jzy/TEESimulator-RS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(interception): reject EC+DECRYPT in createOperation

Browse Source 
EC keys don't support DECRYPT (only AGREE_KEY for key derivation).
Without this guard, an EC DECRYPT operation creates a CipherPrimitive
that fails with a confusing JCA error instead of returning
UNSUPPORTED_PURPOSE upfront.
This commit is contained in:
Enginex0
2026-03-22 00:42:48 +01:00
parent 9a7011eb5e
commit 25dbddf733
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+2 -1
View File
@@ -328,7 +328,8 @@ class KeyMintSecurityLevelInterceptor(
(isAsymmetric &&
(requestedPurpose == KeyPurpose.VERIFY ||
requestedPurpose == KeyPurpose.ENCRYPT)) ||
(requestedPurpose == KeyPurpose.AGREE_KEY && algorithm != Algorithm.EC)
(requestedPurpose == KeyPurpose.AGREE_KEY && algorithm != Algorithm.EC) ||
(algorithm == Algorithm.EC && requestedPurpose == KeyPurpose.DECRYPT)
if (unsupported) {
return InterceptorUtils.createServiceSpecificErrorReply(
KeystoreErrorCode.UNSUPPORTED_PURPOSE