diff options
13 files changed, 50 insertions, 80 deletions
diff --git a/core/java/android/security/ConfirmationPrompt.java b/core/java/android/security/ConfirmationPrompt.java index d8c44adcc322..f626149b03c4 100644 --- a/core/java/android/security/ConfirmationPrompt.java +++ b/core/java/android/security/ConfirmationPrompt.java @@ -92,7 +92,6 @@ public class ConfirmationPrompt { private Executor mExecutor; private Context mContext; - private final KeyStore mKeyStore = KeyStore.getInstance(); private AndroidProtectedConfirmation mProtectedConfirmation; private AndroidProtectedConfirmation getService() { diff --git a/core/java/android/security/keystore/recovery/RecoveryController.java b/core/java/android/security/keystore/recovery/RecoveryController.java index f1054ec8ef15..c171c1b4b3b6 100644 --- a/core/java/android/security/keystore/recovery/RecoveryController.java +++ b/core/java/android/security/keystore/recovery/RecoveryController.java @@ -26,7 +26,6 @@ import android.content.Context; import android.os.RemoteException; import android.os.ServiceManager; import android.os.ServiceSpecificException; -import android.security.KeyStore; import android.security.KeyStore2; import android.security.keystore.KeyPermanentlyInvalidatedException; import android.security.keystore2.AndroidKeyStoreProvider; @@ -272,11 +271,9 @@ public class RecoveryController { public static final int ERROR_KEY_NOT_FOUND = 30; private final ILockSettings mBinder; - private final KeyStore mKeyStore; - private RecoveryController(ILockSettings binder, KeyStore keystore) { + private RecoveryController(ILockSettings binder) { mBinder = binder; - mKeyStore = keystore; } /** @@ -296,7 +293,7 @@ public class RecoveryController { // lockSettings may be null. ILockSettings lockSettings = ILockSettings.Stub.asInterface(ServiceManager.getService("lock_settings")); - return new RecoveryController(lockSettings, KeyStore.getInstance()); + return new RecoveryController(lockSettings); } /** diff --git a/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java b/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java index 62fe54f1f089..ef03d3a3b286 100644 --- a/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java +++ b/keystore/java/android/security/keystore/AndroidKeyStoreProvider.java @@ -19,9 +19,9 @@ package android.security.keystore; import android.annotation.NonNull; import android.annotation.SystemApi; import android.compat.annotation.UnsupportedAppUsage; -import android.security.KeyStore; import java.io.IOException; +import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.security.NoSuchProviderException; @@ -47,13 +47,13 @@ public class AndroidKeyStoreProvider extends Provider { } /** - * Gets the {@link KeyStore} operation handle corresponding to the provided JCA crypto + * Gets the Android KeyStore operation handle corresponding to the provided JCA crypto * primitive. * * <p>The following primitives are supported: {@link Cipher} and {@link Mac}. * - * @return KeyStore operation handle or {@code 0} if the provided primitive's KeyStore operation - * is not in progress. + * @return Android KeyStore operation handle or {@code 0} if the provided primitive's Android + * KeyStore operation is not in progress. * * @throws IllegalArgumentException if the provided primitive is not supported or is not backed * by AndroidKeyStore provider. @@ -67,10 +67,10 @@ public class AndroidKeyStoreProvider extends Provider { } /** - * Returns an {@code AndroidKeyStore} {@link java.security.KeyStore}} of the specified UID. - * The {@code KeyStore} contains keys and certificates owned by that UID. Such cross-UID - * access is permitted to a few system UIDs and only to a few other UIDs (e.g., Wi-Fi, VPN) - * all of which are system. + * Returns an {@code AndroidKeyStore} {@link KeyStore} of the specified UID. The {@code + * KeyStore} contains keys and certificates owned by that UID. Such cross-UID access is + * permitted to a few system UIDs and only to a few other UIDs (e.g., Wi-Fi, VPN) all of which + * are system. * * <p>Note: the returned {@code KeyStore} is already initialized/loaded. Thus, there is * no need to invoke {@code load} on it. @@ -84,12 +84,12 @@ public class AndroidKeyStoreProvider extends Provider { */ @SystemApi @NonNull - public static java.security.KeyStore getKeyStoreForUid(int uid) + public static KeyStore getKeyStoreForUid(int uid) throws KeyStoreException, NoSuchProviderException { - final java.security.KeyStore.LoadStoreParameter loadParameter = + final KeyStore.LoadStoreParameter loadParameter = new android.security.keystore2.AndroidKeyStoreLoadStoreParameter( KeyProperties.legacyUidToNamespace(uid)); - java.security.KeyStore result = java.security.KeyStore.getInstance(PROVIDER_NAME); + KeyStore result = KeyStore.getInstance(PROVIDER_NAME); try { result.load(loadParameter); } catch (NoSuchAlgorithmException | CertificateException | IOException e) { diff --git a/keystore/java/android/security/keystore/KeyGenParameterSpec.java b/keystore/java/android/security/keystore/KeyGenParameterSpec.java index 244fe3033dca..7aecfd8d4a0d 100644 --- a/keystore/java/android/security/keystore/KeyGenParameterSpec.java +++ b/keystore/java/android/security/keystore/KeyGenParameterSpec.java @@ -910,7 +910,7 @@ public final class KeyGenParameterSpec implements AlgorithmParameterSpec, UserAu /** * Returns whether this key is critical to the device encryption flow. * - * @see android.security.KeyStore#FLAG_CRITICAL_TO_DEVICE_ENCRYPTION + * @see Builder#setCriticalToDeviceEncryption(boolean) * @hide */ public boolean isCriticalToDeviceEncryption() { diff --git a/keystore/java/android/security/keystore/KeyProtection.java b/keystore/java/android/security/keystore/KeyProtection.java index 2495d1a85864..31b4a5eac619 100644 --- a/keystore/java/android/security/keystore/KeyProtection.java +++ b/keystore/java/android/security/keystore/KeyProtection.java @@ -569,7 +569,7 @@ public final class KeyProtection implements ProtectionParameter, UserAuthArgs { /** * Return whether this key is critical to the device encryption flow. * - * @see android.security.KeyStore#FLAG_CRITICAL_TO_DEVICE_ENCRYPTION + * @see Builder#setCriticalToDeviceEncryption(boolean) * @hide */ public boolean isCriticalToDeviceEncryption() { @@ -1105,9 +1105,10 @@ public final class KeyProtection implements ProtectionParameter, UserAuthArgs { * Set whether this key is critical to the device encryption flow * * This is a special flag only available to system servers to indicate the current key - * is part of the device encryption flow. + * is part of the device encryption flow. Setting this flag causes the key to not + * be cryptographically bound to the LSKF even if the key is otherwise authentication + * bound. * - * @see android.security.KeyStore#FLAG_CRITICAL_TO_DEVICE_ENCRYPTION * @hide */ public Builder setCriticalToDeviceEncryption(boolean critical) { diff --git a/keystore/java/android/security/keystore/KeyStoreCryptoOperation.java b/keystore/java/android/security/keystore/KeyStoreCryptoOperation.java index 2c709ae1ac5b..c42c9e4d99a6 100644 --- a/keystore/java/android/security/keystore/KeyStoreCryptoOperation.java +++ b/keystore/java/android/security/keystore/KeyStoreCryptoOperation.java @@ -16,18 +16,16 @@ package android.security.keystore; -import android.security.KeyStore; - /** - * Cryptographic operation backed by {@link KeyStore}. + * Cryptographic operation backed by Android KeyStore. * * @hide */ public interface KeyStoreCryptoOperation { /** - * Gets the KeyStore operation handle of this crypto operation. + * Gets the Android KeyStore operation handle of this crypto operation. * - * @return handle or {@code 0} if the KeyStore operation is not in progress. + * @return handle or {@code 0} if the Android KeyStore operation is not in progress. */ long getOperationHandle(); } diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyFactorySpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyFactorySpi.java index a8dd7f3f8b14..8eca67f090d4 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreKeyFactorySpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreKeyFactorySpi.java @@ -16,7 +16,6 @@ package android.security.keystore2; -import android.security.KeyStore; import android.security.keystore.KeyGenParameterSpec; import android.security.keystore.KeyInfo; @@ -39,8 +38,6 @@ import java.security.spec.X509EncodedKeySpec; */ public class AndroidKeyStoreKeyFactorySpi extends KeyFactorySpi { - private final KeyStore mKeyStore = KeyStore.getInstance(); - @Override protected <T extends KeySpec> T engineGetKeySpec(Key key, Class<T> keySpecClass) throws InvalidKeySpecException { diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java b/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java index d204f13d4d78..99100de12684 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreProvider.java @@ -17,7 +17,6 @@ package android.security.keystore2; import android.annotation.NonNull; -import android.security.KeyStore; import android.security.KeyStore2; import android.security.KeyStoreSecurityLevel; import android.security.keymaster.KeymasterDefs; @@ -161,13 +160,13 @@ public class AndroidKeyStoreProvider extends Provider { } /** - * Gets the {@link KeyStore} operation handle corresponding to the provided JCA crypto + * Gets the Android KeyStore operation handle corresponding to the provided JCA crypto * primitive. * * <p>The following primitives are supported: {@link Cipher}, {@link Signature} and {@link Mac}. * - * @return KeyStore operation handle or {@code 0} if the provided primitive's KeyStore operation - * is not in progress. + * @return Android KeyStore operation handle or {@code 0} if the provided primitive's Android + * KeyStore operation is not in progress. * * @throws IllegalArgumentException if the provided primitive is not supported or is not backed * by AndroidKeyStore provider. diff --git a/keystore/java/android/security/keystore2/AndroidKeyStoreSecretKeyFactorySpi.java b/keystore/java/android/security/keystore2/AndroidKeyStoreSecretKeyFactorySpi.java index 2682eb657963..22230916b084 100644 --- a/keystore/java/android/security/keystore2/AndroidKeyStoreSecretKeyFactorySpi.java +++ b/keystore/java/android/security/keystore2/AndroidKeyStoreSecretKeyFactorySpi.java @@ -18,7 +18,6 @@ package android.security.keystore2; import android.annotation.NonNull; import android.security.GateKeeper; -import android.security.KeyStore; import android.security.keymaster.KeymasterArguments; import android.security.keymaster.KeymasterDefs; import android.security.keystore.KeyGenParameterSpec; @@ -46,8 +45,6 @@ import javax.crypto.spec.SecretKeySpec; */ public class AndroidKeyStoreSecretKeyFactorySpi extends SecretKeyFactorySpi { - private final KeyStore mKeyStore = KeyStore.getInstance(); - @Override protected KeySpec engineGetKeySpec(SecretKey key, @SuppressWarnings("rawtypes") Class keySpecClass) throws InvalidKeySpecException { diff --git a/keystore/java/android/security/keystore2/KeyStoreCryptoOperationStreamer.java b/keystore/java/android/security/keystore2/KeyStoreCryptoOperationStreamer.java index 07d6a69eda01..5bd98bce9f39 100644 --- a/keystore/java/android/security/keystore2/KeyStoreCryptoOperationStreamer.java +++ b/keystore/java/android/security/keystore2/KeyStoreCryptoOperationStreamer.java @@ -16,12 +16,11 @@ package android.security.keystore2; -import android.security.KeyStore; import android.security.KeyStoreException; /** - * Helper for streaming a crypto operation's input and output via {@link KeyStore} service's - * {@code update} and {@code finish} operations. + * Helper for streaming a crypto operation's input and output via KeyStore service's {@code update} + * and {@code finish} operations. * * <p>The helper abstracts away to issues that need to be solved in most code that uses KeyStore's * update and finish operations. Firstly, KeyStore's update operation can consume only a limited diff --git a/services/core/java/com/android/server/locksettings/LockSettingsService.java b/services/core/java/com/android/server/locksettings/LockSettingsService.java index 939423f27c3c..a9a9d87bfaf7 100644 --- a/services/core/java/com/android/server/locksettings/LockSettingsService.java +++ b/services/core/java/com/android/server/locksettings/LockSettingsService.java @@ -104,7 +104,6 @@ import android.provider.DeviceConfig; import android.provider.Settings; import android.security.AndroidKeyStoreMaintenance; import android.security.Authorization; -import android.security.KeyStore; import android.security.keystore.KeyProperties; import android.security.keystore.KeyProtection; import android.security.keystore.recovery.KeyChainProtectionParams; @@ -165,6 +164,7 @@ import java.io.PrintWriter; import java.security.GeneralSecurityException; import java.security.InvalidAlgorithmParameterException; import java.security.InvalidKeyException; +import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.security.SecureRandom; @@ -288,7 +288,7 @@ public class LockSettingsService extends ILockSettings.Stub { private final IActivityManager mActivityManager; private final SyntheticPasswordManager mSpManager; - private final java.security.KeyStore mJavaKeyStore; + private final KeyStore mKeyStore; private final RecoverableKeyStoreManager mRecoverableKeyStoreManager; private final UnifiedProfilePasswordCache mUnifiedProfilePasswordCache; @@ -560,10 +560,6 @@ public class LockSettingsService extends ILockSettings.Stub { return DeviceStateCache.getInstance(); } - public KeyStore getKeyStore() { - return KeyStore.getInstance(); - } - public RecoverableKeyStoreManager getRecoverableKeyStoreManager() { return RecoverableKeyStoreManager.getInstance(mContext); } @@ -615,9 +611,9 @@ public class LockSettingsService extends ILockSettings.Stub { return (BiometricManager) mContext.getSystemService(Context.BIOMETRIC_SERVICE); } - public java.security.KeyStore getJavaKeyStore() { + public KeyStore getKeyStore() { try { - java.security.KeyStore ks = java.security.KeyStore.getInstance( + KeyStore ks = KeyStore.getInstance( SyntheticPasswordCrypto.androidKeystoreProviderName()); ks.load(new AndroidKeyStoreLoadStoreParameter( SyntheticPasswordCrypto.keyNamespace())); @@ -627,8 +623,7 @@ public class LockSettingsService extends ILockSettings.Stub { } } - public @NonNull UnifiedProfilePasswordCache getUnifiedProfilePasswordCache( - java.security.KeyStore ks) { + public @NonNull UnifiedProfilePasswordCache getUnifiedProfilePasswordCache(KeyStore ks) { return new UnifiedProfilePasswordCache(ks); } @@ -650,7 +645,7 @@ public class LockSettingsService extends ILockSettings.Stub { protected LockSettingsService(Injector injector) { mInjector = injector; mContext = injector.getContext(); - mJavaKeyStore = injector.getJavaKeyStore(); + mKeyStore = injector.getKeyStore(); mRecoverableKeyStoreManager = injector.getRecoverableKeyStoreManager(); mHandler = injector.getHandler(injector.getServiceThread()); mStrongAuth = injector.getStrongAuth(); @@ -672,7 +667,7 @@ public class LockSettingsService extends ILockSettings.Stub { mGatekeeperPasswords = new LongSparseArray<>(); mSpManager = injector.getSyntheticPasswordManager(mStorage); - mUnifiedProfilePasswordCache = injector.getUnifiedProfilePasswordCache(mJavaKeyStore); + mUnifiedProfilePasswordCache = injector.getUnifiedProfilePasswordCache(mKeyStore); mBiometricDeferredQueue = new BiometricDeferredQueue(mSpManager, mHandler); mRebootEscrowManager = injector.getRebootEscrowManager(new RebootEscrowCallbacks(), @@ -1457,7 +1452,7 @@ public class LockSettingsService extends ILockSettings.Stub { byte[] encryptedPassword = Arrays.copyOfRange(storedData, PROFILE_KEY_IV_SIZE, storedData.length); byte[] decryptionResult; - SecretKey decryptionKey = (SecretKey) mJavaKeyStore.getKey( + SecretKey decryptionKey = (SecretKey) mKeyStore.getKey( PROFILE_KEY_NAME_DECRYPT + userId, null); Cipher cipher = Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/" @@ -2051,16 +2046,16 @@ public class LockSettingsService extends ILockSettings.Stub { keyGenerator.init(new SecureRandom()); SecretKey secretKey = keyGenerator.generateKey(); try { - mJavaKeyStore.setEntry( + mKeyStore.setEntry( PROFILE_KEY_NAME_ENCRYPT + profileUserId, - new java.security.KeyStore.SecretKeyEntry(secretKey), + new KeyStore.SecretKeyEntry(secretKey), new KeyProtection.Builder(KeyProperties.PURPOSE_ENCRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .build()); - mJavaKeyStore.setEntry( + mKeyStore.setEntry( PROFILE_KEY_NAME_DECRYPT + profileUserId, - new java.security.KeyStore.SecretKeyEntry(secretKey), + new KeyStore.SecretKeyEntry(secretKey), new KeyProtection.Builder(KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) @@ -2069,7 +2064,7 @@ public class LockSettingsService extends ILockSettings.Stub { .setUserAuthenticationValidityDurationSeconds(30) .build()); // Key imported, obtain a reference to it. - SecretKey keyStoreEncryptionKey = (SecretKey) mJavaKeyStore.getKey( + SecretKey keyStoreEncryptionKey = (SecretKey) mKeyStore.getKey( PROFILE_KEY_NAME_ENCRYPT + profileUserId, null); Cipher cipher = Cipher.getInstance( KeyProperties.KEY_ALGORITHM_AES + "/" + KeyProperties.BLOCK_MODE_GCM + "/" @@ -2079,7 +2074,7 @@ public class LockSettingsService extends ILockSettings.Stub { iv = cipher.getIV(); } finally { // The original key can now be discarded. - mJavaKeyStore.deleteEntry(PROFILE_KEY_NAME_ENCRYPT + profileUserId); + mKeyStore.deleteEntry(PROFILE_KEY_NAME_ENCRYPT + profileUserId); } } catch (UnrecoverableKeyException | BadPaddingException | IllegalBlockSizeException | KeyStoreException @@ -2526,11 +2521,10 @@ public class LockSettingsService extends ILockSettings.Stub { final String encryptAlias = PROFILE_KEY_NAME_ENCRYPT + targetUserId; final String decryptAlias = PROFILE_KEY_NAME_DECRYPT + targetUserId; try { - if (mJavaKeyStore.containsAlias(encryptAlias) || - mJavaKeyStore.containsAlias(decryptAlias)) { + if (mKeyStore.containsAlias(encryptAlias) || mKeyStore.containsAlias(decryptAlias)) { Slogf.i(TAG, "Removing keystore profile key for user %d", targetUserId); - mJavaKeyStore.deleteEntry(encryptAlias); - mJavaKeyStore.deleteEntry(decryptAlias); + mKeyStore.deleteEntry(encryptAlias); + mKeyStore.deleteEntry(decryptAlias); } } catch (KeyStoreException e) { // We have tried our best to remove the key. @@ -3408,7 +3402,7 @@ public class LockSettingsService extends ILockSettings.Stub { private void dumpKeystoreKeys(IndentingPrintWriter pw) { try { - final Enumeration<String> aliases = mJavaKeyStore.aliases(); + final Enumeration<String> aliases = mKeyStore.aliases(); while (aliases.hasMoreElements()) { pw.println(aliases.nextElement()); } diff --git a/services/tests/servicestests/src/com/android/server/locksettings/BaseLockSettingsServiceTests.java b/services/tests/servicestests/src/com/android/server/locksettings/BaseLockSettingsServiceTests.java index 6986cab72f56..87b007c4fdff 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/BaseLockSettingsServiceTests.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/BaseLockSettingsServiceTests.java @@ -48,7 +48,6 @@ import android.os.UserManager; import android.os.storage.IStorageManager; import android.os.storage.StorageManager; import android.provider.Settings; -import android.security.KeyStore; import androidx.test.InstrumentationRegistry; import androidx.test.runner.AndroidJUnit4; @@ -102,7 +101,6 @@ public abstract class BaseLockSettingsServiceTests { IActivityManager mActivityManager; DevicePolicyManager mDevicePolicyManager; DevicePolicyManagerInternal mDevicePolicyManagerInternal; - KeyStore mKeyStore; MockSyntheticPasswordManager mSpManager; IAuthSecret mAuthSecretService; WindowManagerInternal mMockWindowManager; @@ -165,7 +163,6 @@ public abstract class BaseLockSettingsServiceTests { new LockSettingsServiceTestable.MockInjector( mContext, mStorage, - mKeyStore, mActivityManager, setUpStorageManagerMock(), mSpManager, diff --git a/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTestable.java b/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTestable.java index ee076c6bcf4b..865a4f1b48dd 100644 --- a/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTestable.java +++ b/services/tests/servicestests/src/com/android/server/locksettings/LockSettingsServiceTestable.java @@ -28,7 +28,6 @@ import android.os.Parcel; import android.os.Process; import android.os.RemoteException; import android.os.storage.IStorageManager; -import android.security.KeyStore; import android.security.keystore.KeyPermanentlyInvalidatedException; import android.service.gatekeeper.IGateKeeperService; @@ -39,13 +38,13 @@ import com.android.server.locksettings.recoverablekeystore.RecoverableKeyStoreMa import com.android.server.pm.UserManagerInternal; import java.io.FileNotFoundException; +import java.security.KeyStore; public class LockSettingsServiceTestable extends LockSettingsService { public static class MockInjector extends LockSettingsService.Injector { private LockSettingsStorage mLockSettingsStorage; - private KeyStore mKeyStore; private IActivityManager mActivityManager; private IStorageManager mStorageManager; private SyntheticPasswordManager mSpManager; @@ -57,14 +56,13 @@ public class LockSettingsServiceTestable extends LockSettingsService { public boolean mIsHeadlessSystemUserMode = false; public boolean mIsMainUserPermanentAdmin = false; - public MockInjector(Context context, LockSettingsStorage storage, KeyStore keyStore, - IActivityManager activityManager, - IStorageManager storageManager, SyntheticPasswordManager spManager, - FakeGsiService gsiService, RecoverableKeyStoreManager recoverableKeyStoreManager, + public MockInjector(Context context, LockSettingsStorage storage, + IActivityManager activityManager, IStorageManager storageManager, + SyntheticPasswordManager spManager, FakeGsiService gsiService, + RecoverableKeyStoreManager recoverableKeyStoreManager, UserManagerInternal userManagerInternal, DeviceStateCache deviceStateCache) { super(context); mLockSettingsStorage = storage; - mKeyStore = keyStore; mActivityManager = activityManager; mStorageManager = storageManager; mSpManager = spManager; @@ -105,11 +103,6 @@ public class LockSettingsServiceTestable extends LockSettingsService { } @Override - public KeyStore getKeyStore() { - return mKeyStore; - } - - @Override public IStorageManager getStorageManager() { return mStorageManager; } @@ -140,8 +133,7 @@ public class LockSettingsServiceTestable extends LockSettingsService { } @Override - public UnifiedProfilePasswordCache getUnifiedProfilePasswordCache( - java.security.KeyStore ks) { + public UnifiedProfilePasswordCache getUnifiedProfilePasswordCache(KeyStore ks) { return mock(UnifiedProfilePasswordCache.class); } |