1 /*
2  * Copyright 2016 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #ifndef SYSTEM_KEYMASTER_ATTESTATION_RECORD_H_
18 #define SYSTEM_KEYMASTER_ATTESTATION_RECORD_H_
19 
20 #include <hardware/keymaster_defs.h>
21 
22 #include <keymaster/authorization_set.h>
23 
24 namespace keymaster {
25 
26 class KeymasterContext;
27 
28 /**
29  * The OID for Android attestation records.  For the curious, it breaks down as follows:
30  *
31  * 1 = ISO
32  * 3 = org
33  * 6 = DoD (Huh? OIDs are weird.)
34  * 1 = IANA
35  * 4 = Private
36  * 1 = Enterprises
37  * 11129 = Google
38  * 2 = Google security
39  * 1 = certificate extension
40  * 17 = Android attestation extension.
41  */
42 static const char kAttestionRecordOid[] = "1.3.6.1.4.1.11129.2.1.17";
43 
44 keymaster_error_t build_attestation_record(const AuthorizationSet& attestation_params,
45                                            const AuthorizationSet& software_enforced,
46                                            const AuthorizationSet& tee_enforced,
47                                            const KeymasterContext& context,
48                                            UniquePtr<uint8_t[]>* asn1_key_desc,
49                                            size_t* asn1_key_desc_len);
50 
51 keymaster_error_t parse_attestation_record(const uint8_t* asn1_key_desc, size_t asn1_key_desc_len,
52                                            uint32_t* attestation_version,  //
53                                            keymaster_security_level_t* attestation_security_level,
54                                            uint32_t* keymaster_version,
55                                            keymaster_security_level_t* keymaster_security_level,
56                                            keymaster_blob_t* attestation_challenge,
57                                            AuthorizationSet* software_enforced,
58                                            AuthorizationSet* tee_enforced,
59                                            keymaster_blob_t* unique_id);
60 }
61 
62 #endif  // SYSTEM_KEYMASTER_ATTESTATION_RECORD_H_
63