1/*
2 * Copyright (C) 2017 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 *      http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17syntax = "proto3";
18
19package nugget.app.keymaster;
20
21/*
22 * Minimal type definitions required for building protos.  Sourced from:
23 *     ::android::hardware::keymaster::V3_0
24 */
25enum TagType {
26  TAG_TYPE_INVALID = 0x0;  /* 0 << 16 */
27  ENUM = 0x10000;          /* 1 << 16 */
28  ENUM_REP = 0x20000;      /* 2 << 16 */
29  UINT = 0x30000;          /* 3 << 16 */
30  UINT_REP = 0x40000;      /* 4 << 16 */
31  ULONG = 0x50000;         /* 5 << 16 */
32  DATE = 0x60000;          /* 6 << 16 */
33  BOOL = 0x70000;          /* 7 << 16 */
34  BIGNUM_ = 0x80000;       /* 8 << 16 */
35  BYTES = 0x90000;         /* 9 << 16 */
36  ULONG_REP = 0xA0000;     /* 10 << 16 */
37};
38
39enum Tag {
40  TAG_INVALID = 0; // (TagType:INVALID | 0)
41  PURPOSE = 0x20001; // (TagType:ENUM_REP | 1)
42  ALGORITHM = 0x10002; // (TagType:ENUM | 2)
43  KEY_SIZE = 0x30003; // (TagType:UINT | 3)
44  BLOCK_MODE = 0x20004; // (TagType:ENUM_REP | 4)
45  DIGEST = 0x20005; // (TagType:ENUM_REP | 5)
46  PADDING = 0x20006; // (TagType:ENUM_REP | 6)
47  CALLER_NONCE = 0x70007; // (TagType:BOOL | 7)
48  MIN_MAC_LENGTH = 0x30008; // (TagType:UINT | 8)
49  /* RESERVED: KDF = 0x20009; // (TagType:ENUM_REP | 9) */
50  EC_CURVE = 0x1000a; // (TagType:ENUM | 10)
51  RSA_PUBLIC_EXPONENT = 0x500c8; // (TagType:ULONG | 200)
52  /* RESERVED: ECIES_SINGLE_HASH_MODE = 0x700c9; // (TagType:BOOL | 201) */
53  INCLUDE_UNIQUE_ID = 0x700ca; // (TagType:BOOL | 202)
54  RSA_OAEP_MGF_DIGEST = 0x200cb; // (TagType:ENUM_REP | 203)
55  BLOB_USAGE_REQUIREMENTS = 0x1012d; // (TagType:ENUM | 301)
56  BOOTLOADER_ONLY = 0x7012e; // (TagType:BOOL | 302)
57  ROLLBACK_RESISTANCE = 0x7012f; // (TagType:BOOL | 303)
58  HARDWARE_TYPE = 0x10130; // TagType:ENUM | 304,
59  EARLY_BOOT_ONLY = 0x70131;  // TagType:BOOL | 305,
60  ACTIVE_DATETIME = 0x60190; // (TagType:DATE | 400)
61  ORIGINATION_EXPIRE_DATETIME = 0x60191; // (TagType:DATE | 401)
62  USAGE_EXPIRE_DATETIME = 0x60192; // (TagType:DATE | 402)
63  MIN_SECONDS_BETWEEN_OPS = 0x30193; // (TagType:UINT | 403)
64  MAX_USES_PER_BOOT = 0x30194; // (TagType:UINT | 404)
65  USAGE_COUNT_LIMIT = 0x30195; // (TagType:UINT | 405)
66  /* RESERVED: ALL_USERS = 0x701f4; // (TagType:BOOL | 500) */
67  USER_ID = 0x301f5; // (TagType:UINT | 501)
68  USER_SECURE_ID = 0xa01f6; // (TagType:ULONG_REP | 502)
69  NO_AUTH_REQUIRED = 0x701f7; // (TagType:BOOL | 503)
70  USER_AUTH_TYPE = 0x101f8; // (TagType:ENUM | 504)
71  AUTH_TIMEOUT = 0x301f9; // (TagType:UINT | 505)
72  ALLOW_WHILE_ON_BODY = 0x701fa; // (TagType:BOOL | 506)
73  TRUSTED_USER_PRESENCE_REQUIRED = 0x701fb; // (TagType:BOOL | 507)
74  TRUSTED_CONFIRMATION_REQUIRED = 0x701fc;  // (TagType:BOOL | 508)
75  UNLOCKED_DEVICE_REQUIRED = 0x701fd;  //  (TagType:BOOL | 509)
76  /* RESERVED: ALL_APPLICATIONS = 0x70258; // (TagType:BOOL | 600) */
77  APPLICATION_ID = 0x90259; // (TagType:BYTES | 601)
78  /* RESERVED: EXPORTABLE = 0x7025a; // (TagType:BOOL | 602) */
79  APPLICATION_DATA = 0x902bc; // (TagType:BYTES | 700)
80  CREATION_DATETIME = 0x602bd; // (TagType:DATE | 701)
81  ORIGIN = 0x102be; // (TagType:ENUM | 702)
82  /* RESERVED: ROLLBACK_RESISTANT = 0x702bf; // (TagType:BOOL | 703) */
83  ROOT_OF_TRUST = 0x902c0; // (TagType:BYTES | 704)
84  OS_VERSION = 0x302c1; // (TagType:UINT | 705)
85  OS_PATCHLEVEL = 0x302c2; // (TagType:UINT | 706)
86  UNIQUE_ID = 0x902c3; // (TagType:BYTES | 707)
87  ATTESTATION_CHALLENGE = 0x902c4; // (TagType:BYTES | 708)
88  ATTESTATION_APPLICATION_ID = 0x902c5; // (TagType:BYTES | 709)
89  ATTESTATION_ID_BRAND = 0x902c6; // (TagType:BYTES | 710)
90  ATTESTATION_ID_DEVICE = 0x902c7; // (TagType:BYTES | 711)
91  ATTESTATION_ID_PRODUCT = 0x902c8; // (TagType:BYTES | 712)
92  ATTESTATION_ID_SERIAL = 0x902c9; // (TagType:BYTES | 713)
93  ATTESTATION_ID_IMEI = 0x902ca; // (TagType:BYTES | 714)
94  ATTESTATION_ID_MEID = 0x902cb; // (TagType:BYTES | 715)
95  ATTESTATION_ID_MANUFACTURER = 0x902cc; // (TagType:BYTES | 716)
96  ATTESTATION_ID_MODEL = 0x902cd; // (TagType:BYTES | 717)
97  VENDOR_PATCHLEVEL = 0x302ce; // (TagType:UINT | 718)
98  BOOT_PATCHLEVEL = 0x302cf; // (TagType:UINT | 719)
99  DEVICE_UNIQUE_ATTESTATION = 0x702d0;  // (TagType:BOOL | 720)
100  IDENTITY_CREDENTIAL_KEY = 0x702d1;    // (TagType:BOOL | 721)
101  STORAGE_KEY = 0x702d2;                // (TagType:BOOL | 722)
102  ASSOCIATED_DATA = 0x903e8; // (TagType:BYTES | 1000)
103  NONCE = 0x903e9; // (TagType:BYTES | 1001)
104  /* RESERVED: AUTH_TOKEN = 0x903ea; // (TagType:BYTES | 1002) */
105  MAC_LENGTH = 0x303eb; // (TagType:UINT | 1003)
106  RESET_SINCE_ID_ROTATION = 0x703ec; // (TagType:BOOL | 1004)
107  CONFIRMATION_TOKEN = 0x903ed; // (TagType:BYTES | 1005)
108  CERTIFICATE_SERIAL = 0x803ee; // (TagType:BIGNUM | 1006)
109  CERTIFICATE_SUBJECT = 0x903ef; // (TagType:BYTES | 1007)
110};
111
112enum Algorithm {
113  RSA = 0;
114  EC = 1;
115  AES = 2;
116  DES = 3;
117  HMAC = 4;
118  ALGORITHM_MAX = 5;
119};
120
121enum BlockMode {
122  ECB = 0;
123  CBC = 1;
124  CTR = 2;
125  GCM = 3;
126  BLOCK_MODE_MAX = 4;
127};
128
129enum PaddingMode {
130  PADDING_NONE = 0;
131  PADDING_RSA_OAEP = 1;
132  PADDING_RSA_PSS = 2;
133  PADDING_RSA_PKCS1_1_5_ENCRYPT = 3;
134  PADDING_RSA_PKCS1_1_5_SIGN = 4;
135  PADDING_PKCS7 = 5;
136  PADDING_MODE_MAX = 6;
137};
138
139enum Digest {
140  DIGEST_NONE = 0;
141  DIGEST_MD5 = 1;
142  DIGEST_SHA1 = 2;
143  DIGEST_SHA_2_224 = 3;
144  DIGEST_SHA_2_256 = 4;
145  DIGEST_SHA_2_384 = 5;
146  DIGEST_SHA_2_512 = 6;
147  DIGEST_MAX = 7;
148};
149
150enum EcCurve {
151  P_224 = 0;
152  P_256 = 1;
153  P_384 = 2;
154  P_521 = 3;
155  EC_CURVE_MAX = 4;
156};
157
158enum KeyOrigin {
159  GENERATED = 0;
160  DERIVED = 1;
161  IMPORTED = 2;
162  UNKNOWN = 3;
163  SECURELY_IMPORTED = 4;
164  KEY_ORIGIN_MAX = 5;
165};
166
167enum KeyBlobUsageRequirements {
168  STANDALONE = 0;
169  REQUIRES_FILE_SYSTEM = 1;
170  KEY_USAGE_MAX = 2;
171};
172
173enum KeyPurpose {
174  ENCRYPT = 0;
175  DECRYPT = 1;
176  SIGN = 2;
177  VERIFY = 3;
178  /* RESERVED: DERIVE_KEY = 4; */
179  WRAP_KEY = 5;
180  AGREE_KEY = 6;
181  ATTEST_KEY = 7;
182  PURPOSE_MAX = 8;
183};
184
185enum ErrorCode {
186  OK = 0;
187  ROOT_OF_TRUST_ALREADY_SET = 1;
188  UNSUPPORTED_PURPOSE = 2;
189  INCOMPATIBLE_PURPOSE = 3;
190  UNSUPPORTED_ALGORITHM = 4;
191  INCOMPATIBLE_ALGORITHM = 5;
192  UNSUPPORTED_KEY_SIZE = 6;
193  UNSUPPORTED_BLOCK_MODE = 7;
194  INCOMPATIBLE_BLOCK_MODE = 8;
195  UNSUPPORTED_MAC_LENGTH = 9;
196  UNSUPPORTED_PADDING_MODE = 10;
197  INCOMPATIBLE_PADDING_MODE = 11;
198  UNSUPPORTED_DIGEST = 12;
199  INCOMPATIBLE_DIGEST = 13;
200  INVALID_EXPIRATION_TIME = 14;
201  INVALID_USER_ID = 15;
202  INVALID_AUTHORIZATION_TIMEOUT = 16;
203  UNSUPPORTED_KEY_FORMAT = 17;
204  INCOMPATIBLE_KEY_FORMAT = 18;
205  UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM = 19;
206  UNSUPPORTED_KEY_VERIFICATION_ALGORITHM = 20;
207  INVALID_INPUT_LENGTH = 21;
208  KEY_EXPORT_OPTIONS_INVALID = 22;
209  DELEGATION_NOT_ALLOWED = 23;
210  KEY_NOT_YET_VALID = 24;
211  KEY_EXPIRED = 25;
212  KEY_USER_NOT_AUTHENTICATED = 26;
213  OUTPUT_PARAMETER_NULL = 27;
214  INVALID_OPERATION_HANDLE = 28;
215  INSUFFICIENT_BUFFER_SPACE = 29;
216  VERIFICATION_FAILED = 30;
217  TOO_MANY_OPERATIONS = 31;
218  UNEXPECTED_NULL_POINTER = 32;
219  INVALID_KEY_BLOB = 33;
220  IMPORTED_KEY_NOT_ENCRYPTED = 34;
221  IMPORTED_KEY_DECRYPTION_FAILED = 35;
222  IMPORTED_KEY_NOT_SIGNED = 36;
223  IMPORTED_KEY_VERIFICATION_FAILED = 37;
224  INVALID_ARGUMENT = 38;
225  UNSUPPORTED_TAG = 39;
226  INVALID_TAG = 40;
227  MEMORY_ALLOCATION_FAILED = 41;
228  IMPORT_PARAMETER_MISMATCH = 42;
229  SECURE_HW_ACCESS_DENIED = 43;
230  OPERATION_CANCELLED = 44;
231  CONCURRENT_ACCESS_CONFLICT = 45;
232  SECURE_HW_BUSY = 46;
233  SECURE_HW_COMMUNICATION_FAILED = 47;
234  UNSUPPORTED_EC_FIELD = 48;
235  MISSING_NONCE = 49;
236  INVALID_NONCE = 50;
237  MISSING_MAC_LENGTH = 51;
238  KEY_RATE_LIMIT_EXCEEDED = 52;
239  CALLER_NONCE_PROHIBITED = 53;
240  KEY_MAX_OPS_EXCEEDED = 54;
241  INVALID_MAC_LENGTH = 55;
242  MISSING_MIN_MAC_LENGTH = 56;
243  UNSUPPORTED_MIN_MAC_LENGTH = 57;
244  UNSUPPORTED_KDF = 58;
245  UNSUPPORTED_EC_CURVE = 59;
246  KEY_REQUIRES_UPGRADE = 60;
247  ATTESTATION_CHALLENGE_MISSING = 61;
248  KEYMASTER_NOT_CONFIGURED = 62;
249  ATTESTATION_APPLICATION_ID_MISSING = 63;
250  CANNOT_ATTEST_IDS = 64;
251  UNIMPLEMENTED = 65;
252  VERSION_MISMATCH = 66;
253  ROLLBACK_RESISTANCE_UNAVAILABLE = 67;
254  HARDWARE_TYPE_UNAVAILABLE = 68;
255  PROOF_OF_PRESENCE_REQUIRED = 69;
256  CONCURRENT_PROOF_OF_PRESENCE_REQUESTED = 70;
257  UNKNOWN_ERROR = 71;
258  INVALID_DEVICE_IDS = 72;                // Vendor specific.
259  PRODUCTION_MODE_PROVISIONING = 73;      // Vendor specific.
260  NO_USER_CONFIRMATION = 74;
261  KEY_UPGRADE_NOT_REQUIRED = 75;          // Vendor specific.
262  DEVICE_LOCKED = 76;
263  EARLY_BOOT_ENDED = 77;
264  ATTESTATION_KEYS_NOT_PROVISIONED = 78;
265  ATTESTATION_IDS_NOT_PROVISIONED = 79;
266  INVALID_OPERATION = 80;
267  STORAGE_KEY_UNSUPPORTED = 81;
268  INCOMPATIBLE_MGF_DIGEST = 82;
269  UNSUPPORTED_MGF_DIGEST = 83;
270};
271
272enum SecurityLevel {
273  SOFTWARE = 0;
274  TRUSTED_ENVIRONMENT = 1;
275  STRONGBOX = 2;
276};
277
278// NOTE: these enum values must be kept in sync with the HAL,
279// as they are used in an HMAC calculation.
280enum HardwareAuthenticatorType {
281  HW_AUTH_NONE = 0;
282  HW_AUTH_PASSWORD = 1;
283  HW_AUTH_FINGERPRINT = 2;
284  // Additional entries must be powers of 2.
285};
286
287enum KeyFormat {
288  X509 = 0;   /* for public key export */
289  PKCS8 = 1;  /* for asymmetric key pair import */
290  RAW = 3;    /* for symmetric key import and export*/
291}
292
293enum DTupError {
294  DTUP_OK = 0;
295  DTUP_NO_EVENT = 1;
296}
297
298/* matches Linux event device codes */
299enum DTupKeyEvent {
300    DTUP_RESERVED = 0;
301    DTUP_VOL_DOWN = 114;
302    DTUP_VOL_UP = 115;
303    DTUP_PWR = 116;
304}
305
306enum BootColor {
307    BOOT_VERIFIED_GREEN = 0;
308    BOOT_SELFSIGNED_YELLOW = 1;
309    BOOT_UNVERIFIED_ORANGE = 2;
310    BOOT_VERIFY_FAILED_RED = 3;
311}
312
313enum ChipFusing {
314    FUSING_PROTO = 0;
315    FUSING_DVT = 1;
316    FUSING_PVT = 2;     // Strongbox gen v0 certs.
317    FUSING_PVT_1 = 3;   // Strongbox gen v1 certs.
318    FUSING_D_PVT = 4;   // Dauntless gen v0 certs.
319    FUSING_D_PVT_1 = 5; // Dauntless gen v1 certs.
320}
321
322enum CertificateStatus {
323  CERT_PREVIOUSLY_PROVISIONED = 0;
324  CERT_MISSING = 1;
325  CERT_CHECKSUM = 2;
326  CERT_UNKNOWN_ERROR = 3;
327  CERT_WRONG_PACKET = 4;
328}
329