1 /*
2  * Copyright 2014 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "asymmetric_key.h"
18 
19 #include <new>
20 
21 #include <openssl/asn1.h>
22 #include <openssl/stack.h>
23 #include <openssl/x509.h>
24 #include <openssl/x509v3.h>
25 
26 #include "attestation_record.h"
27 #include "openssl_err.h"
28 #include "openssl_utils.h"
29 
30 namespace keymaster {
31 
32 namespace {
33 
34 constexpr int kDigitalSignatureKeyUsageBit = 0;
35 constexpr int kKeyEnciphermentKeyUsageBit = 2;
36 constexpr int kDataEnciphermentKeyUsageBit = 3;
37 constexpr int kMaxKeyUsageBit = 8;
38 
min(T a,T b)39 template <typename T> T min(T a, T b) {
40     return (a < b) ? a : b;
41 }
42 
add_key_usage_extension(const AuthorizationSet & tee_enforced,const AuthorizationSet & sw_enforced,X509 * certificate)43 static keymaster_error_t add_key_usage_extension(const AuthorizationSet& tee_enforced,
44                                                  const AuthorizationSet& sw_enforced,
45                                                  X509* certificate) {
46     // Build BIT_STRING with correct contents.
47     ASN1_BIT_STRING_Ptr key_usage(ASN1_BIT_STRING_new());
48 
49     for (size_t i = 0; i <= kMaxKeyUsageBit; ++i) {
50         if (!ASN1_BIT_STRING_set_bit(key_usage.get(), i, 0)) {
51             return TranslateLastOpenSslError();
52         }
53     }
54 
55     if (tee_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_SIGN) ||
56         tee_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_VERIFY) ||
57         sw_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_SIGN) ||
58         sw_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_VERIFY)) {
59         if (!ASN1_BIT_STRING_set_bit(key_usage.get(), kDigitalSignatureKeyUsageBit, 1)) {
60             return TranslateLastOpenSslError();
61         }
62     }
63 
64     if (tee_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_ENCRYPT) ||
65         tee_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_DECRYPT) ||
66         sw_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_ENCRYPT) ||
67         sw_enforced.Contains(TAG_PURPOSE, KM_PURPOSE_DECRYPT)) {
68         if (!ASN1_BIT_STRING_set_bit(key_usage.get(), kKeyEnciphermentKeyUsageBit, 1) ||
69             !ASN1_BIT_STRING_set_bit(key_usage.get(), kDataEnciphermentKeyUsageBit, 1)) {
70             return TranslateLastOpenSslError();
71         }
72     }
73 
74     // Convert to octets
75     int len = i2d_ASN1_BIT_STRING(key_usage.get(), nullptr);
76     if (len < 0) {
77         return TranslateLastOpenSslError();
78     }
79     UniquePtr<uint8_t[]> asn1_key_usage(new uint8_t[len]);
80     if (!asn1_key_usage.get()) {
81         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
82     }
83     uint8_t* p = asn1_key_usage.get();
84     len = i2d_ASN1_BIT_STRING(key_usage.get(), &p);
85     if (len < 0) {
86         return TranslateLastOpenSslError();
87     }
88 
89     // Build OCTET_STRING
90     ASN1_OCTET_STRING_Ptr key_usage_str(ASN1_OCTET_STRING_new());
91     if (!key_usage_str.get() ||
92         !ASN1_OCTET_STRING_set(key_usage_str.get(), asn1_key_usage.get(), len)) {
93         return TranslateLastOpenSslError();
94     }
95 
96     X509_EXTENSION_Ptr key_usage_extension(X509_EXTENSION_create_by_NID(nullptr,        //
97                                                                         NID_key_usage,  //
98                                                                         false /* critical */,
99                                                                         key_usage_str.get()));
100     if (!key_usage_extension.get()) {
101         return TranslateLastOpenSslError();
102     }
103 
104     if (!X509_add_ext(certificate, key_usage_extension.get() /* Don't release; copied */,
105                       -1 /* insert at end */)) {
106         return TranslateLastOpenSslError();
107     }
108 
109     return KM_ERROR_OK;
110 }
111 
112 }  // anonymous namespace
113 
formatted_key_material(keymaster_key_format_t format,UniquePtr<uint8_t[]> * material,size_t * size) const114 keymaster_error_t AsymmetricKey::formatted_key_material(keymaster_key_format_t format,
115                                                         UniquePtr<uint8_t[]>* material,
116                                                         size_t* size) const {
117     if (format != KM_KEY_FORMAT_X509)
118         return KM_ERROR_UNSUPPORTED_KEY_FORMAT;
119 
120     if (material == NULL || size == NULL)
121         return KM_ERROR_OUTPUT_PARAMETER_NULL;
122 
123     EVP_PKEY_Ptr pkey(EVP_PKEY_new());
124     if (!InternalToEvp(pkey.get()))
125         return TranslateLastOpenSslError();
126 
127     int key_data_length = i2d_PUBKEY(pkey.get(), NULL);
128     if (key_data_length <= 0)
129         return TranslateLastOpenSslError();
130 
131     material->reset(new (std::nothrow) uint8_t[key_data_length]);
132     if (material->get() == NULL)
133         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
134 
135     uint8_t* tmp = material->get();
136     if (i2d_PUBKEY(pkey.get(), &tmp) != key_data_length) {
137         material->reset();
138         return TranslateLastOpenSslError();
139     }
140 
141     *size = key_data_length;
142     return KM_ERROR_OK;
143 }
144 
build_attestation_extension(const AuthorizationSet & attest_params,const AuthorizationSet & tee_enforced,const AuthorizationSet & sw_enforced,const KeymasterContext & context,X509_EXTENSION_Ptr * extension)145 static keymaster_error_t build_attestation_extension(const AuthorizationSet& attest_params,
146                                                      const AuthorizationSet& tee_enforced,
147                                                      const AuthorizationSet& sw_enforced,
148                                                      const KeymasterContext& context,
149                                                      X509_EXTENSION_Ptr* extension) {
150     ASN1_OBJECT_Ptr oid(
151         OBJ_txt2obj(kAttestionRecordOid, 1 /* accept numerical dotted string form only */));
152     if (!oid.get())
153         return TranslateLastOpenSslError();
154 
155     UniquePtr<uint8_t[]> attest_bytes;
156     size_t attest_bytes_len;
157     keymaster_error_t error = build_attestation_record(attest_params, sw_enforced, tee_enforced,
158                                                        context, &attest_bytes, &attest_bytes_len);
159     if (error != KM_ERROR_OK)
160         return error;
161 
162     ASN1_OCTET_STRING_Ptr attest_str(ASN1_OCTET_STRING_new());
163     if (!attest_str.get() ||
164         !ASN1_OCTET_STRING_set(attest_str.get(), attest_bytes.get(), attest_bytes_len))
165         return TranslateLastOpenSslError();
166 
167     extension->reset(
168         X509_EXTENSION_create_by_OBJ(nullptr, oid.get(), 0 /* not critical */, attest_str.get()));
169     if (!extension->get())
170         return TranslateLastOpenSslError();
171 
172     return KM_ERROR_OK;
173 }
174 
add_public_key(EVP_PKEY * key,X509 * certificate,keymaster_error_t * error)175 static bool add_public_key(EVP_PKEY* key, X509* certificate, keymaster_error_t* error) {
176     if (!X509_set_pubkey(certificate, key)) {
177         *error = TranslateLastOpenSslError();
178         return false;
179     }
180     return true;
181 }
182 
add_attestation_extension(const AuthorizationSet & attest_params,const AuthorizationSet & tee_enforced,const AuthorizationSet & sw_enforced,const KeymasterContext & context,X509 * certificate,keymaster_error_t * error)183 static bool add_attestation_extension(const AuthorizationSet& attest_params,
184                                       const AuthorizationSet& tee_enforced,
185                                       const AuthorizationSet& sw_enforced,
186                                       const KeymasterContext& context, X509* certificate,
187                                       keymaster_error_t* error) {
188     X509_EXTENSION_Ptr attest_extension;
189     *error = build_attestation_extension(attest_params, tee_enforced, sw_enforced, context,
190                                          &attest_extension);
191     if (*error != KM_ERROR_OK)
192         return false;
193 
194     if (!X509_add_ext(certificate, attest_extension.get() /* Don't release; copied */,
195                       -1 /* insert at end */)) {
196         *error = TranslateLastOpenSslError();
197         return false;
198     }
199 
200     return true;
201 }
202 
get_certificate_blob(X509 * certificate,keymaster_blob_t * blob)203 static keymaster_error_t get_certificate_blob(X509* certificate, keymaster_blob_t* blob) {
204     int len = i2d_X509(certificate, nullptr);
205     if (len < 0)
206         return TranslateLastOpenSslError();
207 
208     uint8_t* data = new uint8_t[len];
209     if (!data)
210         return KM_ERROR_MEMORY_ALLOCATION_FAILED;
211 
212     uint8_t* p = data;
213     i2d_X509(certificate, &p);
214 
215     blob->data_length = len;
216     blob->data = data;
217 
218     return KM_ERROR_OK;
219 }
220 
allocate_cert_chain(size_t entry_count,keymaster_cert_chain_t * chain,keymaster_error_t * error)221 static bool allocate_cert_chain(size_t entry_count, keymaster_cert_chain_t* chain,
222                                 keymaster_error_t* error) {
223     if (chain->entries) {
224         for (size_t i = 0; i < chain->entry_count; ++i)
225             delete[] chain->entries[i].data;
226         delete[] chain->entries;
227     }
228 
229     chain->entry_count = entry_count;
230     chain->entries = new keymaster_blob_t[entry_count];
231     if (!chain->entries) {
232         *error = KM_ERROR_MEMORY_ALLOCATION_FAILED;
233         return false;
234     }
235     return true;
236 }
237 
238 // Copies the intermediate and root certificates into chain, leaving the first slot for the leaf
239 // certificate.
copy_attestation_chain(const KeymasterContext & context,keymaster_algorithm_t sign_algorithm,keymaster_cert_chain_t * chain,keymaster_error_t * error)240 static bool copy_attestation_chain(const KeymasterContext& context,
241                                    keymaster_algorithm_t sign_algorithm,
242                                    keymaster_cert_chain_t* chain, keymaster_error_t* error) {
243 
244     UniquePtr<keymaster_cert_chain_t, CertificateChainDelete> attest_key_chain(
245         context.AttestationChain(sign_algorithm, error));
246     if (!attest_key_chain.get())
247         return false;
248 
249     if (!allocate_cert_chain(attest_key_chain->entry_count + 1, chain, error))
250         return false;
251 
252     chain->entries[0].data = nullptr;  // Leave empty for the leaf certificate.
253     chain->entries[1].data_length = 0;
254 
255     for (size_t i = 0; i < attest_key_chain->entry_count; ++i) {
256         chain->entries[i + 1] = attest_key_chain->entries[i];
257         attest_key_chain->entries[i].data = nullptr;
258     }
259 
260     return true;
261 }
262 
GenerateAttestation(const KeymasterContext & context,const AuthorizationSet & attest_params,const AuthorizationSet & tee_enforced,const AuthorizationSet & sw_enforced,keymaster_cert_chain_t * cert_chain) const263 keymaster_error_t AsymmetricKey::GenerateAttestation(const KeymasterContext& context,
264                                                      const AuthorizationSet& attest_params,
265                                                      const AuthorizationSet& tee_enforced,
266                                                      const AuthorizationSet& sw_enforced,
267                                                      keymaster_cert_chain_t* cert_chain) const {
268 
269     keymaster_algorithm_t sign_algorithm;
270     if ((!sw_enforced.GetTagValue(TAG_ALGORITHM, &sign_algorithm) &&
271          !tee_enforced.GetTagValue(TAG_ALGORITHM, &sign_algorithm)))
272         return KM_ERROR_UNKNOWN_ERROR;
273 
274     if ((sign_algorithm != KM_ALGORITHM_RSA && sign_algorithm != KM_ALGORITHM_EC))
275         return KM_ERROR_INCOMPATIBLE_ALGORITHM;
276 
277     EVP_PKEY_Ptr pkey(EVP_PKEY_new());
278     if (!InternalToEvp(pkey.get()))
279         return TranslateLastOpenSslError();
280 
281     X509_Ptr certificate(X509_new());
282     if (!certificate.get())
283         return TranslateLastOpenSslError();
284 
285     if (!X509_set_version(certificate.get(), 2 /* version 3, but zero-based */))
286         return TranslateLastOpenSslError();
287 
288     ASN1_INTEGER_Ptr serialNumber(ASN1_INTEGER_new());
289     if (!serialNumber.get() || !ASN1_INTEGER_set(serialNumber.get(), 1) ||
290         !X509_set_serialNumber(certificate.get(), serialNumber.get() /* Don't release; copied */))
291         return TranslateLastOpenSslError();
292 
293     // TODO(swillden): Find useful values (if possible) for issuerName and subjectName.
294     X509_NAME_Ptr issuerName(X509_NAME_new());
295     if (!issuerName.get() ||
296         !X509_NAME_add_entry_by_txt(issuerName.get(), "CN", MBSTRING_ASC,
297                                     reinterpret_cast<const uint8_t*>("Android Keymaster"),
298                                     -1 /* len */, -1 /* loc */, 0 /* set */) ||
299         !X509_set_issuer_name(certificate.get(), issuerName.get() /* Don't release; copied  */))
300         return TranslateLastOpenSslError();
301 
302     X509_NAME_Ptr subjectName(X509_NAME_new());
303     if (!subjectName.get() ||
304         !X509_NAME_add_entry_by_txt(subjectName.get(), "CN", MBSTRING_ASC,
305                                     reinterpret_cast<const uint8_t*>("A Keymaster Key"),
306                                     -1 /* len */, -1 /* loc */, 0 /* set */) ||
307         !X509_set_subject_name(certificate.get(), subjectName.get() /* Don't release; copied */))
308         return TranslateLastOpenSslError();
309 
310     ASN1_TIME_Ptr notBefore(ASN1_TIME_new());
311     uint64_t activeDateTime = 0;
312     authorizations().GetTagValue(TAG_ACTIVE_DATETIME, &activeDateTime);
313     if (!notBefore.get() || !ASN1_TIME_set(notBefore.get(), activeDateTime / 1000) ||
314         !X509_set_notBefore(certificate.get(), notBefore.get() /* Don't release; copied */))
315         return TranslateLastOpenSslError();
316 
317     ASN1_TIME_Ptr notAfter(ASN1_TIME_new());
318     uint64_t usageExpireDateTime = UINT64_MAX;
319     authorizations().GetTagValue(TAG_USAGE_EXPIRE_DATETIME, &usageExpireDateTime);
320     // TODO(swillden): When trusty can use the C++ standard library change the calculation of
321     // notAfterTime to use std::numeric_limits<time_t>::max(), rather than assuming that time_t is
322     // 32 bits.
323     time_t notAfterTime = min(static_cast<uint64_t>(UINT32_MAX), usageExpireDateTime / 1000);
324     if (!notAfter.get() || !ASN1_TIME_set(notAfter.get(), notAfterTime) ||
325         !X509_set_notAfter(certificate.get(), notAfter.get() /* Don't release; copied */))
326         return TranslateLastOpenSslError();
327 
328     keymaster_error_t error = add_key_usage_extension(tee_enforced, sw_enforced, certificate.get());
329     if (error != KM_ERROR_OK) {
330         return error;
331     }
332 
333     EVP_PKEY_Ptr sign_key(context.AttestationKey(sign_algorithm, &error));
334 
335     if (!sign_key.get() ||  //
336         !add_public_key(pkey.get(), certificate.get(), &error) ||
337         !add_attestation_extension(attest_params, tee_enforced, sw_enforced, context,
338                                    certificate.get(), &error))
339         return error;
340 
341     if (!copy_attestation_chain(context, sign_algorithm, cert_chain, &error))
342         return error;
343 
344     // Copy subject key identifier from cert_chain->entries[1] as authority key_id.
345     if (cert_chain->entry_count < 2) {
346         // cert_chain must have at least two entries, one for the cert we're trying to create and
347         // one for the cert for the key that signs the new cert.
348         return KM_ERROR_UNKNOWN_ERROR;
349     }
350 
351     const uint8_t* p = cert_chain->entries[1].data;
352     X509_Ptr signing_cert(d2i_X509(nullptr, &p, cert_chain->entries[1].data_length));
353     if (!signing_cert.get()) {
354         return TranslateLastOpenSslError();
355     }
356 
357     UniquePtr<X509V3_CTX> x509v3_ctx(new X509V3_CTX);
358     *x509v3_ctx = {};
359     X509V3_set_ctx(x509v3_ctx.get(), signing_cert.get(), certificate.get(), nullptr /* req */,
360                    nullptr /* crl */, 0 /* flags */);
361 
362     X509_EXTENSION_Ptr auth_key_id(X509V3_EXT_nconf_nid(nullptr /* conf */, x509v3_ctx.get(),
363                                                         NID_authority_key_identifier,
364                                                         const_cast<char*>("keyid:always")));
365     if (!auth_key_id.get() ||
366         !X509_add_ext(certificate.get(), auth_key_id.get() /* Don't release; copied */,
367                       -1 /* insert at end */)) {
368         return TranslateLastOpenSslError();
369     }
370 
371     if (!X509_sign(certificate.get(), sign_key.get(), EVP_sha256()))
372         return TranslateLastOpenSslError();
373 
374     return get_certificate_blob(certificate.get(), &cert_chain->entries[0]);
375 }
376 
377 }  // namespace keymaster
378