jzy/TEESimulator-RS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(keystore): evict stale cached key on regen

Browse Source 
keystore2 replaces a key when generateKey reuses an alias. Mirror that:
drop any cached chain for the alias so a later getKeyEntry serves the
current key, not a stale FORGE from a prior generation (an
attest-key-mode leaf cached, then re-generated without an attest key).
This commit is contained in:
Enginex0
2026-06-17 14:54:22 +01:00
parent fbee59688d
commit 0b67700763
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+6
View File
@@ -704,6 +704,12 @@ class KeyMintSecurityLevelInterceptor(
val keyId = KeyIdentifier(callingUid, keyDescriptor.alias) val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
// keystore2 generateKey replaces an existing alias; drop any cached chain from a
// prior generation on it so a later getKeyEntry serves THIS key, never a stale
// FORGE (an attest-key-mode leaf cached, then re-generated without an attest key,
// otherwise resurfaces and breaks the app's reassembled chain).
if (generatedKeys.containsKey(keyId)) cleanupKeyData(keyId)
// Device-ID attestation must be forged, not patched: the real TEE returns // Device-ID attestation must be forged, not patched: the real TEE returns
// CANNOT_ATTEST_IDS, so there is no real chain to patch — only a synthetic one // CANNOT_ATTEST_IDS, so there is no real chain to patch — only a synthetic one
// carrying the requested IDs and rooted under the keybox will satisfy the caller. // carrying the requested IDs and rooted under the keybox will satisfy the caller.