Merge "Persist KeyChainSnapshot to XML" into pi-dev
diff --git a/core/java/android/security/keystore/recovery/KeyChainProtectionParams.java b/core/java/android/security/keystore/recovery/KeyChainProtectionParams.java
index 2a66206..4af1af5 100644
--- a/core/java/android/security/keystore/recovery/KeyChainProtectionParams.java
+++ b/core/java/android/security/keystore/recovery/KeyChainProtectionParams.java
@@ -50,6 +50,22 @@
*/
@SystemApi
public final class KeyChainProtectionParams implements Parcelable {
+
+ // IMPORTANT! PLEASE READ!
+ // -----------------------
+ // If you edit this file (e.g., to add new fields), please MAKE SURE to also do the following:
+ // - Update the #writeToParcel(Parcel) method below
+ // - Update the #(Parcel) constructor below
+ // - Update android.security.keystore.recovery.KeyChainSnapshotTest to make sure nobody
+ // accidentally breaks your fields in the Parcel in the future.
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly serialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly deserialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeychainSnapshotSerializerTest to make sure nobody breaks serialization of your field
+ // in the future.
+
/** @hide */
@Retention(RetentionPolicy.SOURCE)
@IntDef(prefix = {"TYPE_"}, value = {TYPE_LOCKSCREEN})
diff --git a/core/java/android/security/keystore/recovery/KeyChainSnapshot.java b/core/java/android/security/keystore/recovery/KeyChainSnapshot.java
index 24ff182..e46c34c 100644
--- a/core/java/android/security/keystore/recovery/KeyChainSnapshot.java
+++ b/core/java/android/security/keystore/recovery/KeyChainSnapshot.java
@@ -48,6 +48,22 @@
*/
@SystemApi
public final class KeyChainSnapshot implements Parcelable {
+
+ // IMPORTANT! PLEASE READ!
+ // -----------------------
+ // If you edit this file (e.g., to add new fields), please MAKE SURE to also do the following:
+ // - Update the #writeToParcel(Parcel) method below
+ // - Update the #(Parcel) constructor below
+ // - Update android.security.keystore.recovery.KeyChainSnapshotTest to make sure nobody
+ // accidentally breaks your fields in the Parcel in the future.
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly serialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly deserialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeychainSnapshotSerializerTest to make sure nobody breaks serialization of your field
+ // in the future.
+
private static final int DEFAULT_MAX_ATTEMPTS = 10;
private static final long DEFAULT_COUNTER_ID = 1L;
diff --git a/core/java/android/security/keystore/recovery/KeyDerivationParams.java b/core/java/android/security/keystore/recovery/KeyDerivationParams.java
index 225b592..d16f3ea 100644
--- a/core/java/android/security/keystore/recovery/KeyDerivationParams.java
+++ b/core/java/android/security/keystore/recovery/KeyDerivationParams.java
@@ -35,6 +35,22 @@
*/
@SystemApi
public final class KeyDerivationParams implements Parcelable {
+
+ // IMPORTANT! PLEASE READ!
+ // -----------------------
+ // If you edit this file (e.g., to add new fields), please MAKE SURE to also do the following:
+ // - Update the #writeToParcel(Parcel) method below
+ // - Update the #(Parcel) constructor below
+ // - Update android.security.keystore.recovery.KeyChainSnapshotTest to make sure nobody
+ // accidentally breaks your fields in the Parcel in the future.
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly serialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly deserialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeychainSnapshotSerializerTest to make sure nobody breaks serialization of your field
+ // in the future.
+
private final int mAlgorithm;
private final byte[] mSalt;
private final int mMemoryDifficulty;
diff --git a/core/java/android/security/keystore/recovery/WrappedApplicationKey.java b/core/java/android/security/keystore/recovery/WrappedApplicationKey.java
index 714e35a..32952db 100644
--- a/core/java/android/security/keystore/recovery/WrappedApplicationKey.java
+++ b/core/java/android/security/keystore/recovery/WrappedApplicationKey.java
@@ -42,6 +42,21 @@
// The only supported format is AES-256 symmetric key.
private byte[] mEncryptedKeyMaterial;
+ // IMPORTANT! PLEASE READ!
+ // -----------------------
+ // If you edit this file (e.g., to add new fields), please MAKE SURE to also do the following:
+ // - Update the #writeToParcel(Parcel) method below
+ // - Update the #(Parcel) constructor below
+ // - Update android.security.keystore.recovery.KeyChainSnapshotTest to make sure nobody
+ // accidentally breaks your fields in the Parcel in the future.
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly serialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeyChainSnapshotSerializer to correctly deserialize your new field
+ // - Update com.android.server.locksettings.recoverablekeystore.serialization
+ // .KeychainSnapshotSerializerTest to make sure nobody breaks serialization of your field
+ // in the future.
+
/**
* Builder for creating {@link WrappedApplicationKey}.
*/
diff --git a/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RecoverableKeyStoreDbContract.java b/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RecoverableKeyStoreDbContract.java
index 1eff2d4..7ee809a 100644
--- a/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RecoverableKeyStoreDbContract.java
+++ b/services/core/java/com/android/server/locksettings/recoverablekeystore/storage/RecoverableKeyStoreDbContract.java
@@ -70,121 +70,6 @@
}
/**
- * Table holding encrypted snapshots of the recoverable key store.
- */
- static class SnapshotsEntry implements BaseColumns {
- static final String TABLE_NAME = "snapshots";
-
- /**
- * The version number of the snapshot.
- */
- static final String COLUMN_NAME_VERSION = "version";
-
- /**
- * The ID of the user whose keystore was snapshotted.
- */
- static final String COLUMN_NAME_USER_ID = "user_id";
-
- /**
- * The UID of the app that owns the snapshot (i.e., the recovery agent).
- */
- static final String COLUMN_NAME_UID = "uid";
-
- /**
- * The maximum number of attempts allowed to attempt to decrypt the recovery key.
- */
- static final String COLUMN_NAME_MAX_ATTEMPTS = "max_attempts";
-
- /**
- * The ID of the counter in the trusted hardware module.
- */
- static final String COLUMN_NAME_COUNTER_ID = "counter_id";
-
- /**
- * Server parameters used to help identify the device (during recovery).
- */
- static final String SERVER_PARAMS = "server_params";
-
- /**
- * The public key of the trusted hardware module. This key has been used to encrypt the
- * snapshot, to ensure that it can only be read by the trusted module.
- */
- static final String TRUSTED_HARDWARE_PUBLIC_KEY = "thm_public_key";
-
- /**
- * {@link java.security.cert.CertPath} signing the trusted hardware module to whose public
- * key this snapshot is encrypted.
- */
- static final String CERT_PATH = "cert_path";
-
- /**
- * The recovery key, encrypted with the user's lock screen and the trusted hardware module's
- * public key.
- */
- static final String ENCRYPTED_RECOVERY_KEY = "encrypted_recovery_key";
- }
-
- /**
- * Table holding encrypted keys belonging to a particular snapshot.
- */
- static class SnapshotKeysEntry implements BaseColumns {
- static final String TABLE_NAME = "snapshot_keys";
-
- /**
- * ID of the associated snapshot entry in {@link SnapshotsEntry}.
- */
- static final String COLUMN_NAME_SNAPSHOT_ID = "snapshot_id";
-
- /**
- * Alias of the key.
- */
- static final String COLUMN_NAME_ALIAS = "alias";
-
- /**
- * Key material, encrypted with the recovery key from the snapshot.
- */
- static final String COLUMN_NAME_ENCRYPTED_BYTES = "encrypted_key_bytes";
- }
-
- /**
- * A layer of protection associated with a snapshot.
- */
- static class SnapshotProtectionParams implements BaseColumns {
- static final String TABLE_NAME = "snapshot_protection_params";
-
- /**
- * ID of the associated snapshot entry in {@link SnapshotsEntry}.
- */
- static final String COLUMN_NAME_SNAPSHOT_ID = "snapshot_id";
-
- /**
- * Type of secret used to generate recovery key. One of
- * {@link android.security.keystore.recovery.KeyChainProtectionParams#TYPE_LOCKSCREEN} or
- */
- static final String COLUMN_NAME_SECRET_TYPE = "secret_type";
-
- /**
- * If a lock screen, the type of UI used. One of
- * {@link android.security.keystore.recovery.KeyChainProtectionParams#UI_FORMAT_PATTERN},
- * {@link android.security.keystore.recovery.KeyChainProtectionParams#UI_FORMAT_PIN}, or
- * {@link android.security.keystore.recovery.KeyChainProtectionParams#UI_FORMAT_PASSWORD}.
- */
- static final String COLUMN_NAME_LOCKSCREEN_UI_TYPE = "lock_screen_ui_type";
-
- /**
- * The algorithm used to derive cryptographic material from the key and salt. One of
- * {@link android.security.keystore.recovery.KeyDerivationParams#ALGORITHM_SHA256} or
- * {@link android.security.keystore.recovery.KeyDerivationParams#ALGORITHM_SCRYPT}.
- */
- static final String COLUMN_NAME_KEY_DERIVATION_ALGORITHM = "key_derivation_algorithm";
-
- /**
- * The salt used along with the secret to generate cryptographic material.
- */
- static final String COLUMN_NAME_KEY_DERIVATION_SALT = "key_derivation_salt";
- }
-
- /**
* Recoverable KeyStore metadata for a specific user profile.
*/
static class UserMetadataEntry implements BaseColumns {