Instead of always wrapping errors in a DeviceIdAttestationException,
check to see if the underlying cause was originally a
DeviceIdAttestationException. If so, unwrap the cause and just re-throw
that, preserving the original error.
Bug: 183827468
Test: GtsGmsCoreSecurityTestApp
Change-Id: Iab78ccaff91dd1de615e1d2b18f709027aecd59e
If biometric unlock is enabled, we tell keystore at lock time so that
a key can be set up in KM which unlocks UNLOCKED_DEVICE_REQUIRED keys
based on auth tokens carrying those SIDs. This also has the effect that
if there is no biometric unlock, UNLOCKED_DEVICE_REQUIRED keys have
full cryptographic protection, per NIAP requirements.
Test: aosp/1686345
Bug: 163866361
Change-Id: Ia4d01faa998c76b2b33ad3520730466ac59e6d8d
AndroidKeyStoreCipherSpiBase.engineDoFinal may get called with a null
input argument. In the case where we forward the operation to the
default provider doFinal() needs to be called instead of
doFinal(byte[], int, int).
Bug: 183913233
Test: atest android.keystore.cts.CipherTest#testEncryptsAndDecryptsUsingCipherStreams
Change-Id: Ia3afaf281be7c8e5493ac8e4155a7aa02d1d37f0
As a part of internal libcore API cleanup some of the functions
previously exposed are getting removed from public surface.
Math#randomLongInternal is a wrapper around java.util.Random and has no
specific implications so its usages are get refactored.
Bug: 154796679
Test: m droid
Change-Id: I29e0e9307fbaf9c1ac018b83014efb2d3dd74479
This namespace is required by LocksettingsService to protect the
synthetic password key from removal when the user removes the
credentials or wipes AID_SYSTEM app data.
Bug: 184664830
Test: N/A
Change-Id: Ie752a75d2cb2ebf1f4e5814bc2cbc807cc754c21
CryptoObject still called the legacy AndroidKeystoreProvider which did
not return the correct operation handle for per operation auth bound
keys.
Bug: 184804041
Bug: 185181377
Test: CtsVerifier->Security->Biometric Tests->2a Strong Biometrics +
Crypto
Merged-In: I0bceff0425e7ef32c394f33deda3c78f729c0c6c
Change-Id: I0bceff0425e7ef32c394f33deda3c78f729c0c6c
The key migration API is required by locksettingsservice to move the
synthetic password key out of AID_SYSTEM to protect it from deletion
when the user removes credentials from AID_SYSTEM.
Bug: 184664830
Test: N/A
Change-Id: I8d0ffb79870affc8ac055574b6f808a984aa5e52
All the java code used to build the framework jar and run metalava
was previously defined in the toplevel Android.bp files. Move these
into the subdirs where the source actually lives.
This simplifies the rules themselves (no path and needless prefix) and
declutters the top level Android.bp.
Test: m
Change-Id: I97086e309eacb879d16facb8497d9940fa5ddaf6
This disables throwing BackendBusyException in Android S. Instead we
keep the legacy behavior of spinning until an operation can be created.
Bug: 180133780
Test: N/A
Change-Id: I802148c59338b91e751498607fa903e156e40aa6
This change adds an AIDL interface which the RemoteProvisioner app
implements that allows the keystore SPI to inform the app when an
attestation key may have been used, and when the underlying attestation
key pool is totally empty. The former is a non-blocking call, and the
latter blocks until completion.
Since the latter involves network, there are timeouts involved on the
app side to ensure that the blocking call doesn't hang indefinitely if
there's no network.
Test: atest CtsKeystoreTestCases && atest RemoteProvisionerUnitTests
Change-Id: Ie49e37659c96ce5c1626d1b99a4a7ccc62028156
This fix properly casts the Certificate[] returned by KeyStore to an
X509Certificate.
Bug: 182825370
Test: atest GtsGmscoreHostTestCases
Change-Id: If1e7cbbe612217b92067f76f8d13d1a0002e1579
