Skip to content

Commit ba353ed

Browse files
subrahmanyamansubrahmanyaman
authored
Merge pull request #102 from divegeek/Javacard_KeyMint_200_master
Javacard key mint 200 master
2 parents ce4cc82 + 35cf5d9 commit ba353ed

File tree

4 files changed

+47
-44
lines changed

4 files changed

+47
-44
lines changed

‎Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEApplet.java

+13-13
Original file line numberDiff line numberDiff line change
@@ -43,22 +43,22 @@ public class KMAndroidSEApplet extends KMKeymasterApplet implements OnUpgradeLis
4343

4444
// Provider specific Commands
4545
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
46-
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1;
46+
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
4747
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
48-
INS_KEYMINT_PROVIDER_APDU_START + 2;
49-
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
50-
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4;
48+
INS_KEYMINT_PROVIDER_APDU_START + 4;
5149
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; // Unused
50+
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6;
51+
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7;
52+
//0x08 was reserved for INS_INIT_STRONGBOX_CMD
53+
//0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now.
54+
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
55+
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
56+
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12;
5257
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
53-
INS_KEYMINT_PROVIDER_APDU_START + 6;
58+
INS_KEYMINT_PROVIDER_APDU_START + 13;
5459
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
55-
INS_KEYMINT_PROVIDER_APDU_START + 7;
56-
private static final byte INS_SET_BOOT_ENDED_CMD =
57-
INS_KEYMINT_PROVIDER_APDU_START + 8; //unused
58-
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9;
59-
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
60-
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
61-
60+
INS_KEYMINT_PROVIDER_APDU_START + 14;
61+
6262
private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F;
6363
public static final byte BOOT_KEY_MAX_SIZE = 32;
6464
public static final byte BOOT_HASH_MAX_SIZE = 32;
@@ -505,7 +505,7 @@ private void processGetProvisionStatusCmd(APDU apdu) {
505505
private boolean isProvisioningComplete() {
506506
short pStatus = kmDataStore.getProvisionStatus();
507507
short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN |
508-
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS;
508+
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY;
509509
if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) {
510510
return true;
511511
}

‎Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimApplet.java

+19-19
Original file line numberDiff line numberDiff line change
@@ -30,24 +30,24 @@ public class KMJCardSimApplet extends KMKeymasterApplet {
3030
private static final byte ILLEGAL_STATE = KM_BEGIN_STATE + 1;
3131
private static final short POWER_RESET_MASK_FLAG = (short) 0x4000;
3232

33-
// Provider specific Commands
34-
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
35-
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 1;
36-
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
37-
INS_KEYMINT_PROVIDER_APDU_START + 2;
38-
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
39-
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 4;
40-
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5;
41-
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
42-
INS_KEYMINT_PROVIDER_APDU_START + 6;
43-
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
44-
INS_KEYMINT_PROVIDER_APDU_START + 7;
45-
private static final byte INS_SET_BOOT_ENDED_CMD =
46-
INS_KEYMINT_PROVIDER_APDU_START + 8; //unused
47-
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 9;
48-
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
49-
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
50-
33+
//Provider specific Commands
34+
private static final byte INS_KEYMINT_PROVIDER_APDU_START = 0x00;
35+
private static final byte INS_PROVISION_ATTEST_IDS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 3;
36+
private static final byte INS_PROVISION_PRESHARED_SECRET_CMD =
37+
INS_KEYMINT_PROVIDER_APDU_START + 4;
38+
private static final byte INS_SET_BOOT_PARAMS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 5; // Unused
39+
private static final byte INS_OEM_LOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 6;
40+
private static final byte INS_GET_PROVISION_STATUS_CMD = INS_KEYMINT_PROVIDER_APDU_START + 7;
41+
//0x08 was reserved for INS_INIT_STRONGBOX_CMD
42+
//0x09 was reserved for INS_SET_BOOT_ENDED_CMD earlier. it is unused now.
43+
private static final byte INS_SE_FACTORY_PROVISIONING_LOCK_CMD = INS_KEYMINT_PROVIDER_APDU_START + 10;
44+
private static final byte INS_PROVISION_OEM_ROOT_PUBLIC_KEY_CMD = INS_KEYMINT_PROVIDER_APDU_START + 11;
45+
private static final byte INS_OEM_UNLOCK_PROVISIONING_CMD = INS_KEYMINT_PROVIDER_APDU_START + 12;
46+
private static final byte INS_PROVISION_RKP_DEVICE_UNIQUE_KEYPAIR_CMD =
47+
INS_KEYMINT_PROVIDER_APDU_START + 13;
48+
private static final byte INS_PROVISION_RKP_ADDITIONAL_CERT_CHAIN_CMD =
49+
INS_KEYMINT_PROVIDER_APDU_START + 14;
50+
5151
private static final byte INS_KEYMINT_PROVIDER_APDU_END = 0x1F;
5252
public static final byte BOOT_KEY_MAX_SIZE = 32;
5353
public static final byte BOOT_HASH_MAX_SIZE = 32;
@@ -561,7 +561,7 @@ private void processSetBootParamsCmd(APDU apdu) {
561561
private boolean isProvisioningComplete() {
562562
short pStatus = kmDataStore.getProvisionStatus();
563563
short pCompleteStatus = PROVISION_STATUS_DEVICE_UNIQUE_KEYPAIR | PROVISION_STATUS_ADDITIONAL_CERT_CHAIN |
564-
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS;
564+
PROVISION_STATUS_PRESHARED_SECRET | PROVISION_STATUS_ATTEST_IDS | PROVISION_STATUS_OEM_PUBLIC_KEY;
565565
if (kmDataStore.isProvisionLocked() || (pCompleteStatus == (pStatus & pCompleteStatus))) {
566566
return true;
567567
}

‎Applet/src/com/android/javacard/keymaster/KMAsn1Parser.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -168,20 +168,21 @@ public short decodeRsaPrivateKey(short version){
168168
len = header(ASN1_INTEGER);
169169
short modulus = KMByteBlob.instance(len);
170170
getBytes(modulus);
171-
updateModulus(modulus);
171+
updateRsaKeyBuffer(modulus);
172172
len = header(ASN1_INTEGER);
173173
short pubKey = KMByteBlob.instance(len);
174174
getBytes(pubKey);
175175
len = header(ASN1_INTEGER);
176176
short privKey = KMByteBlob.instance(len);
177177
getBytes(privKey);
178+
updateRsaKeyBuffer(privKey);
178179
KMArray.cast(resp).add((short)0, modulus);
179180
KMArray.cast(resp).add((short)1, pubKey);
180181
KMArray.cast(resp).add((short)2, privKey);
181182
return resp;
182183
}
183184

184-
private void updateModulus(short blob) {
185+
private void updateRsaKeyBuffer(short blob) {
185186
byte[] buffer = KMByteBlob.cast(blob).getBuffer();
186187
short startOff = KMByteBlob.cast(blob).getStartOff();
187188
short len = KMByteBlob.cast(blob).length();

‎ProvisioningTool/include/constants.h

+12-10
Original file line numberDiff line numberDiff line change
@@ -101,14 +101,16 @@ constexpr char kSeFactoryProvisionLock[] = "se_factory_lock";
101101
constexpr char kUnLockProvision[] = "unlock_provision";
102102

103103
// Instruction constatnts
104-
// TODO Modify according to keymint
105-
constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 1;
106-
constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 2;
107-
constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 3;
108-
constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 4;
104+
constexpr int kAttestationIdsCmd = INS_BEGIN_KM_CMD + 3;
105+
constexpr int kPresharedSecretCmd = INS_BEGIN_KM_CMD + 4;
109106
constexpr int kBootParamsCmd = INS_BEGIN_KM_CMD + 5;
110-
constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 6;
111-
constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 7;
112-
constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 9;
113-
constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 10;
114-
constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 11;
107+
constexpr int kOemLockProvisionCmd = INS_BEGIN_KM_CMD + 6;
108+
constexpr int kGetProvisionStatusCmd = INS_BEGIN_KM_CMD + 7;
109+
constexpr int kSeFactoryLockCmd = INS_BEGIN_KM_CMD + 10;
110+
constexpr int kOemRootPublicKeyCmd = INS_BEGIN_KM_CMD + 11;
111+
constexpr int kOemUnLockProvisionCmd = INS_BEGIN_KM_CMD + 12;
112+
constexpr int kDeviceUniqueKeyCmd = INS_BEGIN_KM_CMD + 13;
113+
constexpr int kAdditionalCertChainCmd = INS_BEGIN_KM_CMD + 14;
114+
115+
116+

0 commit comments

Comments
 (0)