1 /*
2  * Copyright 2021, The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *     http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef ANDROID_HARDWARE_IDENTITY_FAKESECUREHARDWAREPROXY_H
18 #define ANDROID_HARDWARE_IDENTITY_FAKESECUREHARDWAREPROXY_H
19 
20 #include <libeic.h>
21 
22 #include "SecureHardwareProxy.h"
23 
24 namespace android::hardware::identity {
25 
26 // This implementation uses libEmbeddedIC in-process.
27 //
28 class RemoteSecureHardwareProvisioningProxy
29     : public SecureHardwareProvisioningProxy {
30  public:
31   RemoteSecureHardwareProvisioningProxy();
32   virtual ~RemoteSecureHardwareProvisioningProxy();
33 
34   bool initialize(bool testCredential) override;
35 
36   bool initializeForUpdate(bool testCredential, string docType,
37                            vector<uint8_t> encryptedCredentialKeys) override;
38 
39   bool shutdown() override;
40 
41   // Returns public key certificate.
42   optional<vector<uint8_t>> createCredentialKey(
43       const vector<uint8_t>& challenge,
44       const vector<uint8_t>& applicationId) override;
45 
46   bool startPersonalization(int accessControlProfileCount,
47                             vector<int> entryCounts, const string& docType,
48                             size_t expectedProofOfProvisioningSize) override;
49 
50   // Returns MAC (28 bytes).
51   optional<vector<uint8_t>> addAccessControlProfile(
52       int id, const vector<uint8_t>& readerCertificate,
53       bool userAuthenticationRequired, uint64_t timeoutMillis,
54       uint64_t secureUserId) override;
55 
56   bool beginAddEntry(const vector<int>& accessControlProfileIds,
57                      const string& nameSpace, const string& name,
58                      uint64_t entrySize) override;
59 
60   // Returns encryptedContent.
61   optional<vector<uint8_t>> addEntryValue(
62       const vector<int>& accessControlProfileIds, const string& nameSpace,
63       const string& name, const vector<uint8_t>& content) override;
64 
65   // Returns signatureOfToBeSigned (EIC_ECDSA_P256_SIGNATURE_SIZE bytes).
66   optional<vector<uint8_t>> finishAddingEntries() override;
67 
68   // Returns encryptedCredentialKeys (80 bytes).
69   optional<vector<uint8_t>> finishGetCredentialData(
70       const string& docType) override;
71 
72  protected:
73   EicProvisioning ctx_;
74 };
75 
76 // This implementation uses libEmbeddedIC in-process.
77 //
78 class RemoteSecureHardwarePresentationProxy
79     : public SecureHardwarePresentationProxy {
80  public:
81   RemoteSecureHardwarePresentationProxy();
82   virtual ~RemoteSecureHardwarePresentationProxy();
83 
84   bool initialize(bool testCredential, string docType,
85                   vector<uint8_t> encryptedCredentialKeys) override;
86 
87   // Returns publicKeyCert (1st component) and signingKeyBlob (2nd component)
88   optional<pair<vector<uint8_t>, vector<uint8_t>>> generateSigningKeyPair(
89       string docType, time_t now) override;
90 
91   // Returns private key
92   optional<vector<uint8_t>> createEphemeralKeyPair() override;
93 
94   optional<uint64_t> createAuthChallenge() override;
95 
96   bool startRetrieveEntries() override;
97 
98   bool setAuthToken(uint64_t challenge, uint64_t secureUserId,
99                     uint64_t authenticatorId, int hardwareAuthenticatorType,
100                     uint64_t timeStamp, const vector<uint8_t>& mac,
101                     uint64_t verificationTokenChallenge,
102                     uint64_t verificationTokenTimestamp,
103                     int verificationTokenSecurityLevel,
104                     const vector<uint8_t>& verificationTokenMac) override;
105 
106   bool pushReaderCert(const vector<uint8_t>& certX509) override;
107 
108   optional<bool> validateAccessControlProfile(
109       int id, const vector<uint8_t>& readerCertificate,
110       bool userAuthenticationRequired, int timeoutMillis, uint64_t secureUserId,
111       const vector<uint8_t>& mac) override;
112 
113   bool validateRequestMessage(
114       const vector<uint8_t>& sessionTranscript,
115       const vector<uint8_t>& requestMessage, int coseSignAlg,
116       const vector<uint8_t>& readerSignatureOfToBeSigned) override;
117 
118   bool calcMacKey(const vector<uint8_t>& sessionTranscript,
119                   const vector<uint8_t>& readerEphemeralPublicKey,
120                   const vector<uint8_t>& signingKeyBlob, const string& docType,
121                   unsigned int numNamespacesWithValues,
122                   size_t expectedProofOfProvisioningSize) override;
123 
124   AccessCheckResult startRetrieveEntryValue(
125       const string& nameSpace, const string& name,
126       unsigned int newNamespaceNumEntries, int32_t entrySize,
127       const vector<int32_t>& accessControlProfileIds) override;
128 
129   optional<vector<uint8_t>> retrieveEntryValue(
130       const vector<uint8_t>& encryptedContent, const string& nameSpace,
131       const string& name,
132       const vector<int32_t>& accessControlProfileIds) override;
133 
134   optional<vector<uint8_t>> finishRetrieval() override;
135 
136   optional<vector<uint8_t>> deleteCredential(
137       const string& docType, const vector<uint8_t>& challenge,
138       bool includeChallenge, size_t proofOfDeletionCborSize) override;
139 
140   optional<vector<uint8_t>> proveOwnership(
141       const string& docType, bool testCredential,
142       const vector<uint8_t>& challenge,
143       size_t proofOfOwnershipCborSize) override;
144 
145   bool shutdown() override;
146 
147  protected:
148   EicPresentation ctx_;
149 };
150 
151 // Factory implementation.
152 //
153 class RemoteSecureHardwareProxyFactory : public SecureHardwareProxyFactory {
154  public:
RemoteSecureHardwareProxyFactory()155   RemoteSecureHardwareProxyFactory() {}
~RemoteSecureHardwareProxyFactory()156   virtual ~RemoteSecureHardwareProxyFactory() {}
157 
createProvisioningProxy()158   sp<SecureHardwareProvisioningProxy> createProvisioningProxy() override {
159     return new RemoteSecureHardwareProvisioningProxy();
160   }
161 
createPresentationProxy()162   sp<SecureHardwarePresentationProxy> createPresentationProxy() override {
163     return new RemoteSecureHardwarePresentationProxy();
164   }
165 };
166 
167 }  // namespace android::hardware::identity
168 
169 #endif  // ANDROID_HARDWARE_IDENTITY_FAKESECUREHARDWAREPROXY_H
170