, 0xfe, 0x82, 0x96, 0x24, 0x8d, 0xf1, 0x63, 0xf4, 0x49, 0x52,
};
uint8_t sha_512_expected[] = {
0x80, 0xb2, 0x42, 0x63, 0xc7, 0xc1, 0xa3, 0xeb, 0xb7, 0x14, 0x93, 0xc1, 0xdd,
0x7b, 0xe8, 0xb4, 0x9b, 0x46, 0xd1, 0xf4, 0x1b, 0x4a, 0xee, 0xc1, 0x12, 0x1b,
0x01, 0x37, 0x83, 0xf8, 0xf3, 0x52, 0x6b, 0x56, 0xd0, 0x37, 0xe0, 0x5f, 0x25,
0x98, 0xbd, 0x0f, 0xd2, 0x21, 0x5d, 0x6a, 0x1e, 0x52, 0x95, 0xe6, 0x4f, 0x73,
0xf6, 0x3f, 0x0a, 0xec, 0x8b, 0x91, 0x5a, 0x98, 0x5d, 0x78, 0x65, 0x98,
};
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_224, make_string(sha_224_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_256, make_string(sha_256_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_384, make_string(sha_384_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_512, make_string(sha_512_expected));
}
TEST_P(SigningOperationsTest, HmacRfc4231TestCase7) {
string key(131, 0xaa);
string message = "This is a test using a larger than block-size key and a larger than "
"block-size data. The key needs to be hashed before being used by the HMAC "
"algorithm.";
uint8_t sha_224_expected[] = {
0x3a, 0x85, 0x41, 0x66, 0xac, 0x5d, 0x9f, 0x02, 0x3f, 0x54, 0xd5, 0x17, 0xd0, 0xb3,
0x9d, 0xbd, 0x94, 0x67, 0x70, 0xdb, 0x9c, 0x2b, 0x95, 0xc9, 0xf6, 0xf5, 0x65, 0xd1,
};
uint8_t sha_256_expected[] = {
0x9b, 0x09, 0xff, 0xa7, 0x1b, 0x94, 0x2f, 0xcb, 0x27, 0x63, 0x5f,
0xbc, 0xd5, 0xb0, 0xe9, 0x44, 0xbf, 0xdc, 0x63, 0x64, 0x4f, 0x07,
0x13, 0x93, 0x8a, 0x7f, 0x51, 0x53, 0x5c, 0x3a, 0x35, 0xe2,
};
uint8_t sha_384_expected[] = {
0x66, 0x17, 0x17, 0x8e, 0x94, 0x1f, 0x02, 0x0d, 0x35, 0x1e, 0x2f, 0x25,
0x4e, 0x8f, 0xd3, 0x2c, 0x60, 0x24, 0x20, 0xfe, 0xb0, 0xb8, 0xfb, 0x9a,
0xdc, 0xce, 0xbb, 0x82, 0x46, 0x1e, 0x99, 0xc5, 0xa6, 0x78, 0xcc, 0x31,
0xe7, 0x99, 0x17, 0x6d, 0x38, 0x60, 0xe6, 0x11, 0x0c, 0x46, 0x52, 0x3e,
};
uint8_t sha_512_expected[] = {
0xe3, 0x7b, 0x6a, 0x77, 0x5d, 0xc8, 0x7d, 0xba, 0xa4, 0xdf, 0xa9, 0xf9, 0x6e,
0x5e, 0x3f, 0xfd, 0xde, 0xbd, 0x71, 0xf8, 0x86, 0x72, 0x89, 0x86, 0x5d, 0xf5,
0xa3, 0x2d, 0x20, 0xcd, 0xc9, 0x44, 0xb6, 0x02, 0x2c, 0xac, 0x3c, 0x49, 0x82,
0xb1, 0x0d, 0x5e, 0xeb, 0x55, 0xc3, 0xe4, 0xde, 0x15, 0x13, 0x46, 0x76, 0xfb,
0x6d, 0xe0, 0x44, 0x60, 0x65, 0xc9, 0x74, 0x40, 0xfa, 0x8c, 0x6a, 0x58,
};
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_224, make_string(sha_224_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_256, make_string(sha_256_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_384, make_string(sha_384_expected));
CheckHmacTestVector(key, message, KM_DIGEST_SHA_2_512, make_string(sha_512_expected));
}
TEST_P(SigningOperationsTest, HmacSha256TooLargeMacLength) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 256)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_MAC_LENGTH, 264);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
ASSERT_EQ(KM_ERROR_UNSUPPORTED_MAC_LENGTH,
BeginOperation(KM_PURPOSE_SIGN, begin_params, nullptr /* output_params */));
}
TEST_P(SigningOperationsTest, HmacSha256TooSmallMacLength) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_MAC_LENGTH, 120);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
ASSERT_EQ(KM_ERROR_INVALID_MAC_LENGTH,
BeginOperation(KM_PURPOSE_SIGN, begin_params, nullptr /* output_params */));
}
// TODO(swillden): Add more verification failure tests.
typedef Keymaster2Test VerificationOperationsTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, VerificationOperationsTest, test_params);
TEST_P(VerificationOperationsTest, RsaSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE, KM_PAD_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE, KM_PAD_NONE);
}
TEST_P(VerificationOperationsTest, RsaPssSha256Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(768, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PSS)));
// Use large message, which won't work without digesting.
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PSS);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PSS);
}
TEST_P(VerificationOperationsTest, RsaPssSha224Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_SHA_2_224)
.Padding(KM_PAD_RSA_PSS)));
// Use large message, which won't work without digesting.
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_224, KM_PAD_RSA_PSS);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_224, KM_PAD_RSA_PSS);
// Verify with OpenSSL.
string pubkey;
EXPECT_EQ(KM_ERROR_OK, ExportKey(KM_KEY_FORMAT_X509, &pubkey));
const uint8_t* p = reinterpret_cast<const uint8_t*>(pubkey.data());
unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey(
d2i_PUBKEY(nullptr /* alloc new */, &p, pubkey.size()));
ASSERT_TRUE(pkey.get());
EVP_MD_CTX digest_ctx;
EVP_MD_CTX_init(&digest_ctx);
EVP_PKEY_CTX* pkey_ctx;
EXPECT_EQ(1, EVP_DigestVerifyInit(&digest_ctx, &pkey_ctx, EVP_sha224(), nullptr /* engine */,
pkey.get()));
EXPECT_EQ(1, EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING));
EXPECT_EQ(1, EVP_DigestVerifyUpdate(&digest_ctx, message.data(), message.size()));
EXPECT_EQ(1,
EVP_DigestVerifyFinal(&digest_ctx, reinterpret_cast<const uint8_t*>(signature.data()),
signature.size()));
EVP_MD_CTX_cleanup(&digest_ctx);
}
TEST_P(VerificationOperationsTest, RsaPssSha256CorruptSignature) {
GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(768, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PSS));
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PSS);
++signature[signature.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PSS);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, RsaPssSha256CorruptInput) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(768, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PSS)));
// Use large message, which won't work without digesting.
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PSS);
++message[message.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PSS);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, RsaPkcs1Sha256Success) {
GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN));
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PKCS1_1_5_SIGN);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PKCS1_1_5_SIGN);
}
TEST_P(VerificationOperationsTest, RsaPks1Sha224Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_SHA_2_224)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN)));
// Use large message, which won't work without digesting.
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_224, KM_PAD_RSA_PKCS1_1_5_SIGN);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_224, KM_PAD_RSA_PKCS1_1_5_SIGN);
// Verify with OpenSSL.
string pubkey;
EXPECT_EQ(KM_ERROR_OK, ExportKey(KM_KEY_FORMAT_X509, &pubkey));
const uint8_t* p = reinterpret_cast<const uint8_t*>(pubkey.data());
unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey(
d2i_PUBKEY(nullptr /* alloc new */, &p, pubkey.size()));
ASSERT_TRUE(pkey.get());
EVP_MD_CTX digest_ctx;
EVP_MD_CTX_init(&digest_ctx);
EVP_PKEY_CTX* pkey_ctx;
EXPECT_EQ(1, EVP_DigestVerifyInit(&digest_ctx, &pkey_ctx, EVP_sha224(), nullptr /* engine */,
pkey.get()));
EXPECT_EQ(1, EVP_DigestVerifyUpdate(&digest_ctx, message.data(), message.size()));
EXPECT_EQ(1,
EVP_DigestVerifyFinal(&digest_ctx, reinterpret_cast<const uint8_t*>(signature.data()),
signature.size()));
EVP_MD_CTX_cleanup(&digest_ctx);
}
TEST_P(VerificationOperationsTest, RsaPkcs1Sha256CorruptSignature) {
GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN));
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PKCS1_1_5_SIGN);
++signature[signature.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_SIGN);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, RsaPkcs1Sha256CorruptInput) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(512, 3)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_PKCS1_1_5_SIGN)));
// Use large message, which won't work without digesting.
string message(1024, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256, KM_PAD_RSA_PKCS1_1_5_SIGN);
++message[message.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_SIGN);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, RsaAllDigestAndPadCombinations) {
vector<keymaster_digest_t> digests = {
KM_DIGEST_NONE, KM_DIGEST_MD5, KM_DIGEST_SHA1, KM_DIGEST_SHA_2_224,
KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512,
};
vector<keymaster_padding_t> padding_modes{
KM_PAD_NONE,
KM_PAD_RSA_PKCS1_1_5_SIGN,
KM_PAD_RSA_PSS,
};
int trial_count = 0;
for (keymaster_padding_t padding_mode : padding_modes) {
for (keymaster_digest_t digest : digests) {
if (digest != KM_DIGEST_NONE && padding_mode == KM_PAD_NONE)
// Digesting requires padding
continue;
// Compute key & message size that will work.
size_t key_bits = 0;
size_t message_len = 1000;
if (digest == KM_DIGEST_NONE) {
key_bits = 256;
switch (padding_mode) {
case KM_PAD_NONE:
// Match key size.
message_len = key_bits / 8;
break;
case KM_PAD_RSA_PKCS1_1_5_SIGN:
message_len = key_bits / 8 - 11;
break;
case KM_PAD_RSA_PSS:
// PSS requires a digest.
continue;
default:
FAIL() << "Missing padding";
break;
}
} else {
size_t digest_bits;
switch (digest) {
case KM_DIGEST_MD5:
digest_bits = 128;
break;
case KM_DIGEST_SHA1:
digest_bits = 160;
break;
case KM_DIGEST_SHA_2_224:
digest_bits = 224;
break;
case KM_DIGEST_SHA_2_256:
digest_bits = 256;
break;
case KM_DIGEST_SHA_2_384:
digest_bits = 384;
break;
case KM_DIGEST_SHA_2_512:
digest_bits = 512;
break;
default:
FAIL() << "Missing digest";
}
switch (padding_mode) {
case KM_PAD_RSA_PKCS1_1_5_SIGN:
key_bits = digest_bits + 8 * (11 + 19);
break;
case KM_PAD_RSA_PSS:
key_bits = digest_bits * 2 + 2 * 8;
break;
default:
FAIL() << "Missing padding";
break;
}
}
// Round up to the nearest multiple of 128.
key_bits = (key_bits + 127) / 128 * 128;
GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(key_bits, 3)
.Digest(digest)
.Padding(padding_mode));
string message(message_len, 'a');
string signature;
SignMessage(message, &signature, digest, padding_mode);
VerifyMessage(message, signature, digest, padding_mode);
++trial_count;
}
}
}
TEST_P(VerificationOperationsTest, EcdsaSuccess) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(KM_DIGEST_NONE)));
string message = "12345678901234567890123456789012";
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE);
}
TEST_P(VerificationOperationsTest, EcdsaTooShort) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(KM_DIGEST_NONE)));
string message = "12345678901234567890";
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE);
}
TEST_P(VerificationOperationsTest, EcdsaSlightlyTooLong) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(521).Digest(KM_DIGEST_NONE)));
string message(66, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE);
// Modifying low-order bits doesn't matter, because they didn't get signed. Ugh.
message[65] ^= 7;
VerifyMessage(message, signature, KM_DIGEST_NONE);
}
TEST_P(VerificationOperationsTest, EcdsaSha256Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.EcdsaSigningKey(256)
.Digest(KM_DIGEST_SHA_2_256)
.Digest(KM_DIGEST_NONE)));
string message = "12345678901234567890123456789012";
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_256);
// Just for giggles, try verifying with the wrong digest.
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, EcdsaSha224Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(
KM_DIGEST_SHA_2_224)));
string message = "12345678901234567890123456789012";
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_224);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_224);
// Just for giggles, try verifying with the wrong digest.
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, EcdsaAllDigestsAndKeySizes) {
keymaster_digest_t digests[] = {
KM_DIGEST_SHA1, KM_DIGEST_SHA_2_224, KM_DIGEST_SHA_2_256,
KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512,
};
size_t key_sizes[] = {224, 256, 384, 521};
string message = "1234567890";
string signature;
for (auto key_size : key_sizes) {
SCOPED_TRACE(testing::Message() << "Key size: " << key_size);
AuthorizationSetBuilder builder;
builder.EcdsaSigningKey(key_size);
for (auto digest : digests)
builder.Digest(digest);
ASSERT_EQ(KM_ERROR_OK, GenerateKey(builder));
for (auto digest : digests) {
SCOPED_TRACE(testing::Message() << "Digest: " << digest);
SignMessage(message, &signature, digest);
VerifyMessage(message, signature, digest);
}
}
}
TEST_P(VerificationOperationsTest, HmacSha1Success) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA1)
.Authorization(TAG_MIN_MAC_LENGTH, 128));
string message = "123456789012345678901234567890123456789012345678";
string signature;
MacMessage(message, &signature, 160);
VerifyMac(message, signature);
}
TEST_P(VerificationOperationsTest, HmacSha224Success) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_224)
.Authorization(TAG_MIN_MAC_LENGTH, 128));
string message = "123456789012345678901234567890123456789012345678";
string signature;
MacMessage(message, &signature, 224);
VerifyMac(message, signature);
}
TEST_P(VerificationOperationsTest, HmacSha256Success) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 128));
string message = "123456789012345678901234567890123456789012345678";
string signature;
MacMessage(message, &signature, 256);
VerifyMac(message, signature);
}
TEST_P(VerificationOperationsTest, HmacSha256TooShortMac) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 128));
string message = "123456789012345678901234567890123456789012345678";
string signature;
MacMessage(message, &signature, 256);
// Shorten to 128 bits, should still work.
signature.resize(128 / 8);
VerifyMac(message, signature);
// Drop one more byte.
signature.resize(signature.length() - 1);
AuthorizationSet begin_params(client_params());
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_VERIFY, begin_params));
string result;
EXPECT_EQ(KM_ERROR_INVALID_MAC_LENGTH, FinishOperation(message, signature, &result));
}
TEST_P(VerificationOperationsTest, HmacSha384Success) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_384)
.Authorization(TAG_MIN_MAC_LENGTH, 128));
string message = "123456789012345678901234567890123456789012345678";
string signature;
MacMessage(message, &signature, 384);
VerifyMac(message, signature);
}
TEST_P(VerificationOperationsTest, HmacSha512Success) {
GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_512)
.Authorization(TAG_MIN_MAC_LENGTH, 128));
string message = "123456789012345678901234567890123456789012345678";
string signature;
MacMessage(message, &signature, 512);
VerifyMac(message, signature);
}
typedef Keymaster2Test ExportKeyTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, ExportKeyTest, test_params);
TEST_P(ExportKeyTest, RsaSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string export_data;
ASSERT_EQ(KM_ERROR_OK, ExportKey(KM_KEY_FORMAT_X509, &export_data));
EXPECT_GT(export_data.length(), 0U);
// TODO(swillden): Verify that the exported key is actually usable to verify signatures.
}
TEST_P(ExportKeyTest, EcdsaSuccess) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(KM_DIGEST_NONE)));
string export_data;
ASSERT_EQ(KM_ERROR_OK, ExportKey(KM_KEY_FORMAT_X509, &export_data));
EXPECT_GT(export_data.length(), 0U);
// TODO(swillden): Verify that the exported key is actually usable to verify signatures.
}
TEST_P(ExportKeyTest, RsaUnsupportedKeyFormat) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
string export_data;
ASSERT_EQ(KM_ERROR_UNSUPPORTED_KEY_FORMAT, ExportKey(KM_KEY_FORMAT_PKCS8, &export_data));
}
TEST_P(ExportKeyTest, RsaCorruptedKeyBlob) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)));
corrupt_key_blob();
string export_data;
ASSERT_EQ(KM_ERROR_INVALID_KEY_BLOB, ExportKey(KM_KEY_FORMAT_X509, &export_data));
}
TEST_P(ExportKeyTest, AesKeyExportFails) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().AesEncryptionKey(128)));
string export_data;
EXPECT_EQ(KM_ERROR_UNSUPPORTED_KEY_FORMAT, ExportKey(KM_KEY_FORMAT_X509, &export_data));
EXPECT_EQ(KM_ERROR_UNSUPPORTED_KEY_FORMAT, ExportKey(KM_KEY_FORMAT_PKCS8, &export_data));
EXPECT_EQ(KM_ERROR_UNSUPPORTED_KEY_FORMAT, ExportKey(KM_KEY_FORMAT_RAW, &export_data));
}
typedef Keymaster2Test ImportKeyTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, ImportKeyTest, test_params);
TEST_P(ImportKeyTest, RsaSuccess) {
string pk8_key(reinterpret_cast<char*>(&rsa_privkey_pk8_der[0]), rsa_privkey_pk8_der_len);
ASSERT_EQ(633U, pk8_key.size());
ASSERT_EQ(KM_ERROR_OK, ImportKey(AuthorizationSetBuilder()
.RsaSigningKey(1024, 65537)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE),
KM_KEY_FORMAT_PKCS8, pk8_key));
// Check values derived from the key.
EXPECT_TRUE(contains(sw_enforced(), TAG_ALGORITHM, KM_ALGORITHM_RSA));
EXPECT_TRUE(contains(sw_enforced(), TAG_KEY_SIZE, 1024));
EXPECT_TRUE(contains(sw_enforced(), TAG_RSA_PUBLIC_EXPONENT, 65537U));
// And values provided by AndroidKeymaster
EXPECT_TRUE(contains(sw_enforced(), TAG_ORIGIN, KM_ORIGIN_IMPORTED));
EXPECT_TRUE(contains(sw_enforced(), KM_TAG_CREATION_DATETIME));
string message(1024 / 8, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE, KM_PAD_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE, KM_PAD_NONE);
}
TEST_P(ImportKeyTest, RsaKeySizeMismatch) {
string pk8_key(reinterpret_cast<char*>(&rsa_privkey_pk8_der[0]), rsa_privkey_pk8_der_len);
ASSERT_EQ(633U, pk8_key.size());
ASSERT_EQ(KM_ERROR_IMPORT_PARAMETER_MISMATCH,
ImportKey(AuthorizationSetBuilder()
.RsaSigningKey(2048 /* Doesn't match key */, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE),
KM_KEY_FORMAT_PKCS8, pk8_key));
}
TEST_P(ImportKeyTest, RsaPublicExponenMismatch) {
string pk8_key(reinterpret_cast<char*>(&rsa_privkey_pk8_der[0]), rsa_privkey_pk8_der_len);
ASSERT_EQ(633U, pk8_key.size());
ASSERT_EQ(KM_ERROR_IMPORT_PARAMETER_MISMATCH,
ImportKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3 /* Doesnt' match key */)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE),
KM_KEY_FORMAT_PKCS8, pk8_key));
}
TEST_P(ImportKeyTest, EcdsaSuccess) {
string pk8_key(reinterpret_cast<char*>(&ec_privkey_pk8_der[0]), ec_privkey_pk8_der_len);
ASSERT_EQ(138U, pk8_key.size());
ASSERT_EQ(KM_ERROR_OK,
ImportKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(KM_DIGEST_NONE),
KM_KEY_FORMAT_PKCS8, pk8_key));
// Check values derived from the key.
EXPECT_TRUE(contains(sw_enforced(), TAG_ALGORITHM, KM_ALGORITHM_EC));
EXPECT_TRUE(contains(sw_enforced(), TAG_KEY_SIZE, 256));
// And values provided by AndroidKeymaster
EXPECT_TRUE(contains(sw_enforced(), TAG_ORIGIN, KM_ORIGIN_IMPORTED));
EXPECT_TRUE(contains(sw_enforced(), KM_TAG_CREATION_DATETIME));
string message(32, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE);
}
TEST_P(ImportKeyTest, EcdsaSizeSpecified) {
string pk8_key(reinterpret_cast<char*>(&ec_privkey_pk8_der[0]), ec_privkey_pk8_der_len);
ASSERT_EQ(138U, pk8_key.size());
ASSERT_EQ(KM_ERROR_OK,
ImportKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(KM_DIGEST_NONE),
KM_KEY_FORMAT_PKCS8, pk8_key));
// Check values derived from the key.
EXPECT_TRUE(contains(sw_enforced(), TAG_ALGORITHM, KM_ALGORITHM_EC));
EXPECT_TRUE(contains(sw_enforced(), TAG_KEY_SIZE, 256));
// And values provided by AndroidKeymaster
EXPECT_TRUE(contains(sw_enforced(), TAG_ORIGIN, KM_ORIGIN_IMPORTED));
EXPECT_TRUE(contains(sw_enforced(), KM_TAG_CREATION_DATETIME));
string message(32, 'a');
string signature;
SignMessage(message, &signature, KM_DIGEST_NONE);
VerifyMessage(message, signature, KM_DIGEST_NONE);
}
TEST_P(ImportKeyTest, EcdsaSizeMismatch) {
string pk8_key(reinterpret_cast<char*>(&ec_privkey_pk8_der[0]), ec_privkey_pk8_der_len);
ASSERT_EQ(138U, pk8_key.size());
ASSERT_EQ(KM_ERROR_IMPORT_PARAMETER_MISMATCH,
ImportKey(AuthorizationSetBuilder()
.EcdsaSigningKey(224 /* Doesn't match key */)
.Digest(KM_DIGEST_NONE),
KM_KEY_FORMAT_PKCS8, pk8_key));
}
TEST_P(ImportKeyTest, AesKeySuccess) {
char key_data[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
string key(key_data, sizeof(key_data));
ASSERT_EQ(KM_ERROR_OK,
ImportKey(AuthorizationSetBuilder().AesEncryptionKey(128).EcbMode().Authorization(
TAG_PADDING, KM_PAD_PKCS7),
KM_KEY_FORMAT_RAW, key));
EXPECT_TRUE(contains(sw_enforced(), TAG_ORIGIN, KM_ORIGIN_IMPORTED));
EXPECT_TRUE(contains(sw_enforced(), KM_TAG_CREATION_DATETIME));
string message = "Hello World!";
string ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_PKCS7);
string plaintext = DecryptMessage(ciphertext, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(message, plaintext);
}
TEST_P(ImportKeyTest, HmacSha256KeySuccess) {
char key_data[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
string key(key_data, sizeof(key_data));
ASSERT_EQ(KM_ERROR_OK, ImportKey(AuthorizationSetBuilder()
.HmacKey(sizeof(key_data) * 8)
.Digest(KM_DIGEST_SHA_2_256)
.Authorization(TAG_MIN_MAC_LENGTH, 256),
KM_KEY_FORMAT_RAW, key));
EXPECT_TRUE(contains(sw_enforced(), TAG_ORIGIN, KM_ORIGIN_IMPORTED));
EXPECT_TRUE(contains(sw_enforced(), KM_TAG_CREATION_DATETIME));
string message = "Hello World!";
string signature;
MacMessage(message, &signature, 256);
VerifyMac(message, signature);
}
auto wrapped_key = hex2str(
"3082017902010004820100934bf94e2aa28a3f83c9f79297250262fbe3276b5a1c91159bbfa3ef8957aac84b59b30b"
"455a79c2973480823d8b3863c3deef4a8e243590268d80e18751a0e130f67ce6a1ace9f79b95e097474febc981195b"
"1d13a69086c0863f66a7b7fdb48792227b1ac5e2489febdf087ab5486483033a6f001ca5d1ec1e27f5c30f4cec2642"
"074a39ae68aee552e196627a8e3d867e67a8c01b11e75f13cca0a97ab668b50cda07a8ecb7cd8e3dd7009c9636534f"
"6f239cffe1fc8daa466f78b676c7119efb96bce4e69ca2a25d0b34ed9c3ff999b801597d5220e307eaa5bee507fb94"
"d1fa69f9e519b2de315bac92c36f2ea1fa1df4478c0ddedeae8c70e0233cd098040cd796b02c370f1fa4cc0124f130"
"2e0201033029a1083106020100020101a203020120a30402020100a4053103020101a6053103020140bf8377020500"
"0420ccd540855f833a5e1480bfd2d36faf3aeee15df5beabe2691bc82dde2a7aa910041064c9f689c60ff6223ab6e6"
"999e0eb6e5");
auto wrapped_key_masked = hex2str(
"3082017902010004820100aad93ed5924f283b4bb5526fbe7a1412f9d9749ec30db9062b29e574a8546f33c8873245"
"2f5b8e6a391ee76c39ed1712c61d8df6213dec1cffbc17a8c6d04c7b30893d8daa9b2015213e21946821553207f8f9"
"931c4caba23ed3bee28b36947e47f10e0a5c3dc51c988a628daad3e5e1f4005e79c2d5a96c284b4b8d7e4948f331e5"
"b85dd5a236f85579f3ea1d1b848487470bdb0ab4f81a12bee42c99fe0df4bee3759453e69ad1d68a809ce06b949f76"
"94a990429b2fe81e066ff43e56a21602db70757922a4bcc23ab89f1e35da77586775f423e519c2ea394caf48a28d0c"
"8020f1dcf6b3a68ec246f615ae96dae9a079b1f6eb959033c1af5c125fd94168040c6d9721d08589581ab49204a330"
"2e0201033029a1083106020100020101a203020120a30402020100a4053103020101a6053103020140bf8377020500"
"0420a61c6e247e25b3e6e69aa78eb03c2d4ac20d1f99a9a024a76f35c8e2cab9b68d04102560c70109ae67c030f00b"
"98b512a670");
auto wrapping_key = hex2str(
"308204be020100300d06092a864886f70d0101010500048204a8308204a40201000282010100aec367931d8900ce56"
"b0067f7d70e1fc653f3f34d194c1fed50018fb43db937b06e673a837313d56b1c725150a3fef86acbddc41bb759c28"
"54eae32d35841efb5c18d82bc90a1cb5c1d55adf245b02911f0b7cda88c421ff0ebafe7c0d23be312d7bd5921ffaea"
"1347c157406fef718f682643e4e5d33c6703d61c0cf7ac0bf4645c11f5c1374c3886427411c449796792e0bef75dec"
"858a2123c36753e02a95a96d7c454b504de385a642e0dfc3e60ac3a7ee4991d0d48b0172a95f9536f02ba13cecccb9"
"2b727db5c27e5b2f5cec09600b286af5cf14c42024c61ddfe71c2a8d7458f185234cb00e01d282f10f8fc6721d2aed"
"3f4833cca2bd8fa62821dd55020301000102820100431447b6251908112b1ee76f99f3711a52b6630960046c2de70d"
"e188d833f8b8b91e4d785caeeeaf4f0f74414e2cda40641f7fe24f14c67a88959bdb27766df9e710b630a03adc683b"
"5d2c43080e52bee71e9eaeb6de297a5fea1072070d181c822bccff087d63c940ba8a45f670feb29fb4484d1c95e6d2"
"579ba02aae0a00900c3ebf490e3d2cd7ee8d0e20c536e4dc5a5097272888cddd7e91f228b1c4d7474c55b8fcd618c4"
"a957bbddd5ad7407cc312d8d98a5caf7e08f4a0d6b45bb41c652659d5a5ba05b663737a8696281865ba20fbdd7f851"
"e6c56e8cbe0ddbbf24dc03b2d2cb4c3d540fb0af52e034a2d06698b128e5f101e3b51a34f8d8b4f8618102818100de"
"392e18d682c829266cc3454e1d6166242f32d9a1d10577753e904ea7d08bff841be5bac82a164c5970007047b8c517"
"db8f8f84e37bd5988561bdf503d4dc2bdb38f885434ae42c355f725c9a60f91f0788e1f1a97223b524b5357fdf72e2"
"f696bab7d78e32bf92ba8e1864eab1229e91346130748a6e3c124f9149d71c743502818100c95387c0f9d35f137b57"
"d0d65c397c5e21cc251e47008ed62a542409c8b6b6ac7f8967b3863ca645fcce49582a9aa17349db6c4a95affdae0d"
"ae612e1afac99ed39a2d934c880440aed8832f9843163a47f27f392199dc1202f9a0f9bd08308007cb1e4e7f583093"
"66a7de25f7c3c9b880677c068e1be936e81288815252a8a102818057ff8ca1895080b2cae486ef0adfd791fb0235c0"
"b8b36cd6c136e52e4085f4ea5a063212a4f105a3764743e53281988aba073f6e0027298e1c4378556e0efca0e14ece"
"1af76ad0b030f27af6f0ab35fb73a060d8b1a0e142fa2647e93b32e36d8282ae0a4de50ab7afe85500a16f43a64719"
"d6e2b9439823719cd08bcd03178102818100ba73b0bb28e3f81e9bd1c568713b101241acc607976c4ddccc90e65b65"
"56ca31516058f92b6e09f3b160ff0e374ec40d78ae4d4979fde6ac06a1a400c61dd31254186af30b22c10582a8a43e"
"34fe949c5f3b9755bae7baa7b7b7a6bd03b38cef55c86885fc6c1978b9cee7ef33da507c9df6b9277cff1e6aaa5d57"
"aca528466102818100c931617c77829dfb1270502be9195c8f2830885f57dba869536811e6864236d0c4736a0008a1"
"45af36b8357a7c3d139966d04c4e00934ea1aede3bb6b8ec841dc95e3f579751e2bfdfe27ae778983f959356210723"
"287b0affcc9f727044d48c373f1babde0724fa17a4fd4da0902c7c9b9bf27ba61be6ad02dfddda8f4e6822");
string zero_masking_key =
hex2str("0000000000000000000000000000000000000000000000000000000000000000");
string masking_key = hex2str("D796B02C370F1FA4CC0124F14EC8CBEBE987E825246265050F399A51FD477DFC");
class ImportWrappedKeyTest : public testing::Test {
public:
ImportWrappedKeyTest() : keymaster_(new PureSoftKeymasterContext(kCurrentKmVersion), 16) {}
protected:
void SetUp() override {
ConfigureRequest configReq(kMaxMessageVersion);
configReq.os_version = kOsVersion;
configReq.os_patchlevel = kOsPatchLevel;
ConfigureResponse configRsp(kMaxMessageVersion);
keymaster_.Configure(configReq, &configRsp);
EXPECT_EQ(KM_ERROR_OK, configRsp.error);
}
keymaster_error_t BeginOperation(keymaster_purpose_t purpose,
const AuthorizationSet& input_set) {
BeginOperationRequest req(kMaxMessageVersion);
req.purpose = purpose;
req.SetKeyMaterial(blob_);
req.additional_params = input_set;
BeginOperationResponse rsp(kMaxMessageVersion);
keymaster_.BeginOperation(req, &rsp);
op_handle_ = rsp.op_handle;
return rsp.error;
}
keymaster_error_t FinishOperation(const string& input, string* output) {
FinishOperationRequest req(kMaxMessageVersion);
req.op_handle = op_handle_;
req.input.Reinitialize(input.data(), input.size());
FinishOperationResponse rsp(kMaxMessageVersion);
keymaster_.FinishOperation(req, &rsp);
if (output) {
*output = string(reinterpret_cast<const char*>(rsp.output.peek_read()),
rsp.output.available_read());
}
return rsp.error;
}
string ProcessMessage(keymaster_purpose_t purpose, const string& message,
const AuthorizationSet& begin_params) {
EXPECT_EQ(KM_ERROR_OK, BeginOperation(purpose, begin_params));
string result;
EXPECT_EQ(KM_ERROR_OK, FinishOperation(message, &result));
return result;
}
AndroidKeymaster keymaster_;
KeymasterKeyBlob blob_;
uint64_t op_handle_;
};
TEST_F(ImportWrappedKeyTest, GoldenKeySuccess) {
ImportKeyRequest import_request(kMaxMessageVersion);
auto import_params = AuthorizationSetBuilder()
.RsaEncryptionKey(2048, 65537)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_OAEP)
.Authorization(TAG_PURPOSE, KM_PURPOSE_WRAP)
.build();
import_request.key_description.Reinitialize(import_params);
import_request.key_data = KeymasterKeyBlob(
reinterpret_cast<const uint8_t*>(wrapping_key.c_str()), wrapping_key.size());
import_request.key_format = KM_KEY_FORMAT_PKCS8;
ImportKeyResponse import_response(kMaxMessageVersion);
keymaster_.ImportKey(import_request, &import_response);
ASSERT_EQ(import_response.error, KM_ERROR_OK);
ImportWrappedKeyRequest request(kMaxMessageVersion);
KeymasterKeyBlob wrapped_key_blob(reinterpret_cast<const uint8_t*>(wrapped_key.c_str()),
wrapped_key.size());
request.SetKeyMaterial(wrapped_key_blob, import_response.key_blob);
request.SetMaskingKeyMaterial(reinterpret_cast<const uint8_t*>(zero_masking_key.c_str()),
zero_masking_key.size());
ImportWrappedKeyResponse response(kMaxMessageVersion);
keymaster_.ImportWrappedKey(request, &response);
EXPECT_EQ(response.error, KM_ERROR_OK);
// Check that the tags from the wrapped auth list were imported correctly
ASSERT_EQ(response.key_blob.key_material_size > 0, true);
ASSERT_EQ(response.unenforced.Contains(TAG_ALGORITHM), true);
ASSERT_EQ(response.unenforced.Contains(TAG_KEY_SIZE), true);
ASSERT_EQ(response.unenforced.Contains(TAG_PURPOSE), true);
ASSERT_EQ(response.unenforced.Contains(TAG_BLOCK_MODE), true);
blob_ = move(response.key_blob);
string message = "Hello World!";
auto params = AuthorizationSetBuilder().BlockMode(KM_MODE_ECB).Padding(KM_PAD_PKCS7).build();
string ciphertext = ProcessMessage(KM_PURPOSE_ENCRYPT, message, params);
string plaintext = ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext, params);
EXPECT_EQ(message, plaintext);
}
TEST_F(ImportWrappedKeyTest, SuccessMaskingKey) {
ImportKeyRequest import_request(kMaxMessageVersion);
auto import_params = AuthorizationSetBuilder()
.RsaEncryptionKey(2048, 65537)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_OAEP)
.Authorization(TAG_PURPOSE, KM_PURPOSE_WRAP)
.build();
import_request.key_description.Reinitialize(import_params);
import_request.key_data = KeymasterKeyBlob(
reinterpret_cast<const uint8_t*>(wrapping_key.c_str()), wrapping_key.size());
import_request.key_format = KM_KEY_FORMAT_PKCS8;
ImportKeyResponse import_response(kMaxMessageVersion);
keymaster_.ImportKey(import_request, &import_response);
EXPECT_EQ(import_response.error, KM_ERROR_OK);
if (import_response.error != KM_ERROR_OK) return;
ImportWrappedKeyRequest request(kMaxMessageVersion);
KeymasterKeyBlob wrapped_key_blob(reinterpret_cast<const uint8_t*>(wrapped_key_masked.c_str()),
wrapped_key_masked.size());
request.SetKeyMaterial(wrapped_key_blob, import_response.key_blob);
request.SetMaskingKeyMaterial(reinterpret_cast<const uint8_t*>(masking_key.c_str()),
masking_key.size());
ImportWrappedKeyResponse response(kMaxMessageVersion);
keymaster_.ImportWrappedKey(request, &response);
EXPECT_EQ(response.error, KM_ERROR_OK);
}
TEST_F(ImportWrappedKeyTest, WrongMaskingKey) {
ImportKeyRequest import_request(kMaxMessageVersion);
auto import_params = AuthorizationSetBuilder()
.RsaEncryptionKey(2048, 65537)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_RSA_OAEP)
.Authorization(TAG_PURPOSE, KM_PURPOSE_WRAP)
.build();
import_request.key_description.Reinitialize(import_params);
import_request.key_data = KeymasterKeyBlob(
reinterpret_cast<const uint8_t*>(wrapping_key.c_str()), wrapping_key.size());
import_request.key_format = KM_KEY_FORMAT_PKCS8;
ImportKeyResponse import_response(kMaxMessageVersion);
keymaster_.ImportKey(import_request, &import_response);
EXPECT_EQ(import_response.error, KM_ERROR_OK);
if (import_response.error != KM_ERROR_OK) return;
ImportWrappedKeyRequest request(kMaxMessageVersion);
KeymasterKeyBlob wrapped_key_blob(reinterpret_cast<const uint8_t*>(wrapped_key_masked.c_str()),
wrapped_key_masked.size());
request.SetKeyMaterial(wrapped_key_blob, import_response.key_blob);
request.SetMaskingKeyMaterial(reinterpret_cast<const uint8_t*>(zero_masking_key.c_str()),
zero_masking_key.size());
ImportWrappedKeyResponse response(kMaxMessageVersion);
keymaster_.ImportWrappedKey(request, &response);
EXPECT_EQ(response.error, KM_ERROR_VERIFICATION_FAILED);
}
TEST_F(ImportWrappedKeyTest, WrongPurpose) {
ImportKeyRequest import_request(kMaxMessageVersion);
auto import_params = AuthorizationSetBuilder()
.RsaEncryptionKey(2048, 65537)
.Digest(KM_DIGEST_SHA1)
.Padding(KM_PAD_RSA_OAEP)
.build();
import_request.key_description.Reinitialize(import_params);
import_request.key_data = KeymasterKeyBlob(
reinterpret_cast<const uint8_t*>(wrapping_key.c_str()), wrapping_key.size());
import_request.key_format = KM_KEY_FORMAT_PKCS8;
ImportKeyResponse import_response(kMaxMessageVersion);
keymaster_.ImportKey(import_request, &import_response);
EXPECT_EQ(import_response.error, KM_ERROR_OK);
if (import_response.error != KM_ERROR_OK) return;
ImportWrappedKeyRequest request(kMaxMessageVersion);
KeymasterKeyBlob wrapped_key_blob(reinterpret_cast<const uint8_t*>(wrapped_key.c_str()),
wrapped_key.size());
request.SetKeyMaterial(wrapped_key_blob, import_response.key_blob);
ImportWrappedKeyResponse response(kMaxMessageVersion);
keymaster_.ImportWrappedKey(request, &response);
EXPECT_EQ(response.error, KM_ERROR_INCOMPATIBLE_PURPOSE);
}
typedef Keymaster2Test EncryptionOperationsTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, EncryptionOperationsTest, test_params);
TEST_P(EncryptionOperationsTest, RsaNoPaddingSuccess) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(256, 3).Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string ciphertext1 = EncryptMessage(string(message), KM_PAD_NONE);
EXPECT_EQ(256U / 8, ciphertext1.size());
string ciphertext2 = EncryptMessage(string(message), KM_PAD_NONE);
EXPECT_EQ(256U / 8, ciphertext2.size());
// Unpadded RSA is deterministic
EXPECT_EQ(ciphertext1, ciphertext2);
}
TEST_P(EncryptionOperationsTest, RsaNoPaddingTooShort) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(256, 3).Padding(KM_PAD_NONE)));
string message = "1";
string ciphertext = EncryptMessage(message, KM_PAD_NONE);
EXPECT_EQ(256U / 8, ciphertext.size());
string expected_plaintext = string(256 / 8 - 1, 0) + message;
string plaintext = DecryptMessage(ciphertext, KM_PAD_NONE);
EXPECT_EQ(expected_plaintext, plaintext);
}
TEST_P(EncryptionOperationsTest, RsaNoPaddingTooLong) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(256, 3).Padding(KM_PAD_NONE)));
string message = "123456789012345678901234567890123";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
string result;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, UpdateOperation(message, &result, &input_consumed));
}
TEST_P(EncryptionOperationsTest, RsaNoPaddingLargerThanModulus) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(256, 3).Padding(KM_PAD_NONE)));
string exported;
ASSERT_EQ(KM_ERROR_OK, ExportKey(KM_KEY_FORMAT_X509, &exported));
const uint8_t* p = reinterpret_cast<const uint8_t*>(exported.data());
unique_ptr<EVP_PKEY, EVP_PKEY_Delete> pkey(
d2i_PUBKEY(nullptr /* alloc new */, &p, exported.size()));
unique_ptr<RSA, RSA_Delete> rsa(EVP_PKEY_get1_RSA(pkey.get()));
size_t modulus_len = BN_num_bytes(rsa->n);
ASSERT_EQ(256U / 8, modulus_len);
unique_ptr<uint8_t[]> modulus_buf(new uint8_t[modulus_len]);
BN_bn2bin(rsa->n, modulus_buf.get());
// The modulus is too big to encrypt.
string message(reinterpret_cast<const char*>(modulus_buf.get()), modulus_len);
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
string result;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(message, &result, &input_consumed));
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, FinishOperation(&result));
// One smaller than the modulus is okay.
BN_sub(rsa->n, rsa->n, BN_value_one());
modulus_len = BN_num_bytes(rsa->n);
ASSERT_EQ(256U / 8, modulus_len);
BN_bn2bin(rsa->n, modulus_buf.get());
message = string(reinterpret_cast<const char*>(modulus_buf.get()), modulus_len);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(message, "", &result));
}
TEST_P(EncryptionOperationsTest, RsaOaepSuccess) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)));
string message = "Hello";
string ciphertext1 = EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext1.size());
string ciphertext2 = EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext2.size());
// OAEP randomizes padding so every result should be different.
EXPECT_NE(ciphertext1, ciphertext2);
}
TEST_P(EncryptionOperationsTest, RsaOaepWithMgf224Success) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)
.OaepMgfDigest(KM_DIGEST_SHA_2_224)));
string message = "Hello";
string ciphertext1 =
EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_224, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext1.size());
string ciphertext2 =
EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_224, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext2.size());
// OAEP randomizes padding so every result should be different.
EXPECT_NE(ciphertext1, ciphertext2);
}
TEST_P(EncryptionOperationsTest, RsaOaepWithMgfMD5Success) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)
.OaepMgfDigest(KM_DIGEST_MD5)));
string message = "Hello";
string ciphertext1 =
EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_DIGEST_MD5, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext1.size());
string ciphertext2 =
EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_DIGEST_MD5, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext2.size());
// OAEP randomizes padding so every result should be different.
EXPECT_NE(ciphertext1, ciphertext2);
}
TEST_P(EncryptionOperationsTest, RsaOaepSha224Success) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_224)));
string message = "Hello";
string ciphertext1 = EncryptMessage(string(message), KM_DIGEST_SHA_2_224, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext1.size());
string ciphertext2 = EncryptMessage(string(message), KM_DIGEST_SHA_2_224, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext2.size());
// OAEP randomizes padding so every result should be different.
EXPECT_NE(ciphertext1, ciphertext2);
}
TEST_P(EncryptionOperationsTest, RsaOaepRoundTrip) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)));
string message = "Hello World!";
string ciphertext = EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, RsaOaepWithMgfSha256RoundTrip) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)
.OaepMgfDigest(KM_DIGEST_SHA_2_256)));
string message = "Hello World!";
string ciphertext =
EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext.size());
string plaintext =
DecryptMessage(ciphertext, KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, RsaOaepSha224RoundTrip) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_224)));
string message = "Hello World!";
string ciphertext = EncryptMessage(string(message), KM_DIGEST_SHA_2_224, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_DIGEST_SHA_2_224, KM_PAD_RSA_OAEP);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, RsaOaepInvalidDigest) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(512, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_NONE)));
string message = "Hello World!";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_OAEP);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_NONE);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_DIGEST, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, RsaOaepWithMgfInvalidDigest) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(512, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)
.OaepMgfDigest(KM_DIGEST_SHA_2_256)));
string message = "Hello World!";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_OAEP);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
begin_params.push_back(TAG_RSA_OAEP_MGF_DIGEST, KM_DIGEST_SHA_2_224);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_MGF_DIGEST, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, RsaOaepUnauthorizedDigest) {
if (GetParam()->minimal_digest_set())
// We don't have two supported digests, so we can't try authorizing one and using another.
return;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(512, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)));
string message = "Hello World!";
// Works because encryption is a public key operation.
EncryptMessage(string(message), KM_DIGEST_SHA1, KM_PAD_RSA_OAEP);
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_OAEP);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA1);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_DIGEST, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, RsaOaepDecryptWithWrongDigest) {
if (GetParam()->minimal_digest_set())
// We don't have two supported digests, so we can't try encrypting with one and decrypting
// with another.
return;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(768, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)
.Digest(KM_DIGEST_SHA_2_384)));
string message = "Hello World!";
string ciphertext = EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
string result;
size_t input_consumed;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_OAEP);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_384);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext, &result, &input_consumed));
EXPECT_EQ(KM_ERROR_UNKNOWN_ERROR, FinishOperation(&result));
EXPECT_EQ(0U, result.size());
}
TEST_P(EncryptionOperationsTest, RsaOaepTooLarge) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(512, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA1)));
string message = "12345678901234567890123";
string result;
size_t input_consumed;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_OAEP);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA1);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(message, &result, &input_consumed));
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, FinishOperation(&result));
EXPECT_EQ(0U, result.size());
}
TEST_P(EncryptionOperationsTest, RsaOaepCorruptedDecrypt) {
size_t key_size = 768;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(768, 3)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_SHA_2_256)));
string message = "Hello World!";
string ciphertext = EncryptMessage(string(message), KM_DIGEST_SHA_2_256, KM_PAD_RSA_OAEP);
EXPECT_EQ(key_size / 8, ciphertext.size());
// Corrupt the ciphertext
ciphertext[key_size / 8 / 2]++;
string result;
size_t input_consumed;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_OAEP);
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext, &result, &input_consumed));
EXPECT_EQ(KM_ERROR_UNKNOWN_ERROR, FinishOperation(&result));
EXPECT_EQ(0U, result.size());
}
TEST_P(EncryptionOperationsTest, RsaPkcs1Success) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(512, 3).Padding(
KM_PAD_RSA_PKCS1_1_5_ENCRYPT)));
string message = "Hello World!";
string ciphertext1 = EncryptMessage(message, KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(512U / 8, ciphertext1.size());
string ciphertext2 = EncryptMessage(message, KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(512U / 8, ciphertext2.size());
// PKCS1 v1.5 randomizes padding so every result should be different.
EXPECT_NE(ciphertext1, ciphertext2);
}
TEST_P(EncryptionOperationsTest, RsaPkcs1RoundTrip) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(512, 3).Padding(
KM_PAD_RSA_PKCS1_1_5_ENCRYPT)));
string message = "Hello World!";
string ciphertext = EncryptMessage(message, KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(512U / 8, ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, RsaRoundTripAllCombinations) {
size_t key_size = 2048;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaEncryptionKey(key_size, 3)
.Padding(KM_PAD_RSA_PKCS1_1_5_ENCRYPT)
.Padding(KM_PAD_RSA_OAEP)
.Digest(KM_DIGEST_NONE)
.Digest(KM_DIGEST_MD5)
.Digest(KM_DIGEST_SHA1)
.Digest(KM_DIGEST_SHA_2_224)
.Digest(KM_DIGEST_SHA_2_256)
.Digest(KM_DIGEST_SHA_2_384)
.Digest(KM_DIGEST_SHA_2_512)));
string message = "Hello World!";
keymaster_padding_t padding_modes[] = {KM_PAD_RSA_OAEP, KM_PAD_RSA_PKCS1_1_5_ENCRYPT};
keymaster_digest_t digests[] = {
KM_DIGEST_NONE, KM_DIGEST_MD5, KM_DIGEST_SHA1, KM_DIGEST_SHA_2_224,
KM_DIGEST_SHA_2_256, KM_DIGEST_SHA_2_384, KM_DIGEST_SHA_2_512,
};
for (auto padding : padding_modes)
for (auto digest : digests) {
if (padding == KM_PAD_RSA_OAEP && digest == KM_DIGEST_NONE)
// OAEP requires a digest.
continue;
string ciphertext = EncryptMessage(message, digest, padding);
EXPECT_EQ(key_size / 8, ciphertext.size());
string plaintext = DecryptMessage(ciphertext, digest, padding);
EXPECT_EQ(message, plaintext);
}
}
TEST_P(EncryptionOperationsTest, RsaPkcs1TooLarge) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(512, 3).Padding(
KM_PAD_RSA_PKCS1_1_5_ENCRYPT)));
string message = "123456789012345678901234567890123456789012345678901234";
string result;
size_t input_consumed;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(message, &result, &input_consumed));
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, FinishOperation(&result));
EXPECT_EQ(0U, result.size());
}
TEST_P(EncryptionOperationsTest, RsaPkcs1CorruptedDecrypt) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(512, 3).Padding(
KM_PAD_RSA_PKCS1_1_5_ENCRYPT)));
string message = "Hello World!";
string ciphertext = EncryptMessage(string(message), KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(512U / 8, ciphertext.size());
// Corrupt the ciphertext
ciphertext[512 / 8 / 2]++;
string result;
size_t input_consumed;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_RSA_PKCS1_1_5_ENCRYPT);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext, &result, &input_consumed));
EXPECT_EQ(KM_ERROR_UNKNOWN_ERROR, FinishOperation(&result));
EXPECT_EQ(0U, result.size());
}
TEST_P(EncryptionOperationsTest, RsaEncryptWithSigningKey) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().RsaSigningKey(256, 3).Padding(KM_PAD_NONE)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
ASSERT_EQ(KM_ERROR_INCOMPATIBLE_PURPOSE, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, EcdsaEncrypt) {
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(224).Digest(KM_DIGEST_NONE)));
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PURPOSE, BeginOperation(KM_PURPOSE_ENCRYPT));
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PURPOSE, BeginOperation(KM_PURPOSE_DECRYPT));
}
TEST_P(EncryptionOperationsTest, HmacEncrypt) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.HmacKey(128)
.Digest(KM_DIGEST_SHA_2_256)
.Padding(KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PURPOSE, BeginOperation(KM_PURPOSE_ENCRYPT));
ASSERT_EQ(KM_ERROR_UNSUPPORTED_PURPOSE, BeginOperation(KM_PURPOSE_DECRYPT));
}
TEST_P(EncryptionOperationsTest, AesEcbRoundTripSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Padding(KM_PAD_NONE)));
// Two-block message.
string message = "12345678901234567890123456789012";
string ciphertext1 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message.size(), ciphertext1.size());
string ciphertext2 = EncryptMessage(string(message), KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message.size(), ciphertext2.size());
// ECB is deterministic.
EXPECT_EQ(ciphertext1, ciphertext2);
string plaintext = DecryptMessage(ciphertext1, KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesEcbNotAuthorized) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
// Two-block message.
string message = "12345678901234567890123456789012";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_BLOCK_MODE, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, AesEcbNoPaddingWrongInputSize) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Padding(KM_PAD_NONE)));
// Message is slightly shorter than two blocks.
string message = "1234567890123456789012345678901";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
string ciphertext;
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, FinishOperation(message, "", &ciphertext));
}
TEST_P(EncryptionOperationsTest, AesEcbPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
// Try various message lengths; all should work.
for (size_t i = 0; i < 32; ++i) {
string message(i, 'a');
string ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(i + 16 - (i % 16), ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(message, plaintext);
}
}
TEST_P(EncryptionOperationsTest, AesEcbNoPaddingKeyWithPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Authorization(TAG_PADDING, KM_PAD_NONE)));
// Try various message lengths; all should fail.
for (size_t i = 0; i < 32; ++i) {
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_PKCS7);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_PADDING_MODE,
BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
}
TEST_P(EncryptionOperationsTest, AesEcbPkcs7PaddingCorrupted) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
string message = "a";
string ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(16U, ciphertext.size());
EXPECT_NE(ciphertext, message);
++ciphertext[ciphertext.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_PKCS7);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext, &plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, FinishOperation(&plaintext));
}
TEST_P(EncryptionOperationsTest, AesCtrRoundTripSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CTR)
.Padding(KM_PAD_NONE)));
string message = "123";
string iv1;
string ciphertext1 = EncryptMessage(message, KM_MODE_CTR, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
EXPECT_EQ(16U, iv1.size());
string iv2;
string ciphertext2 = EncryptMessage(message, KM_MODE_CTR, KM_PAD_NONE, &iv2);
EXPECT_EQ(message.size(), ciphertext2.size());
EXPECT_EQ(16U, iv2.size());
// IVs should be random, so ciphertexts should differ.
EXPECT_NE(iv1, iv2);
EXPECT_NE(ciphertext1, ciphertext2);
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CTR, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesCtrIncremental) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CTR)
.Padding(KM_PAD_NONE)));
int increment = 15;
string message(239, 'a');
AuthorizationSet input_params(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CTR);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
AuthorizationSet output_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, input_params, &output_params));
string ciphertext;
size_t input_consumed;
for (size_t i = 0; i < message.size(); i += increment)
EXPECT_EQ(KM_ERROR_OK,
UpdateOperation(message.substr(i, increment), &ciphertext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
EXPECT_EQ(message.size(), ciphertext.size());
// Move TAG_NONCE into input_params
input_params.Reinitialize(output_params);
input_params.push_back(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CTR);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
output_params.Clear();
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, input_params, &output_params));
string plaintext;
for (size_t i = 0; i < ciphertext.size(); i += increment)
EXPECT_EQ(KM_ERROR_OK,
UpdateOperation(ciphertext.substr(i, increment), &plaintext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
EXPECT_EQ(ciphertext.size(), plaintext.size());
EXPECT_EQ(message, plaintext);
}
struct AesCtrSp80038aTestVector {
const char* key;
const char* nonce;
const char* plaintext;
const char* ciphertext;
};
// These test vectors are taken from
// http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf, section F.5.
static const AesCtrSp80038aTestVector kAesCtrSp80038aTestVectors[] = {
// AES-128
{
"2b7e151628aed2a6abf7158809cf4f3c",
"f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
"6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e51"
"30c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710",
"874d6191b620e3261bef6864990db6ce9806f66b7970fdff8617187bb9fffdff"
"5ae4df3edbd5d35e5b4f09020db03eab1e031dda2fbe03d1792170a0f3009cee",
},
// AES-192
{
"8e73b0f7da0e6452c810f32b809079e562f8ead2522c6b7b",
"f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
"6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e51"
"30c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710",
"1abc932417521ca24f2b0459fe7e6e0b090339ec0aa6faefd5ccc2c6f4ce8e94"
"1e36b26bd1ebc670d1bd1d665620abf74f78a7f6d29809585a97daec58c6b050",
},
// AES-256
{
"603deb1015ca71be2b73aef0857d77811f352c073b6108d72d9810a30914dff4",
"f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff",
"6bc1bee22e409f96e93d7e117393172aae2d8a571e03ac9c9eb76fac45af8e51"
"30c81c46a35ce411e5fbc1191a0a52eff69f2445df4f9b17ad2b417be66c3710",
"601ec313775789a5b7a7f504bbf3d228f443e3ca4d62b59aca84e990cacaf5c5"
"2b0930daa23de94ce87017ba2d84988ddfc9c58db67aada613c2dd08457941a6",
},
};
TEST_P(EncryptionOperationsTest, AesCtrSp80038aTestVector) {
for (size_t i = 0; i < 3; i++) {
const AesCtrSp80038aTestVector& test(kAesCtrSp80038aTestVectors[i]);
const string key = hex2str(test.key);
const string nonce = hex2str(test.nonce);
const string plaintext = hex2str(test.plaintext);
const string ciphertext = hex2str(test.ciphertext);
CheckAesCtrTestVector(key, nonce, plaintext, ciphertext);
}
}
TEST_P(EncryptionOperationsTest, AesCtrInvalidPaddingMode) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CTR)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_CTR);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_PADDING_MODE, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, AesCtrInvalidCallerNonce) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CTR)
.Authorization(TAG_CALLER_NONCE)
.Padding(KM_PAD_NONE)));
AuthorizationSet input_params(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CTR);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
input_params.push_back(TAG_NONCE, "123", 3);
EXPECT_EQ(KM_ERROR_INVALID_NONCE, BeginOperation(KM_PURPOSE_ENCRYPT, input_params));
}
TEST_P(EncryptionOperationsTest, AesCbcRoundTripSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
// Two-block message.
string message = "12345678901234567890123456789012";
string iv1;
string ciphertext1 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
string iv2;
string ciphertext2 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv2);
EXPECT_EQ(message.size(), ciphertext2.size());
// IVs should be random, so ciphertexts should differ.
EXPECT_NE(iv1, iv2);
EXPECT_NE(ciphertext1, ciphertext2);
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CBC, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesCallerNonce) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Authorization(TAG_CALLER_NONCE)
.Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string iv1;
// Don't specify nonce, should get a random one.
string ciphertext1 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
EXPECT_EQ(16U, iv1.size());
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CBC, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
// Now specify a nonce, should also work.
AuthorizationSet input_params(client_params());
AuthorizationSet update_params;
AuthorizationSet output_params;
input_params.push_back(TAG_NONCE, "abcdefghijklmnop", 16);
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
string ciphertext2 =
ProcessMessage(KM_PURPOSE_ENCRYPT, message, input_params, update_params, &output_params);
// Decrypt with correct nonce.
plaintext = ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext2, input_params, update_params,
&output_params);
EXPECT_EQ(message, plaintext);
// Now try with wrong nonce.
input_params.Reinitialize(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
input_params.push_back(TAG_NONCE, "aaaaaaaaaaaaaaaa", 16);
plaintext = ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext2, input_params, update_params,
&output_params);
EXPECT_NE(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesCallerNonceProhibited) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string iv1;
// Don't specify nonce, should get a random one.
string ciphertext1 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
EXPECT_EQ(16U, iv1.size());
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CBC, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
// Now specify a nonce, should fail.
AuthorizationSet input_params(client_params());
AuthorizationSet update_params;
AuthorizationSet output_params;
input_params.push_back(TAG_NONCE, "abcdefghijklmnop", 16);
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_CALLER_NONCE_PROHIBITED,
BeginOperation(KM_PURPOSE_ENCRYPT, input_params, &output_params));
}
TEST_P(EncryptionOperationsTest, AesCbcIncrementalNoPadding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
int increment = 15;
string message(240, 'a');
AuthorizationSet input_params(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
AuthorizationSet output_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, input_params, &output_params));
string ciphertext;
size_t input_consumed;
for (size_t i = 0; i < message.size(); i += increment)
EXPECT_EQ(KM_ERROR_OK,
UpdateOperation(message.substr(i, increment), &ciphertext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
EXPECT_EQ(message.size(), ciphertext.size());
// Move TAG_NONCE into input_params
input_params.Reinitialize(output_params);
input_params.push_back(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
output_params.Clear();
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, input_params, &output_params));
string plaintext;
for (size_t i = 0; i < ciphertext.size(); i += increment)
EXPECT_EQ(KM_ERROR_OK,
UpdateOperation(ciphertext.substr(i, increment), &plaintext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
EXPECT_EQ(ciphertext.size(), plaintext.size());
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesCbcPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
// Try various message lengths; all should work.
for (size_t i = 0; i < 32; ++i) {
string message(i, 'a');
string iv;
string ciphertext = EncryptMessage(message, KM_MODE_CBC, KM_PAD_PKCS7, &iv);
EXPECT_EQ(i + 16 - (i % 16), ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_MODE_CBC, KM_PAD_PKCS7, iv);
EXPECT_EQ(message, plaintext);
}
}
TEST_P(EncryptionOperationsTest, AesGcmRoundTripSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string aad = "foobar";
string message = "123456789012345678901234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
// Encrypt
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
string ciphertext;
size_t input_consumed;
AuthorizationSet update_out_params;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(message.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
// Grab nonce
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.push_back(begin_out_params);
// Decrypt.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
&plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesGcmTooShortTag) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string aad = "foobar";
string message = "123456789012345678901234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 96);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_INVALID_MAC_LENGTH,
BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
}
TEST_P(EncryptionOperationsTest, AesGcmTooShortTagOnDecrypt) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string aad = "foobar";
string message = "123456789012345678901234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
// Encrypt
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
string ciphertext;
size_t input_consumed;
AuthorizationSet update_out_params;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(message.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
// Grab nonce
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.Reinitialize(client_params());
begin_params.push_back(begin_out_params);
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 96);
// Decrypt.
EXPECT_EQ(KM_ERROR_INVALID_MAC_LENGTH, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, AesGcmCorruptKey) {
uint8_t nonce[] = {
0xb7, 0x94, 0x37, 0xae, 0x08, 0xff, 0x35, 0x5d, 0x7d, 0x8a, 0x4d, 0x0f,
};
uint8_t ciphertext[] = {
0xb3, 0xf6, 0x79, 0x9e, 0x8f, 0x93, 0x26, 0xf2, 0xdf, 0x1e, 0x80, 0xfc, 0xd2, 0xcb, 0x16,
0xd7, 0x8c, 0x9d, 0xc7, 0xcc, 0x14, 0xbb, 0x67, 0x78, 0x62, 0xdc, 0x6c, 0x63, 0x9b, 0x3a,
0x63, 0x38, 0xd2, 0x4b, 0x31, 0x2d, 0x39, 0x89, 0xe5, 0x92, 0x0b, 0x5d, 0xbf, 0xc9, 0x76,
0x76, 0x5e, 0xfb, 0xfe, 0x57, 0xbb, 0x38, 0x59, 0x40, 0xa7, 0xa4, 0x3b, 0xdf, 0x05, 0xbd,
0xda, 0xe3, 0xc9, 0xd6, 0xa2, 0xfb, 0xbd, 0xfc, 0xc0, 0xcb, 0xa0,
};
string ciphertext_str(reinterpret_cast<char*>(ciphertext), sizeof(ciphertext));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
begin_params.push_back(TAG_NONCE, nonce, sizeof(nonce));
string plaintext;
size_t input_consumed;
// Import correct key and decrypt
uint8_t good_key[] = {
0xba, 0x76, 0x35, 0x4f, 0x0a, 0xed, 0x6e, 0x8d,
0x91, 0xf4, 0x5c, 0x4f, 0xf5, 0xa0, 0x62, 0xdb,
};
string good_key_str(reinterpret_cast<char*>(good_key), sizeof(good_key));
ASSERT_EQ(KM_ERROR_OK, ImportKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_CALLER_NONCE)
.Authorization(TAG_MIN_MAC_LENGTH, 128),
KM_KEY_FORMAT_RAW, good_key_str));
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext_str, &plaintext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
// Import bad key and decrypt
uint8_t bad_key[] = {
0xbb, 0x76, 0x35, 0x4f, 0x0a, 0xed, 0x6e, 0x8d,
0x91, 0xf4, 0x5c, 0x4f, 0xf5, 0xa0, 0x62, 0xdb,
};
string bad_key_str(reinterpret_cast<char*>(bad_key), sizeof(bad_key));
ASSERT_EQ(KM_ERROR_OK, ImportKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128),
KM_KEY_FORMAT_RAW, bad_key_str));
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext_str, &plaintext, &input_consumed));
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&plaintext));
}
TEST_P(EncryptionOperationsTest, AesGcmAadNoData) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string aad = "123456789012345678";
string empty_message;
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
// Encrypt
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
string ciphertext;
size_t input_consumed;
AuthorizationSet update_out_params;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, empty_message, &update_out_params,
&ciphertext, &input_consumed));
EXPECT_EQ(0U, input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
// Grab nonce
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.push_back(begin_out_params);
// Decrypt.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
&plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
EXPECT_EQ(empty_message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesGcmIncremental) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, "b", 1);
// Encrypt
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
string ciphertext;
size_t input_consumed;
AuthorizationSet update_out_params;
// Send AAD, incrementally
for (int i = 0; i < 1000; ++i) {
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, "", &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(0U, input_consumed);
EXPECT_EQ(0U, ciphertext.size());
}
// Now send data, incrementally, no data.
AuthorizationSet empty_params;
for (int i = 0; i < 1000; ++i) {
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(empty_params, "a", &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(1U, input_consumed);
}
EXPECT_EQ(1000U, ciphertext.size());
// And finish.
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
EXPECT_EQ(1016U, ciphertext.size());
// Grab nonce
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.push_back(begin_out_params);
// Decrypt.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
// Send AAD, incrementally, no data
for (int i = 0; i < 1000; ++i) {
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, "", &update_out_params, &plaintext,
&input_consumed));
EXPECT_EQ(0U, input_consumed);
EXPECT_EQ(0U, plaintext.size());
}
// Now send data, incrementally.
for (size_t i = 0; i < ciphertext.length(); ++i) {
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(empty_params, string(ciphertext.data() + i, 1),
&update_out_params, &plaintext, &input_consumed));
EXPECT_EQ(1U, input_consumed);
}
EXPECT_EQ(1000U, plaintext.size());
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
}
TEST_P(EncryptionOperationsTest, AesGcmMultiPartAad) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string message = "123456789012345678901234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet begin_out_params;
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, "foo", 3);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
// No data, AAD only.
string ciphertext;
size_t input_consumed;
AuthorizationSet update_out_params;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, "" /* message */, &update_out_params,
&ciphertext, &input_consumed));
EXPECT_EQ(0U, input_consumed);
// AAD and data.
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(message.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
// Grab nonce.
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.push_back(begin_out_params);
// Decrypt
update_params.Clear();
update_params.push_back(TAG_ASSOCIATED_DATA, "foofoo", 6);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
&plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesGcmBadAad) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string message = "12345678901234567890123456789012";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, "foobar", 6);
AuthorizationSet finish_params;
AuthorizationSet finish_out_params;
// Encrypt
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
AuthorizationSet update_out_params;
string ciphertext;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(message.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
// Grab nonce
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.push_back(begin_out_params);
update_params.Clear();
update_params.push_back(TAG_ASSOCIATED_DATA, "barfoo" /* Wrong AAD */, 6);
// Decrypt.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
string plaintext;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
&plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&plaintext));
}
TEST_P(EncryptionOperationsTest, AesGcmWrongNonce) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string message = "12345678901234567890123456789012";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, "foobar", 6);
// Encrypt
AuthorizationSet begin_out_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
AuthorizationSet update_out_params;
string ciphertext;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(message.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
begin_params.push_back(TAG_NONCE, "123456789012", 12);
// Decrypt
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
string plaintext;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
&plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&plaintext));
// With wrong nonce, should have gotten garbage plaintext.
EXPECT_NE(message, plaintext);
}
TEST_P(EncryptionOperationsTest, AesGcmCorruptTag) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_GCM)
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MIN_MAC_LENGTH, 128)));
string aad = "foobar";
string message = "123456789012345678901234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_GCM);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
begin_params.push_back(TAG_MAC_LENGTH, 128);
AuthorizationSet begin_out_params;
AuthorizationSet update_params;
update_params.push_back(TAG_ASSOCIATED_DATA, aad.data(), aad.size());
// Encrypt
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &begin_out_params));
AuthorizationSet update_out_params;
string ciphertext;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, message, &update_out_params, &ciphertext,
&input_consumed));
EXPECT_EQ(message.size(), input_consumed);
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
// Corrupt tag
(*ciphertext.rbegin())++;
// Grab nonce.
EXPECT_NE(-1, begin_out_params.find(TAG_NONCE));
begin_params.push_back(begin_out_params);
// Decrypt.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params, &begin_out_params));
string plaintext;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(update_params, ciphertext, &update_out_params,
&plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_VERIFICATION_FAILED, FinishOperation(&plaintext));
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, TripleDesEcbRoundTripSuccess) {
auto auths = AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Padding(KM_PAD_NONE);
ASSERT_EQ(KM_ERROR_OK, GenerateKey(auths));
// Two-block message.
string message = "1234567890123456";
string ciphertext1 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message.size(), ciphertext1.size());
string ciphertext2 = EncryptMessage(string(message), KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message.size(), ciphertext2.size());
// ECB is deterministic.
EXPECT_EQ(ciphertext1, ciphertext2);
string plaintext = DecryptMessage(ciphertext1, KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, TripleDesEcbNotAuthorized) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
// Two-block message.
string message = "1234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_BLOCK_MODE, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, TripleDesEcbNoPaddingWrongInputSize) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Padding(KM_PAD_NONE)));
// Message is slightly shorter than two blocks.
string message = "123456789012345";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
string ciphertext;
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, FinishOperation(message, "", &ciphertext));
}
TEST_P(EncryptionOperationsTest, TripleDesEcbPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
// Try various message lengths; all should work.
for (size_t i = 0; i < 32; ++i) {
string message(i, 'a');
string ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(i + 8 - (i % 8), ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(message, plaintext);
}
}
TEST_P(EncryptionOperationsTest, TripleDesEcbNoPaddingKeyWithPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Authorization(TAG_PADDING, KM_PAD_NONE)));
// Try various message lengths; all should fail.
for (size_t i = 0; i < 32; ++i) {
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_PKCS7);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_PADDING_MODE,
BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
}
TEST_P(EncryptionOperationsTest, TripleDesEcbPkcs7PaddingCorrupted) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
string message = "a";
string ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_PKCS7);
EXPECT_EQ(8U, ciphertext.size());
EXPECT_NE(ciphertext, message);
++ciphertext[ciphertext.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_PKCS7);
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext, &plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, FinishOperation(&plaintext));
}
struct TripleDesTestVector {
const char* name;
const keymaster_purpose_t purpose;
const keymaster_block_mode_t block_mode;
const keymaster_padding_t padding_mode;
const char* key;
const char* iv;
const char* input;
const char* output;
};
// These test vectors are from NIST CAVP, plus a few custom variants to test padding, since all of
// the NIST vectors are multiples of the block size.
static const TripleDesTestVector kTripleDesTestVectors[] = {
{
"TECBMMT2 Encrypt 0", KM_PURPOSE_ENCRYPT, KM_MODE_ECB, KM_PAD_NONE,
"ad192fd064b5579e7a4fb3c8f794f22a", // key
"", // IV
"13bad542f3652d67", // input
"908e543cf2cb254f", // output
},
{
"TECBMMT2 Encrypt 0 PKCS7", KM_PURPOSE_ENCRYPT, KM_MODE_ECB, KM_PAD_PKCS7,
"ad192fd064b5579e7a4fb3c8f794f22a", // key
"", // IV
"13bad542f3652d6700", // input
"908e543cf2cb254fc40165289a89008c", // output
},
{
"TECBMMT2 Encrypt 0 PKCS7 decrypted", KM_PURPOSE_DECRYPT, KM_MODE_ECB, KM_PAD_PKCS7,
"ad192fd064b5579e7a4fb3c8f794f22a", // key
"", // IV
"908e543cf2cb254fc40165289a89008c", // input
"13bad542f3652d6700", // output
},
{
"TECBMMT2 Encrypt 1", KM_PURPOSE_ENCRYPT, KM_MODE_ECB, KM_PAD_NONE,
"259df16e7af804fe83b90e9bf7c7e557", // key
"", // IV
"a4619c433bbd6787c07c81728f9ac9fa", // input
"9e06de155c483c6bcfd834dbc8bd5830", // output
},
{
"TECBMMT2 Decrypt 0", KM_PURPOSE_DECRYPT, KM_MODE_ECB, KM_PAD_NONE,
"b32ff42092024adf2076b9d3d9f19e6d", // key
"", // IV
"2f3f2a49bba807a5", // input
"2249973fa135fb52", // output
},
{
"TECBMMT2 Decrypt 1", KM_PURPOSE_DECRYPT, KM_MODE_ECB, KM_PAD_NONE,
"023dfbe6621aa17cc219eae9cdecd923", // key
"", // IV
"54045dc71d8d565b227ec19f06fef912", // input
"9b071622181e6412de6066429401410d", // output
},
{
"TECBMMT3 Encrypt 0", KM_PURPOSE_ENCRYPT, KM_MODE_ECB, KM_PAD_NONE,
"a2b5bc67da13dc92cd9d344aa238544a0e1fa79ef76810cd", // key
"", // IV
"329d86bdf1bc5af4", // input
"d946c2756d78633f", // output
},
{
"TECBMMT3 Encrypt 1", KM_PURPOSE_ENCRYPT, KM_MODE_ECB, KM_PAD_NONE,
"49e692290d2a5e46bace79b9648a4c5d491004c262dc9d49", // key
"", // IV
"6b1540781b01ce1997adae102dbf3c5b", // input
"4d0dc182d6e481ac4a3dc6ab6976ccae", // output
},
{
"TECBMMT3 Decrypt 0", KM_PURPOSE_DECRYPT, KM_MODE_ECB, KM_PAD_NONE,
"52daec2ac7dc1958377392682f37860b2cc1ea2304bab0e9", // key
"", // IV
"6daad94ce08acfe7", // input
"660e7d32dcc90e79", // output
},
{
"TECBMMT3 Decrypt 1", KM_PURPOSE_DECRYPT, KM_MODE_ECB, KM_PAD_NONE,
"7f8fe3d3f4a48394fb682c2919926d6ddfce8932529229ce", // key
"", // IV
"e9653a0a1f05d31b9acd12d73aa9879d", // input
"9b2ae9d998efe62f1b592e7e1df8ff38", // output
},
{
"TCBCMMT2 Encrypt 0", KM_PURPOSE_ENCRYPT, KM_MODE_CBC, KM_PAD_NONE,
"34a41a8c293176c1b30732ecfe38ae8a", // key
"f55b4855228bd0b4", // IV
"7dd880d2a9ab411c", // input
"c91892948b6cadb4", // output
},
{
"TCBCMMT2 Encrypt 1", KM_PURPOSE_ENCRYPT, KM_MODE_CBC, KM_PAD_NONE,
"70a88fa1dfb9942fa77f40157ffef2ad", // key
"ece08ce2fdc6ce80", // IV
"bc225304d5a3a5c9918fc5006cbc40cc", // input
"27f67dc87af7ddb4b68f63fa7c2d454a", // output
},
{
"TCBCMMT2 Decrypt 0", KM_PURPOSE_DECRYPT, KM_MODE_CBC, KM_PAD_NONE,
"4ff47fda89209bda8c85f7fe80192007", // key
"d5bc4891dabe48b9", // IV
"7e154b28c353adef", // input
"712b961ea9a1d0af", // output
},
{
"TCBCMMT2 Decrypt 1", KM_PURPOSE_DECRYPT, KM_MODE_CBC, KM_PAD_NONE,
"464092cdbf736d38fb1fe6a12a94ae0e", // key
"5423455f00023b01", // IV
"3f6050b74ed64416bc23d53b0469ed7a", // input
"9cbe7d1b5cdd1864c3095ba810575960", // output
},
{
"TCBCMMT3 Encrypt 0", KM_PURPOSE_ENCRYPT, KM_MODE_CBC, KM_PAD_NONE,
"b5cb1504802326c73df186e3e352a20de643b0d63ee30e37", // key
"43f791134c5647ba", // IV
"dcc153cef81d6f24", // input
"92538bd8af18d3ba", // output
},
{
"TCBCMMT3 Encrypt 1", KM_PURPOSE_ENCRYPT, KM_MODE_CBC, KM_PAD_NONE,
"a49d7564199e97cb529d2c9d97bf2f98d35edf57ba1f7358", // key
"c2e999cb6249023c", // IV
"c689aee38a301bb316da75db36f110b5", // input
"e9afaba5ec75ea1bbe65506655bb4ecb", // output
},
{
"TCBCMMT3 Encrypt 1 PKCS7 variant", KM_PURPOSE_ENCRYPT, KM_MODE_CBC, KM_PAD_PKCS7,
"a49d7564199e97cb529d2c9d97bf2f98d35edf57ba1f7358", // key
"c2e999cb6249023c", // IV
"c689aee38a301bb316da75db36f110b500", // input
"e9afaba5ec75ea1bbe65506655bb4ecb825aa27ec0656156", // output
},
{
"TCBCMMT3 Encrypt 1 PKCS7 decrypted", KM_PURPOSE_DECRYPT, KM_MODE_CBC, KM_PAD_PKCS7,
"a49d7564199e97cb529d2c9d97bf2f98d35edf57ba1f7358", // key
"c2e999cb6249023c", // IV
"e9afaba5ec75ea1bbe65506655bb4ecb825aa27ec0656156", // input
"c689aee38a301bb316da75db36f110b500", // output
},
{
"TCBCMMT3 Decrypt 0", KM_PURPOSE_DECRYPT, KM_MODE_CBC, KM_PAD_NONE,
"5eb6040d46082c7aa7d06dfd08dfeac8c18364c1548c3ba1", // key
"41746c7e442d3681", // IV
"c53a7b0ec40600fe", // input
"d4f00eb455de1034", // output
},
{
"TCBCMMT3 Decrypt 1", KM_PURPOSE_DECRYPT, KM_MODE_CBC, KM_PAD_NONE,
"5b1cce7c0dc1ec49130dfb4af45785ab9179e567f2c7d549", // key
"3982bc02c3727d45", // IV
"6006f10adef52991fcc777a1238bbb65", // input
"edae09288e9e3bc05746d872b48e3b29", // output
},
};
TEST_P(EncryptionOperationsTest, TripleDesTestVector) {
for (auto& test : array_range(kTripleDesTestVectors)) {
SCOPED_TRACE(test.name);
CheckTripleDesTestVector(test.purpose, test.block_mode, test.padding_mode,
hex2str(test.key), hex2str(test.iv), hex2str(test.input),
hex2str(test.output));
}
}
TEST_P(EncryptionOperationsTest, TripleDesCbcRoundTripSuccess) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
// Two-block message.
string message = "1234567890123456";
string iv1;
string ciphertext1 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
string iv2;
string ciphertext2 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv2);
EXPECT_EQ(message.size(), ciphertext2.size());
// IVs should be random, so ciphertexts should differ.
EXPECT_NE(iv1, iv2);
EXPECT_NE(ciphertext1, ciphertext2);
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CBC, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
}
TEST_P(EncryptionOperationsTest, TripleDesCallerIv) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Authorization(TAG_CALLER_NONCE)
.Padding(KM_PAD_NONE)));
string message = "1234567890123456";
string iv1;
// Don't specify IV, should get a random one.
string ciphertext1 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
EXPECT_EQ(8U, iv1.size());
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CBC, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
// Now specify an IV, should also work.
AuthorizationSet input_params(client_params());
AuthorizationSet update_params;
AuthorizationSet output_params;
input_params.push_back(TAG_NONCE, "abcdefgh", 8);
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
string ciphertext2 =
ProcessMessage(KM_PURPOSE_ENCRYPT, message, input_params, update_params, &output_params);
// Decrypt with correct IV.
plaintext = ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext2, input_params, update_params,
&output_params);
EXPECT_EQ(message, plaintext);
// Now try with wrong IV.
input_params.Reinitialize(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
input_params.push_back(TAG_NONCE, "aaaaaaaa", 8);
plaintext = ProcessMessage(KM_PURPOSE_DECRYPT, ciphertext2, input_params, update_params,
&output_params);
EXPECT_NE(message, plaintext);
}
TEST_P(EncryptionOperationsTest, TripleDesCallerNonceProhibited) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
string message = "12345678901234567890123456789012";
string iv1;
// Don't specify nonce, should get a random one.
string ciphertext1 = EncryptMessage(message, KM_MODE_CBC, KM_PAD_NONE, &iv1);
EXPECT_EQ(message.size(), ciphertext1.size());
EXPECT_EQ(8U, iv1.size());
string plaintext = DecryptMessage(ciphertext1, KM_MODE_CBC, KM_PAD_NONE, iv1);
EXPECT_EQ(message, plaintext);
// Now specify a nonce, should fail.
AuthorizationSet input_params(client_params());
AuthorizationSet update_params;
AuthorizationSet output_params;
input_params.push_back(TAG_NONCE, "abcdefgh", 8);
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_CALLER_NONCE_PROHIBITED,
BeginOperation(KM_PURPOSE_ENCRYPT, input_params, &output_params));
}
TEST_P(EncryptionOperationsTest, TripleDesCbcNotAuthorized) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Padding(KM_PAD_NONE)));
// Two-block message.
string message = "1234567890123456";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_BLOCK_MODE, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(EncryptionOperationsTest, TripleDesCbcNoPaddingWrongInputSize) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
// Message is slightly shorter than two blocks.
string message = "123456789012345";
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
AuthorizationSet output_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params, &output_params));
string ciphertext;
EXPECT_EQ(KM_ERROR_INVALID_INPUT_LENGTH, FinishOperation(message, "", &ciphertext));
}
TEST_P(EncryptionOperationsTest, TripleDesCbcPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
// Try various message lengths; all should work.
for (size_t i = 0; i < 32; ++i) {
string message(i, 'a');
string iv;
string ciphertext = EncryptMessage(message, KM_MODE_CBC, KM_PAD_PKCS7, &iv);
EXPECT_EQ(i + 8 - (i % 8), ciphertext.size());
string plaintext = DecryptMessage(ciphertext, KM_MODE_CBC, KM_PAD_PKCS7, iv);
EXPECT_EQ(message, plaintext);
}
}
TEST_P(EncryptionOperationsTest, TripleDesCbcNoPaddingKeyWithPkcs7Padding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Authorization(TAG_PADDING, KM_PAD_NONE)));
// Try various message lengths; all should fail.
for (size_t i = 0; i < 32; ++i) {
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
begin_params.push_back(TAG_PADDING, KM_PAD_PKCS7);
EXPECT_EQ(KM_ERROR_INCOMPATIBLE_PADDING_MODE,
BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
}
TEST_P(EncryptionOperationsTest, TripleDesCbcPkcs7PaddingCorrupted) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Authorization(TAG_PADDING, KM_PAD_PKCS7)));
string message = "a";
string iv;
string ciphertext = EncryptMessage(message, KM_MODE_CBC, KM_PAD_PKCS7, &iv);
EXPECT_EQ(8U, ciphertext.size());
EXPECT_NE(ciphertext, message);
++ciphertext[ciphertext.size() / 2];
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
begin_params.push_back(TAG_PADDING, KM_PAD_PKCS7);
begin_params.push_back(TAG_NONCE, iv.data(), iv.size());
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, begin_params));
string plaintext;
size_t input_consumed;
EXPECT_EQ(KM_ERROR_OK, UpdateOperation(ciphertext, &plaintext, &input_consumed));
EXPECT_EQ(ciphertext.size(), input_consumed);
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, FinishOperation(&plaintext));
}
TEST_P(EncryptionOperationsTest, TripleDesCbcIncrementalNoPadding) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.TripleDesEncryptionKey(112)
.Authorization(TAG_BLOCK_MODE, KM_MODE_CBC)
.Padding(KM_PAD_NONE)));
int increment = 7;
string message(240, 'a');
AuthorizationSet input_params(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
AuthorizationSet output_params;
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, input_params, &output_params));
string ciphertext;
size_t input_consumed;
for (size_t i = 0; i < message.size(); i += increment)
EXPECT_EQ(KM_ERROR_OK,
UpdateOperation(message.substr(i, increment), &ciphertext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&ciphertext));
EXPECT_EQ(message.size(), ciphertext.size());
// Move TAG_NONCE into input_params
input_params.Reinitialize(output_params);
input_params.push_back(client_params());
input_params.push_back(TAG_BLOCK_MODE, KM_MODE_CBC);
input_params.push_back(TAG_PADDING, KM_PAD_NONE);
output_params.Clear();
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_DECRYPT, input_params, &output_params));
string plaintext;
for (size_t i = 0; i < ciphertext.size(); i += increment)
EXPECT_EQ(KM_ERROR_OK,
UpdateOperation(ciphertext.substr(i, increment), &plaintext, &input_consumed));
EXPECT_EQ(KM_ERROR_OK, FinishOperation(&plaintext));
EXPECT_EQ(ciphertext.size(), plaintext.size());
EXPECT_EQ(message, plaintext);
}
typedef Keymaster2Test MaxOperationsTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, MaxOperationsTest, test_params);
TEST_P(MaxOperationsTest, TestLimit) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.EcbMode()
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MAX_USES_PER_BOOT, 3)));
string message = "1234567890123456";
string ciphertext1 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
string ciphertext2 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
string ciphertext3 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
// Fourth time should fail.
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_KEY_MAX_OPS_EXCEEDED, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
TEST_P(MaxOperationsTest, TestAbort) {
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.EcbMode()
.Authorization(TAG_PADDING, KM_PAD_NONE)
.Authorization(TAG_MAX_USES_PER_BOOT, 3)));
string message = "1234567890123456";
string ciphertext1 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
string ciphertext2 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
string ciphertext3 = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
// Fourth time should fail.
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
EXPECT_EQ(KM_ERROR_KEY_MAX_OPS_EXCEEDED, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
}
typedef Keymaster2Test AddEntropyTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, AddEntropyTest, test_params);
TEST_P(AddEntropyTest, AddEntropy) {
// There's no obvious way to test that entropy is actually added, but we can test that the API
// doesn't blow up or return an error.
EXPECT_EQ(KM_ERROR_OK,
device()->add_rng_entropy(device(), reinterpret_cast<const uint8_t*>("foo"), 3));
}
typedef Keymaster2Test AttestationTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, AttestationTest, test_params);
static X509* parse_cert_blob(const keymaster_blob_t& blob) {
const uint8_t* p = blob.data;
return d2i_X509(nullptr, &p, blob.data_length);
}
static bool verify_chain(const keymaster_cert_chain_t& chain) {
for (size_t i = 0; i < chain.entry_count - 1; ++i) {
keymaster_blob_t& key_cert_blob = chain.entries[i];
keymaster_blob_t& signing_cert_blob = chain.entries[i + 1];
X509_Ptr key_cert(parse_cert_blob(key_cert_blob));
X509_Ptr signing_cert(parse_cert_blob(signing_cert_blob));
EXPECT_TRUE(!!key_cert.get() && !!signing_cert.get());
if (!key_cert.get() || !signing_cert.get()) return false;
EVP_PKEY_Ptr signing_pubkey(X509_get_pubkey(signing_cert.get()));
EXPECT_TRUE(!!signing_pubkey.get());
if (!signing_pubkey.get()) return false;
EXPECT_EQ(1, X509_verify(key_cert.get(), signing_pubkey.get()))
<< "Verification of certificate " << i << " failed";
}
return true;
}
// Extract attestation record from cert. Returned object is still part of cert; don't free it
// separately.
static ASN1_OCTET_STRING* get_attestation_record(X509* certificate, const char* oid_string) {
ASN1_OBJECT_Ptr oid(OBJ_txt2obj(oid_string, 1 /* dotted string format */));
EXPECT_TRUE(!!oid.get());
if (!oid.get()) return nullptr;
int location = X509_get_ext_by_OBJ(certificate, oid.get(), -1 /* search from beginning */);
EXPECT_NE(-1, location);
if (location == -1) return nullptr;
X509_EXTENSION* attest_rec_ext = X509_get_ext(certificate, location);
EXPECT_TRUE(!!attest_rec_ext);
if (!attest_rec_ext) return nullptr;
ASN1_OCTET_STRING* attest_rec = X509_EXTENSION_get_data(attest_rec_ext);
EXPECT_TRUE(!!attest_rec);
return attest_rec;
}
static bool verify_attestation_record(const string& challenge, const string& attestation_app_id,
AuthorizationSet expected_sw_enforced,
AuthorizationSet expected_tee_enforced,
uint32_t expected_keymaster_version,
keymaster_security_level_t expected_keymaster_security_level,
const keymaster_blob_t& attestation_cert) {
X509_Ptr cert(parse_cert_blob(attestation_cert));
EXPECT_TRUE(!!cert.get());
if (!cert.get()) return false;
const char* oid =
expected_keymaster_version >= (uint32_t)KmVersion::KEYMINT_1 ? kEatTokenOid : kAsn1TokenOid;
uint32_t expected_attestation_version =
expected_keymaster_version >= (uint32_t)KmVersion::KEYMINT_1 ? 5u : 4u;
ASN1_OCTET_STRING* attest_rec = get_attestation_record(cert.get(), oid);
EXPECT_TRUE(!!attest_rec);
if (!attest_rec) return false;
AuthorizationSet att_sw_enforced;
AuthorizationSet att_tee_enforced;
uint32_t att_attestation_version;
uint32_t att_keymaster_version;
keymaster_security_level_t att_attestation_security_level;
keymaster_security_level_t att_keymaster_security_level;
keymaster_blob_t att_challenge = {};
keymaster_blob_t att_unique_id = {};
keymaster_blob_t att_boot_key = {};
keymaster_verified_boot_t att_boot_state;
bool att_dev_locked;
std::vector<int64_t> unexpected_eat_claims;
if (expected_keymaster_version >= (uint32_t)KmVersion::KEYMINT_1) {
EXPECT_EQ(KM_ERROR_OK,
parse_eat_record(attest_rec->data, attest_rec->length, &att_attestation_version,
&att_attestation_security_level, &att_keymaster_version,
&att_keymaster_security_level, &att_challenge, &att_sw_enforced,
&att_tee_enforced, &att_unique_id, &att_boot_key,
&att_boot_state, &att_dev_locked, &unexpected_eat_claims));
} else {
EXPECT_EQ(KM_ERROR_OK, parse_attestation_record(
attest_rec->data, attest_rec->length, &att_attestation_version,
&att_attestation_security_level, &att_keymaster_version,
&att_keymaster_security_level, &att_challenge, &att_sw_enforced,
&att_tee_enforced, &att_unique_id));
}
EXPECT_EQ(std::vector<int64_t>(), unexpected_eat_claims);
EXPECT_EQ(expected_attestation_version, att_attestation_version);
EXPECT_EQ(KM_SECURITY_LEVEL_SOFTWARE, att_attestation_security_level);
EXPECT_EQ(expected_keymaster_version, att_keymaster_version);
EXPECT_EQ(expected_keymaster_security_level, att_keymaster_security_level);
EXPECT_EQ(challenge.length(), att_challenge.data_length);
EXPECT_EQ(0, memcmp(challenge.data(), att_challenge.data, challenge.length()));
// Add TAG_USER_ID to the relevant attestation list, because user IDs are not included in
// attestations, since they're meaningless off-device.
uint32_t user_id;
if (expected_sw_enforced.GetTagValue(TAG_USER_ID, &user_id))
att_sw_enforced.push_back(TAG_USER_ID, user_id);
if (expected_tee_enforced.GetTagValue(TAG_USER_ID, &user_id))
att_tee_enforced.push_back(TAG_USER_ID, user_id);
// Add TAG_INCLUDE_UNIQUE_ID to the relevant attestation list, because that tag is not included
// in the attestation.
if (expected_sw_enforced.GetTagValue(TAG_INCLUDE_UNIQUE_ID))
att_sw_enforced.push_back(TAG_INCLUDE_UNIQUE_ID);
if (expected_tee_enforced.GetTagValue(TAG_INCLUDE_UNIQUE_ID))
att_tee_enforced.push_back(TAG_INCLUDE_UNIQUE_ID);
// Add TAG_ATTESTATION_APPLICATION_ID to the expected sw-enforced list.
expected_sw_enforced.push_back(TAG_ATTESTATION_APPLICATION_ID, attestation_app_id.data(),
attestation_app_id.size());
att_sw_enforced.Sort();
expected_sw_enforced.Sort();
EXPECT_EQ(expected_sw_enforced, att_sw_enforced);
att_tee_enforced.Sort();
expected_tee_enforced.Sort();
EXPECT_EQ(expected_tee_enforced, att_tee_enforced);
delete[] att_challenge.data;
delete[] att_unique_id.data;
return true;
}
TEST_P(AttestationTest, RsaAttestationKeymaster) {
// We can't test KeyMint attestation here because these tests are architected to use the
// Keymaster2 API (an old-style C-struct HAL, pre-HIDL), which doesn't have a way to return the
// certificates. For now, we'll have to rely on the KeyMint VTS tests to validate KeyMint
// attestation.
//
// TODO: Refactor this test suite to use the HIDL/AIDL interfaces.
if (GetParam()->is_keymint()) return;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.RsaSigningKey(256, 3)
.Digest(KM_DIGEST_NONE)
.Padding(KM_PAD_NONE)
.Authorization(TAG_INCLUDE_UNIQUE_ID)));
keymaster_cert_chain_t cert_chain;
EXPECT_EQ(KM_ERROR_OK, AttestKey("challenge", "attest_app_id", &cert_chain));
ASSERT_EQ(3U, cert_chain.entry_count);
EXPECT_TRUE(verify_chain(cert_chain));
uint32_t expected_keymaster_version;
keymaster_security_level_t expected_keymaster_security_level;
// TODO(swillden): Add a test KM1 that claims to be hardware.
expected_keymaster_version = (uint32_t)GetParam()->km_version();
expected_keymaster_security_level = KM_SECURITY_LEVEL_SOFTWARE;
EXPECT_TRUE(verify_attestation_record(
"challenge", "attest_app_id", sw_enforced(), hw_enforced(), expected_keymaster_version,
expected_keymaster_security_level, cert_chain.entries[0]));
keymaster_free_cert_chain(&cert_chain);
}
TEST_P(AttestationTest, EcAttestation) {
// We can't test KeyMint attestation here because these tests are architected to use the
// Keymaster2 API (an old-style C-struct HAL, pre-HIDL), which doesn't have a way to return the
// certificates. For now, we'll have to rely on the KeyMint VTS tests to validate KeyMint
// attestation.
//
// TODO: Refactor this test suite to use the HIDL/AIDL interfaces.
if (GetParam()->is_keymint()) return;
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(
KM_DIGEST_SHA_2_256)));
uint32_t expected_keymaster_version;
keymaster_security_level_t expected_keymaster_security_level;
// TODO(swillden): Add a test KM1 that claims to be hardware.
expected_keymaster_version = (uint32_t)GetParam()->km_version();
expected_keymaster_security_level = KM_SECURITY_LEVEL_SOFTWARE;
keymaster_cert_chain_t cert_chain;
EXPECT_EQ(KM_ERROR_OK, AttestKey("challenge", "attest_app_id", &cert_chain));
ASSERT_EQ(3U, cert_chain.entry_count);
EXPECT_TRUE(verify_chain(cert_chain));
EXPECT_TRUE(verify_attestation_record(
"challenge", "attest_app_id", sw_enforced(), hw_enforced(), expected_keymaster_version,
expected_keymaster_security_level, cert_chain.entries[0]));
keymaster_free_cert_chain(&cert_chain);
}
typedef Keymaster2Test KeyUpgradeTest;
INSTANTIATE_TEST_CASE_P(AndroidKeymasterTest, KeyUpgradeTest, test_params);
TEST_P(KeyUpgradeTest, AesVersionUpgrade) {
GetParam()->keymaster_context()->SetSystemVersion(1, 1);
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder()
.AesEncryptionKey(128)
.Authorization(TAG_BLOCK_MODE, KM_MODE_ECB)
.Padding(KM_PAD_NONE)));
// Key should operate fine.
string message = "1234567890123456";
string ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message, DecryptMessage(ciphertext, KM_MODE_ECB, KM_PAD_NONE));
// Increase patch level. Key usage should fail with KM_ERROR_KEY_REQUIRES_UPGRADE.
GetParam()->keymaster_context()->SetSystemVersion(1, 2);
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_BLOCK_MODE, KM_MODE_ECB);
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
if (GetParam()->is_keymaster1_hw()) {
// Keymaster1 hardware can't support version binding. The key will work regardless
// of system version. Just abort the remainder of the test.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, AbortOperation());
return;
}
EXPECT_EQ(KM_ERROR_KEY_REQUIRES_UPGRADE, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
// Getting characteristics should also fail
EXPECT_EQ(KM_ERROR_KEY_REQUIRES_UPGRADE, GetCharacteristics());
// Upgrade key.
EXPECT_EQ(KM_ERROR_OK, UpgradeKey(client_params()));
// Key should work again
ciphertext = EncryptMessage(message, KM_MODE_ECB, KM_PAD_NONE);
EXPECT_EQ(message, DecryptMessage(ciphertext, KM_MODE_ECB, KM_PAD_NONE));
// Decrease patch level. Key usage should fail with KM_ERROR_INVALID_KEY_BLOB.
GetParam()->keymaster_context()->SetSystemVersion(1, 1);
EXPECT_EQ(KM_ERROR_INVALID_KEY_BLOB, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_INVALID_KEY_BLOB, GetCharacteristics());
// Upgrade should fail
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, UpgradeKey(client_params()));
}
TEST_P(KeyUpgradeTest, RsaVersionUpgrade) {
GetParam()->keymaster_context()->SetSystemVersion(1, 1);
ASSERT_EQ(KM_ERROR_OK,
GenerateKey(AuthorizationSetBuilder().RsaEncryptionKey(256, 3).Padding(KM_PAD_NONE)));
// Key should operate fine.
string message = "12345678901234567890123456789012";
string ciphertext = EncryptMessage(message, KM_PAD_NONE);
EXPECT_EQ(message, DecryptMessage(ciphertext, KM_PAD_NONE));
// Increase patch level. Key usage should fail with KM_ERROR_KEY_REQUIRES_UPGRADE.
GetParam()->keymaster_context()->SetSystemVersion(1, 2);
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_PADDING, KM_PAD_NONE);
if (GetParam()->is_keymaster1_hw()) {
// Keymaster1 hardware can't support version binding. The key will work regardless
// of system version. Just abort the remainder of the test.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_OK, AbortOperation());
return;
}
EXPECT_EQ(KM_ERROR_KEY_REQUIRES_UPGRADE, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
// Getting characteristics should also fail
EXPECT_EQ(KM_ERROR_KEY_REQUIRES_UPGRADE, GetCharacteristics());
// Upgrade key.
EXPECT_EQ(KM_ERROR_OK, UpgradeKey(client_params()));
// Key should work again
ciphertext = EncryptMessage(message, KM_PAD_NONE);
EXPECT_EQ(message, DecryptMessage(ciphertext, KM_PAD_NONE));
// Decrease patch level. Key usage should fail with KM_ERROR_INVALID_KEY_BLOB.
GetParam()->keymaster_context()->SetSystemVersion(1, 1);
EXPECT_EQ(KM_ERROR_INVALID_KEY_BLOB, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_INVALID_KEY_BLOB, GetCharacteristics());
// Upgrade should fail
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, UpgradeKey(client_params()));
}
TEST_P(KeyUpgradeTest, EcVersionUpgrade) {
GetParam()->keymaster_context()->SetSystemVersion(1, 1);
ASSERT_EQ(KM_ERROR_OK, GenerateKey(AuthorizationSetBuilder().EcdsaSigningKey(256).Digest(
KM_DIGEST_SHA_2_256)));
// Key should operate fine.
string message = "1234567890123456";
string signature;
SignMessage(message, &signature, KM_DIGEST_SHA_2_256);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_256);
// Increase patch level. Key usage should fail with KM_ERROR_KEY_REQUIRES_UPGRADE.
GetParam()->keymaster_context()->SetSystemVersion(1, 2);
AuthorizationSet begin_params(client_params());
begin_params.push_back(TAG_DIGEST, KM_DIGEST_SHA_2_256);
if (GetParam()->is_keymaster1_hw()) {
// Keymaster1 hardware can't support version binding. The key will work regardless
// of system version. Just abort the remainder of the test.
EXPECT_EQ(KM_ERROR_OK, BeginOperation(KM_PURPOSE_SIGN, begin_params));
EXPECT_EQ(KM_ERROR_OK, AbortOperation());
return;
}
EXPECT_EQ(KM_ERROR_KEY_REQUIRES_UPGRADE, BeginOperation(KM_PURPOSE_SIGN, begin_params));
// Getting characteristics should also fail
EXPECT_EQ(KM_ERROR_KEY_REQUIRES_UPGRADE, GetCharacteristics());
// Upgrade key.
EXPECT_EQ(KM_ERROR_OK, UpgradeKey(client_params()));
// Key should work again
SignMessage(message, &signature, KM_DIGEST_SHA_2_256);
VerifyMessage(message, signature, KM_DIGEST_SHA_2_256);
// Decrease patch level. Key usage should fail with KM_ERROR_INVALID_KEY_BLOB.
GetParam()->keymaster_context()->SetSystemVersion(1, 1);
EXPECT_EQ(KM_ERROR_INVALID_KEY_BLOB, BeginOperation(KM_PURPOSE_ENCRYPT, begin_params));
EXPECT_EQ(KM_ERROR_INVALID_KEY_BLOB, GetCharacteristics());
// Upgrade should fail
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, UpgradeKey(client_params()));
}
TEST(SoftKeymasterWrapperTest, CheckKeymaster2Device) {
// Make a good fake device, and wrap it.
SoftKeymasterDevice* good_fake(
new SoftKeymasterDevice(new TestKeymasterContext(KmVersion::KEYMASTER_4_1)));
// Wrap it and check it.
SoftKeymasterDevice* good_fake_wrapper(
new SoftKeymasterDevice(new TestKeymasterContext(KmVersion::KEYMASTER_4_1)));
good_fake_wrapper->SetHardwareDevice(good_fake->keymaster_device());
EXPECT_TRUE(good_fake_wrapper->Keymaster1DeviceIsGood());
// Close and clean up wrapper and wrapped
good_fake_wrapper->keymaster_device()->common.close(good_fake_wrapper->hw_device());
// Make a "bad" (doesn't support all digests) device;
keymaster1_device_t* sha256_only_fake = make_device_sha256_only(
(new SoftKeymasterDevice(new TestKeymasterContext(KmVersion::KEYMASTER_4_1, "256")))
->keymaster_device());
// Wrap it and check it.
SoftKeymasterDevice* sha256_only_fake_wrapper(
(new SoftKeymasterDevice(new TestKeymasterContext(KmVersion::KEYMASTER_4_1))));
sha256_only_fake_wrapper->SetHardwareDevice(sha256_only_fake);
EXPECT_FALSE(sha256_only_fake_wrapper->Keymaster1DeviceIsGood());
// Close and clean up wrapper and wrapped
sha256_only_fake_wrapper->keymaster_device()->common.close(
sha256_only_fake_wrapper->hw_device());
}
class HmacKeySharingTest : public ::testing::Test {
protected:
using KeymasterVec = std::vector<std::unique_ptr<AndroidKeymaster>>;
using ParamsVec = std::vector<HmacSharingParameters>;
using ByteString = std::basic_string<uint8_t>;
using NonceVec = std::vector<ByteString>;
using ResponseVec = std::vector<ComputeSharedHmacResponse>;
KeymasterVec CreateKeymasters(size_t count) {
KeymasterVec keymasters;
for (size_t i = 0; i < count; ++i) {
keymasters.push_back(make_unique<AndroidKeymaster>(new TestKeymasterContext, 16));
}
return keymasters;
}
ParamsVec GetHmacSharingParameters(const KeymasterVec& keymasters) {
ParamsVec paramsVec;
for (auto& keymaster : keymasters) {
auto result = keymaster->GetHmacSharingParameters();
EXPECT_EQ(KM_ERROR_OK, result.error);
if (result.error == KM_ERROR_OK) paramsVec.push_back(move(result.params));
}
return paramsVec;
}
template <size_t N> ByteString ToByteString(const uint8_t (&a)[N]) { return ByteString(a, N); }
ByteString ToByteString(const keymaster_blob_t& b) { return ByteString(b.data, b.data_length); }
NonceVec CopyNonces(const ParamsVec& paramsVec) {
NonceVec nonces;
for (auto& param : paramsVec) {
nonces.push_back(ToByteString(param.nonce));
}
return nonces;
}
ResponseVec ComputeSharedHmac(const KeymasterVec& keymasters, const ParamsVec& paramsVec) {
ComputeSharedHmacRequest req(kMaxMessageVersion);
req.params_array.params_array = const_cast<HmacSharingParameters*>(paramsVec.data());
auto prevent_deletion_of_paramsVec_data =
finally([&]() { req.params_array.params_array = nullptr; });
req.params_array.num_params = paramsVec.size();
ResponseVec responses;
for (auto& keymaster : keymasters) {
responses.push_back(keymaster->ComputeSharedHmac(req));
}
return responses;
}
bool VerifyResponses(const ByteString& expected, const ResponseVec& responses) {
for (auto& response : responses) {
EXPECT_EQ(KM_ERROR_OK, response.error);
auto this_sharing_check = ToByteString(response.sharing_check);
EXPECT_EQ(expected, this_sharing_check) << "Sharing check values should match.";
if (response.error != KM_ERROR_OK || expected != this_sharing_check) {
return false;
}
}
return true;
}
};
TEST_F(HmacKeySharingTest, GetParametersIdempotency) {
AndroidKeymaster keymaster(new TestKeymasterContext, 16);
ParamsVec paramsVec;
auto result1 = keymaster.GetHmacSharingParameters();
EXPECT_EQ(KM_ERROR_OK, result1.error);
paramsVec.push_back(std::move(result1.params));
auto result2 = keymaster.GetHmacSharingParameters();
EXPECT_EQ(KM_ERROR_OK, result2.error);
paramsVec.push_back(std::move(result2.params));
ASSERT_EQ(ToByteString(paramsVec[0].seed), ToByteString(paramsVec[1].seed))
<< "A given keymaster should always return the same seed.";
EXPECT_EQ(ToByteString(paramsVec[0].nonce), ToByteString(paramsVec[1].nonce))
<< "A given keymaster should always return the same nonce until restart.";
}
TEST_F(HmacKeySharingTest, ComputeSharedHmac) {
// ComputeSharedHmac should work with any number of participants; we just test 1 through 4.
for (size_t keymaster_count = 1; keymaster_count <= 4; ++keymaster_count) {
SCOPED_TRACE(testing::Message() << keymaster_count << " keymaster instances");
auto keymasters = CreateKeymasters(keymaster_count);
auto params = GetHmacSharingParameters(keymasters);
ASSERT_EQ(keymaster_count, params.size())
<< "One or more keymasters failed to provide parameters.";
auto nonces = CopyNonces(params);
EXPECT_EQ(keymaster_count, nonces.size()) << "We should have a nonce per keymaster.";
std::sort(nonces.begin(), nonces.end());
std::unique(nonces.begin(), nonces.end());
EXPECT_EQ(keymaster_count, nonces.size()) << "Nonces should all be unique.";
auto responses = ComputeSharedHmac(keymasters, params);
ASSERT_EQ(keymaster_count, responses.size());
ASSERT_TRUE(VerifyResponses(ToByteString(responses[0].sharing_check), responses));
}
}
TEST_F(HmacKeySharingTest, ComputeSharedHmacTwice) {
for (size_t keymaster_count = 1; keymaster_count <= 4; ++keymaster_count) {
SCOPED_TRACE(testing::Message() << keymaster_count << " keymaster instances");
auto keymasters = CreateKeymasters(keymaster_count);
auto params = GetHmacSharingParameters(keymasters);
ASSERT_EQ(keymaster_count, params.size())
<< "One or more keymasters failed to provide parameters.";
auto responses = ComputeSharedHmac(keymasters, params);
ASSERT_EQ(keymaster_count, responses.size());
ByteString sharing_check_value = ToByteString(responses[0].sharing_check);
ASSERT_TRUE(VerifyResponses(sharing_check_value, responses));
params = GetHmacSharingParameters(keymasters);
ASSERT_EQ(keymaster_count, params.size())
<< "One or more keymasters failed to provide parameters.";
responses = ComputeSharedHmac(keymasters, params);
// Verify against first check value; we should get the same one every time, because each
// keymaster instance returns the same seed every time, and the same nonce until restart.
ASSERT_TRUE(VerifyResponses(sharing_check_value, responses));
}
}
TEST_F(HmacKeySharingTest, ComputeSharedHmacCorruptNonce) {
constexpr size_t keymaster_count = 4;
auto keymasters = CreateKeymasters(keymaster_count);
auto params = GetHmacSharingParameters(keymasters);
ASSERT_EQ(keymaster_count, params.size())
<< "One or more keymasters failed to provide parameters.";
// All should be well in the normal case
auto responses = ComputeSharedHmac(keymasters, params);
ASSERT_EQ(keymaster_count, responses.size());
ByteString sharing_check_value = ToByteString(responses[0].sharing_check);
ASSERT_TRUE(VerifyResponses(sharing_check_value, responses));
// Pick a random param, a random byte within the param's nonce, and a random bit within
// the byte. Flip that bit.
size_t param_to_tweak = rand() % params.size();
uint8_t byte_to_tweak = rand() % sizeof(params[param_to_tweak].nonce);
uint8_t bit_to_tweak = rand() % 8;
params[param_to_tweak].nonce[byte_to_tweak] ^= (1 << bit_to_tweak);
responses = ComputeSharedHmac(keymasters, params);
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, responses[param_to_tweak].error)
<< "Keymaster that provided tweaked response should fail to compute HMAC key";
for (size_t i = 0; i < responses.size(); ++i) {
if (i != param_to_tweak) {
EXPECT_EQ(KM_ERROR_OK, responses[i].error) << "Others should succeed";
EXPECT_NE(sharing_check_value, ToByteString(responses[i].sharing_check))
<< "Others should calculate a different HMAC key, due to the tweaked nonce.";
}
}
}
TEST_F(HmacKeySharingTest, ComputeSharedHmacCorruptSeed) {
constexpr size_t keymaster_count = 4;
auto keymasters = CreateKeymasters(keymaster_count);
auto params = GetHmacSharingParameters(keymasters);
ASSERT_EQ(keymaster_count, params.size())
<< "One or more keymasters failed to provide parameters.";
// All should be well in the normal case
auto responses = ComputeSharedHmac(keymasters, params);
ASSERT_EQ(keymaster_count, responses.size());
ByteString sharing_check_value = ToByteString(responses[0].sharing_check);
ASSERT_TRUE(VerifyResponses(sharing_check_value, responses));
// Pick a random param and modify the seed.
auto param_to_tweak = rand() % params.size();
constexpr uint8_t wrong_seed_value[] = {0xF, 0x0, 0x0};
params[param_to_tweak].SetSeed({wrong_seed_value, sizeof(wrong_seed_value)});
auto prevent_deletion_of_wrong_seed =
finally([&]() { params[param_to_tweak].seed.data = nullptr; });
responses = ComputeSharedHmac(keymasters, params);
EXPECT_EQ(KM_ERROR_INVALID_ARGUMENT, responses[param_to_tweak].error)
<< "Keymaster that provided tweaked response should fail to compute HMAC key";
for (size_t i = 0; i < responses.size(); ++i) {
if (i != param_to_tweak) {
EXPECT_EQ(KM_ERROR_OK, responses[i].error) << "Others should succeed";
EXPECT_NE(sharing_check_value, ToByteString(responses[i].sharing_check))
<< "Others should calculate a different HMAC key, due to the tweaked seed.";
}
}
}
} // namespace test
} // namespace keymaster
Reference in New Issue View Git Blame Copy Permalink