1 /*
2 * Copyright (C) 2020 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #define LOG_TAG "ProveOwnershipTests"
18
19 #include <aidl/Gtest.h>
20 #include <aidl/Vintf.h>
21 #include <aidl/android/hardware/keymaster/HardwareAuthToken.h>
22 #include <aidl/android/hardware/keymaster/VerificationToken.h>
23 #include <android-base/logging.h>
24 #include <android/hardware/identity/IIdentityCredentialStore.h>
25 #include <android/hardware/identity/support/IdentityCredentialSupport.h>
26 #include <binder/IServiceManager.h>
27 #include <binder/ProcessState.h>
28 #include <cppbor.h>
29 #include <cppbor_parse.h>
30 #include <gtest/gtest.h>
31 #include <future>
32 #include <map>
33 #include <utility>
34
35 #include "Util.h"
36
37 namespace android::hardware::identity {
38
39 using std::endl;
40 using std::make_pair;
41 using std::map;
42 using std::optional;
43 using std::pair;
44 using std::string;
45 using std::tie;
46 using std::vector;
47
48 using ::android::sp;
49 using ::android::String16;
50 using ::android::binder::Status;
51
52 using ::android::hardware::keymaster::HardwareAuthToken;
53 using ::android::hardware::keymaster::VerificationToken;
54
55 class ProveOwnershipTests : public testing::TestWithParam<string> {
56 public:
SetUp()57 virtual void SetUp() override {
58 credentialStore_ = android::waitForDeclaredService<IIdentityCredentialStore>(
59 String16(GetParam().c_str()));
60 ASSERT_NE(credentialStore_, nullptr);
61 halApiVersion_ = credentialStore_->getInterfaceVersion();
62 }
63
64 void provisionData();
65
66 // Set by provisionData
67 vector<uint8_t> credentialData_;
68 vector<uint8_t> credentialPubKey_;
69
70 sp<IIdentityCredentialStore> credentialStore_;
71 int halApiVersion_;
72 };
73
provisionData()74 void ProveOwnershipTests::provisionData() {
75 string docType = "org.iso.18013-5.2019.mdl";
76 bool testCredential = true;
77 sp<IWritableIdentityCredential> wc;
78 ASSERT_TRUE(credentialStore_->createCredential(docType, testCredential, &wc).isOk());
79
80 vector<uint8_t> attestationApplicationId = {};
81 vector<uint8_t> attestationChallenge = {1};
82 vector<Certificate> certChain;
83 ASSERT_TRUE(wc->getAttestationCertificate(attestationApplicationId, attestationChallenge,
84 &certChain)
85 .isOk());
86
87 optional<vector<uint8_t>> optCredentialPubKey =
88 support::certificateChainGetTopMostKey(certChain[0].encodedCertificate);
89 ASSERT_TRUE(optCredentialPubKey);
90 credentialPubKey_ = optCredentialPubKey.value();
91
92 size_t proofOfProvisioningSize = 106;
93 // Not in v1 HAL, may fail
94 wc->setExpectedProofOfProvisioningSize(proofOfProvisioningSize);
95
96 ASSERT_TRUE(wc->startPersonalization(1 /* numAccessControlProfiles */,
97 {1} /* numDataElementsPerNamespace */)
98 .isOk());
99
100 // Access control profile 0: open access - don't care about the returned SACP
101 SecureAccessControlProfile sacp;
102 ASSERT_TRUE(wc->addAccessControlProfile(1, {}, false, 0, 0, &sacp).isOk());
103
104 // Single entry - don't care about the returned encrypted data
105 ASSERT_TRUE(wc->beginAddEntry({1}, "ns", "Some Data", 1).isOk());
106 vector<uint8_t> encryptedData;
107 ASSERT_TRUE(wc->addEntryValue({9}, &encryptedData).isOk());
108
109 vector<uint8_t> proofOfProvisioningSignature;
110 Status status = wc->finishAddingEntries(&credentialData_, &proofOfProvisioningSignature);
111 EXPECT_TRUE(status.isOk()) << status.exceptionCode() << ": " << status.exceptionMessage();
112 }
113
TEST_P(ProveOwnershipTests,proveOwnership)114 TEST_P(ProveOwnershipTests, proveOwnership) {
115 if (halApiVersion_ < 3) {
116 GTEST_SKIP() << "Need HAL API version 3, have " << halApiVersion_;
117 }
118
119 provisionData();
120
121 sp<IIdentityCredential> credential;
122 ASSERT_TRUE(credentialStore_
123 ->getCredential(
124 CipherSuite::CIPHERSUITE_ECDHE_HKDF_ECDSA_WITH_AES_256_GCM_SHA256,
125 credentialData_, &credential)
126 .isOk());
127
128 // Implementations must support at least 32 bytes.
129 string challengeString = "0123456789abcdef0123456789abcdef";
130 vector<uint8_t> challenge(challengeString.begin(), challengeString.end());
131 vector<uint8_t> proofOfOwnershipSignature;
132 ASSERT_TRUE(credential->proveOwnership(challenge, &proofOfOwnershipSignature).isOk());
133 optional<vector<uint8_t>> proofOfOwnership =
134 support::coseSignGetPayload(proofOfOwnershipSignature);
135 ASSERT_TRUE(proofOfOwnership);
136 string cborPretty = cppbor::prettyPrint(proofOfOwnership.value(), 32, {});
137 EXPECT_EQ(
138 "['ProofOfOwnership', 'org.iso.18013-5.2019.mdl', {"
139 "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
140 "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, "
141 "0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, "
142 "0x38, 0x39, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66}, true, ]",
143 cborPretty);
144 EXPECT_TRUE(support::coseCheckEcDsaSignature(proofOfOwnershipSignature, {}, // Additional data
145 credentialPubKey_));
146 }
147
148 GTEST_ALLOW_UNINSTANTIATED_PARAMETERIZED_TEST(ProveOwnershipTests);
149 INSTANTIATE_TEST_SUITE_P(
150 Identity, ProveOwnershipTests,
151 testing::ValuesIn(android::getAidlHalInstanceNames(IIdentityCredentialStore::descriptor)),
152 android::PrintInstanceNameToString);
153
154 } // namespace android::hardware::identity
155