Skip to content

Commit d97435e

Browse files
mdwivedimdwivedi
authored
Merge pull request #3 from BKSSMVenkateswarlu/remove_public_operations
Remove public operations
2 parents 9b75c62 + 5809a2d commit d97435e

10 files changed

Lines changed: 377 additions & 382 deletions

File tree

‎Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMAndroidSEProvider.java‎

Lines changed: 5 additions & 85 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,8 @@
4040
import com.android.javacard.keymaster.KMAESKey;
4141
import com.android.javacard.keymaster.KMAttestationKey;
4242
import com.android.javacard.keymaster.KMECPrivateKey;
43+
import com.android.javacard.keymaster.KMError;
44+
import com.android.javacard.keymaster.KMException;
4345
import com.android.javacard.keymaster.KMHmacKey;
4446
import com.android.javacard.keymaster.KMMasterKey;
4547
import com.android.javacard.keymaster.KMPreSharedKey;
@@ -1018,51 +1020,6 @@ public Signature createRsaSigner(short digest, short padding, byte[] secret,
10181020
return rsaSigner;
10191021
}
10201022

1021-
public Signature createRsaVerifier(short digest, short padding,
1022-
byte[] modBuffer, short modOff, short modLength) {
1023-
try {
1024-
byte alg = mapSignature256Alg(KMType.RSA, (byte) padding, (byte) digest);
1025-
if (digest == KMType.DIGEST_NONE || padding == KMType.PADDING_NONE)
1026-
CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
1027-
1028-
Signature rsaVerifier = getSignatureInstanceFromPool(alg);
1029-
RSAPublicKey key = (RSAPublicKey) rsaKeyPair.getPublic();
1030-
// setExponent
1031-
Util.setShort(tmpArray, (short) 0, (short) 0x0001);
1032-
Util.setShort(tmpArray, (short) 2, (short) 0x0001);
1033-
key.setExponent(tmpArray, (short) 0, (short) 4);
1034-
key.setModulus(modBuffer, modOff, modLength);
1035-
rsaVerifier.init(key, Signature.MODE_VERIFY);
1036-
return rsaVerifier;
1037-
} finally {
1038-
clean();
1039-
}
1040-
}
1041-
1042-
public Cipher createRsaCipher(short padding, short digest, byte[] modBuffer,
1043-
short modOff, short modLength) {
1044-
try {
1045-
byte cipherAlg = mapCipherAlg(KMType.RSA, (byte) padding, (byte) 0, (byte)digest);
1046-
// Java Card does not support MGF1-SHA1 and digest as SHA256.
1047-
// Both digest should be SHA256 as per Java Card, but as per Keymaster
1048-
// MGF should use SHA1 and message digest should be SHA256.
1049-
if (cipherAlg == Cipher.ALG_RSA_PKCS1_OAEP) {
1050-
KMException.throwIt(KMError.UNIMPLEMENTED);
1051-
}
1052-
Cipher rsaCipher = getCipherInstanceFromPool(cipherAlg);
1053-
RSAPublicKey key = (RSAPublicKey) rsaKeyPair.getPublic();
1054-
// setExponent
1055-
Util.setShort(tmpArray, (short) 0, (short) 0x0001);
1056-
Util.setShort(tmpArray, (short) 2, (short) 0x0001);
1057-
key.setExponent(tmpArray, (short) 0, (short) 4);
1058-
key.setModulus(modBuffer, modOff, modLength);
1059-
rsaCipher.init(key, Cipher.MODE_ENCRYPT);
1060-
return rsaCipher;
1061-
} finally {
1062-
clean();
1063-
}
1064-
}
1065-
10661023
public Cipher createRsaDecipher(short padding, short digest, byte[] secret,
10671024
short secretStart, short secretLength, byte[] modBuffer, short modOff,
10681025
short modLength) {
@@ -1086,17 +1043,6 @@ public Signature createEcSigner(short digest, byte[] secret,
10861043
return ecSigner;
10871044
}
10881045

1089-
public Signature createEcVerifier(short digest, byte[] pubKey,
1090-
short pubKeyStart, short pubKeyLength) {
1091-
byte alg = mapSignature256Alg(KMType.EC, (byte) 0, (byte) digest);
1092-
Signature ecVerifier = null;
1093-
ECPublicKey key = (ECPublicKey) ecKeyPair.getPublic();
1094-
key.setW(pubKey, pubKeyStart, pubKeyLength);
1095-
ecVerifier = getSignatureInstanceFromPool(alg);
1096-
ecVerifier.init(key, Signature.MODE_VERIFY);
1097-
return ecVerifier;
1098-
}
1099-
11001046
@Override
11011047
public KMOperation initAsymmetricOperation(byte purpose, byte alg,
11021048
byte padding, byte digest, byte[] privKeyBuf, short privKeyStart,
@@ -1116,28 +1062,6 @@ public KMOperation initAsymmetricOperation(byte purpose, byte alg,
11161062
opr.setMode(purpose);
11171063
JCSystem.commitTransaction();
11181064
break;
1119-
case KMType.VERIFY:
1120-
Signature verifier = createRsaVerifier(digest, padding, pubModBuf,
1121-
pubModStart, pubModLength);
1122-
opr = getOperationInstanceFromPool();
1123-
JCSystem.beginTransaction();
1124-
opr.setSignature(verifier);
1125-
opr.setCipherAlgorithm(alg);
1126-
opr.setPaddingAlgorithm(padding);
1127-
opr.setMode(purpose);
1128-
JCSystem.commitTransaction();
1129-
break;
1130-
case KMType.ENCRYPT:
1131-
Cipher cipher = createRsaCipher(padding, digest, pubModBuf,
1132-
pubModStart, pubModLength);
1133-
opr = getOperationInstanceFromPool();
1134-
JCSystem.beginTransaction();
1135-
opr.setCipher(cipher);
1136-
opr.setCipherAlgorithm(alg);
1137-
opr.setPaddingAlgorithm(padding);
1138-
opr.setMode(purpose);
1139-
JCSystem.commitTransaction();
1140-
break;
11411065
case KMType.DECRYPT:
11421066
Cipher decipher = createRsaDecipher(padding, digest, privKeyBuf,
11431067
privKeyStart, privKeyLength, pubModBuf, pubModStart, pubModLength);
@@ -1150,6 +1074,7 @@ public KMOperation initAsymmetricOperation(byte purpose, byte alg,
11501074
JCSystem.commitTransaction();
11511075
break;
11521076
default:
1077+
KMException.throwIt(KMError.UNSUPPORTED_PURPOSE);
11531078
break;
11541079
}
11551080
} else if (alg == KMType.EC) {
@@ -1162,13 +1087,8 @@ public KMOperation initAsymmetricOperation(byte purpose, byte alg,
11621087
opr.setSignature(signer);
11631088
JCSystem.commitTransaction();
11641089
break;
1165-
case KMType.VERIFY:
1166-
Signature verifier = createEcVerifier(digest, pubModBuf, pubModStart,
1167-
pubModLength);
1168-
opr = getOperationInstanceFromPool();
1169-
JCSystem.beginTransaction();
1170-
opr.setSignature(verifier);
1171-
JCSystem.commitTransaction();
1090+
default:
1091+
KMException.throwIt(KMError.UNSUPPORTED_PURPOSE);
11721092
break;
11731093
}
11741094
} else {

‎Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMEcdsa256NoDigestSignature.java‎

Lines changed: 4 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -112,28 +112,14 @@ public short signPreComputedHash(byte[] bytes, short i, short i1,
112112
@Override
113113
public boolean verify(byte[] bytes, short i, short i1, byte[] bytes1,
114114
short i2, short i3) throws CryptoException {
115-
try {
116-
if (i1 > MAX_NO_DIGEST_MSG_LEN)
117-
CryptoException.throwIt(CryptoException.ILLEGAL_USE);
118-
// add zeros to the left
119-
if (i1 < MAX_NO_DIGEST_MSG_LEN) {
120-
Util.arrayFillNonAtomic(KMAndroidSEProvider.getInstance().tmpArray,
121-
(short) 0, (short) MAX_NO_DIGEST_MSG_LEN, (byte) 0);
122-
}
123-
Util.arrayCopyNonAtomic(bytes, i,
124-
KMAndroidSEProvider.getInstance().tmpArray,
125-
(short) (MAX_NO_DIGEST_MSG_LEN - i1), i1);
126-
return inst.verifyPreComputedHash(
127-
KMAndroidSEProvider.getInstance().tmpArray, (short) 0,
128-
(short) MAX_NO_DIGEST_MSG_LEN, bytes1, i2, i3);
129-
} finally {
130-
KMAndroidSEProvider.getInstance().clean();
131-
}
115+
//Verification is handled inside HAL
116+
return false;
132117
}
133118

134119
@Override
135120
public boolean verifyPreComputedHash(byte[] bytes, short i, short i1,
136121
byte[] bytes1, short i2, short i3) throws CryptoException {
137-
return inst.verify(bytes, i, i1, bytes1, i2, i3);
122+
//Verification is handled inside HAL
123+
return false;
138124
}
139125
}

‎Applet/AndroidSEProvider/src/com/android/javacard/keymaster/KMOperationImpl.java‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -125,19 +125,6 @@ public short finish(byte[] inputDataBuf, short inputDataStart,
125125
if (mode == KMType.DECRYPT) {
126126
inputDataLen = (short) (inputDataLen - macLength);
127127
}
128-
} else if (cipherAlg == KMType.RSA && padding == KMType.PADDING_NONE &&
129-
mode == KMType.ENCRYPT) {
130-
// Length cannot be greater then key size according to Java Card
131-
if (inputDataLen > 256)
132-
KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
133-
// make input equal to 255 bytes
134-
Util.arrayFillNonAtomic(tmpArray, (short) 0, (short) 256, (byte) 0);
135-
Util.arrayCopyNonAtomic(inputDataBuf, inputDataStart, tmpArray,
136-
(short) (256 - inputDataLen), inputDataLen);
137-
inputDataStart = 0;
138-
inputDataLen = 256;
139-
inputDataBuf = tmpArray;
140-
141128
} else if ((cipherAlg == KMType.DES || cipherAlg == KMType.AES) &&
142129
padding == KMType.PKCS7 && mode == KMType.ENCRYPT) {
143130
byte blkSize = 16;

‎Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMCipherImpl.java‎

Lines changed: 1 addition & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -81,21 +81,7 @@ public short doFinal(byte[] buffer, short startOff, short length, byte[] scratch
8181
CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
8282
}
8383
} else{
84-
if(cipherAlg == KMType.RSA && padding == KMType.PADDING_NONE && mode == KMType.ENCRYPT ){
85-
// Length cannot be greater then key size according to JcardSim
86-
if(length >= 256) KMException.throwIt(KMError.INVALID_INPUT_LENGTH);
87-
// make input equal to 255 bytes
88-
byte[] tmp = new byte[255];
89-
Util.arrayFillNonAtomic(tmp,(short)0,(short)255, (byte)0);
90-
Util.arrayCopyNonAtomic(
91-
buffer,
92-
startOff,
93-
tmp, (short)(255 - length),length);
94-
startOff = 0;
95-
length = 255;
96-
buffer = tmp;
97-
98-
}else if((cipherAlg == KMType.DES || cipherAlg == KMType.AES) && padding ==KMType.PKCS7 && mode == KMType.ENCRYPT){
84+
if((cipherAlg == KMType.DES || cipherAlg == KMType.AES) && padding ==KMType.PKCS7 && mode == KMType.ENCRYPT){
9985
byte blkSize = 16;
10086
byte paddingBytes;
10187
short len = length;

‎Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMEcdsa256NoDigestSignature.java‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -173,14 +173,7 @@ public short signPreComputedHash(byte[] bytes, short i, short i1, byte[] bytes1,
173173

174174
@Override
175175
public boolean verify(byte[] bytes, short i, short i1, byte[] bytes1, short i2, short i3) throws CryptoException {
176-
// Cannot support this method as javacard cipher api does not allow 256 byte for public key
177-
// encryption without padding. It only allows 255 bytes data.
178-
try {
179-
update(bytes, i , i1);
180-
return sunSigner.verify(bytes1, i2, i3);
181-
} catch (SignatureException e) {
182-
CryptoException.throwIt(CryptoException.ILLEGAL_VALUE);
183-
}
176+
// Public key operations not handled here.
184177
return false;
185178
}
186179

‎Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMJCardSimulator.java‎

Lines changed: 4 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -605,27 +605,22 @@ public KMOperation initAsymmetricOperation(byte purpose, byte alg, byte padding,
605605
pubModStart,
606606
pubModLength);
607607
return new KMOperationImpl(signer);
608-
case KMType.VERIFY:
609-
Signature verifier = createRsaVerifier(digest, padding, pubModBuf, pubModStart, pubModLength);
610-
return new KMOperationImpl(verifier);
611-
case KMType.ENCRYPT:
612-
KMCipher cipher = createRsaCipher(padding, digest, pubModBuf, pubModStart, pubModLength);
613-
return new KMOperationImpl(cipher);
614608
case KMType.DECRYPT:
615609
KMCipher decipher =
616610
createRsaDecipher(
617611
padding, digest, privKeyBuf, privKeyStart, privKeyLength, pubModBuf, pubModStart, pubModLength);
618612
return new KMOperationImpl(decipher);
613+
default:
614+
KMException.throwIt(KMError.UNSUPPORTED_PURPOSE);
619615
}
620616
}else if(alg == KMType.EC){
621617
switch(purpose){
622618
case KMType.SIGN:
623619
Signature signer =
624620
createEcSigner(digest,privKeyBuf,privKeyStart,privKeyLength);
625621
return new KMOperationImpl(signer);
626-
case KMType.VERIFY:
627-
Signature verifier = createEcVerifier(digest,pubModBuf,pubModStart,pubModLength);
628-
return new KMOperationImpl(verifier);
622+
default:
623+
KMException.throwIt(KMError.UNSUPPORTED_PURPOSE);
629624
}
630625
}
631626
CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
@@ -1110,52 +1105,6 @@ public void addRngEntropy(byte[] num, short offset, short length) {
11101105
}
11111106
}
11121107

1113-
1114-
public KMCipher createRsaCipher(short padding, short digest, byte[] modBuffer, short modOff, short modLength) {
1115-
byte cipherAlg = mapCipherAlg(KMType.RSA, (byte)padding, (byte)0);
1116-
if (cipherAlg == Cipher.ALG_RSA_PKCS1_OAEP) {
1117-
return createRsaOAEP256Cipher(KMType.ENCRYPT, (byte)digest, null,(short)0,(short)0,modBuffer,modOff,modLength);
1118-
}
1119-
Cipher rsaCipher = Cipher.getInstance(cipherAlg,false);
1120-
RSAPublicKey key = (RSAPublicKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PUBLIC, KeyBuilder.LENGTH_RSA_2048, false);
1121-
byte[] exponent = new byte[]{0x01,0x00,0x01};
1122-
key.setExponent(exponent,(short)0,(short)3);
1123-
key.setModulus(modBuffer, modOff, modLength);
1124-
rsaCipher.init(key,Cipher.MODE_ENCRYPT);
1125-
KMCipherImpl inst = new KMCipherImpl(rsaCipher);
1126-
inst.setCipherAlgorithm(KMType.RSA);
1127-
inst.setMode(KMType.ENCRYPT);
1128-
inst.setPaddingAlgorithm(padding);
1129-
return inst;
1130-
}
1131-
1132-
public Signature createRsaVerifier(short digest, short padding, byte[] modBuffer, short modOff, short modLength) {
1133-
short alg = mapSignature256Alg(KMType.RSA,(byte)padding);
1134-
if(digest == KMType.DIGEST_NONE || padding == KMType.PADDING_NONE) CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
1135-
Signature rsaVerifier = Signature.getInstance((byte)alg, false);
1136-
RSAPublicKey key = (RSAPublicKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PUBLIC, KeyBuilder.LENGTH_RSA_2048, false);
1137-
byte[] exponent = new byte[]{0x01,0x00,0x01};
1138-
key.setExponent(exponent,(short)0,(short)3);
1139-
key.setModulus(modBuffer, modOff, modLength);
1140-
rsaVerifier.init(key,Signature.MODE_VERIFY);
1141-
return rsaVerifier;
1142-
}
1143-
1144-
public Signature createEcVerifier(short digest, byte[] pubKey, short pubKeyStart, short pubKeyLength) {
1145-
short alg = mapSignature256Alg(KMType.EC, (byte)0);
1146-
Signature ecVerifier;
1147-
//if(msgDigestAlg == MessageDigest.ALG_NULL) CryptoException.throwIt(CryptoException.NO_SUCH_ALGORITHM);
1148-
if(digest == KMType.DIGEST_NONE) {
1149-
ecVerifier = new KMEcdsa256NoDigestSignature(Signature.MODE_VERIFY, pubKey, pubKeyStart, pubKeyLength);
1150-
} else {
1151-
ECPublicKey key = (ECPublicKey) KeyBuilder.buildKey(KeyBuilder.TYPE_EC_FP_PUBLIC, KeyBuilder.LENGTH_EC_FP_256, false);
1152-
key.setW(pubKey,pubKeyStart,pubKeyLength);
1153-
ecVerifier = Signature.getInstance((byte)alg,false);
1154-
ecVerifier.init(key,Signature.MODE_VERIFY);
1155-
}
1156-
return ecVerifier;
1157-
}
1158-
11591108
@Override
11601109
public KMAttestationCert getAttestationCert(boolean rsaCert) {
11611110
return KMAttestationCertImpl.instance(rsaCert);

‎Applet/JCardSimProvider/src/com/android/javacard/keymaster/KMRsa2048NoDigestSignature.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,8 +89,7 @@ public short signPreComputedHash(byte[] bytes, short i, short i1, byte[] bytes1,
8989

9090
@Override
9191
public boolean verify(byte[] bytes, short i, short i1, byte[] bytes1, short i2, short i3) throws CryptoException {
92-
// Cannot support this method as javacard cipher api does not allow 256 byte for public key
93-
// encryption without padding. It only allows 255 bytes data.
92+
// Public key operations not handled here.
9493
return false;
9594
}
9695

0 commit comments

Comments
 (0)