From 49763cdca771ace246087cb1a74e31b9ab2f6cc6 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Wed, 20 May 2026 03:58:53 +0100 Subject: [PATCH] fix: harden software gen symmetric branch errors doSoftwareKeyGen's symmetric branch (AES/HMAC/3DES) previously did two things wrong: 1. It accepted attestationKey != null silently and then ignored the reference: the symmetric path never consults attestationKey, so a caller asking for BYO on a symmetric key would have received a key with no certificate chain and no signal that BYO was dropped. Reject early with KEYMINT_INVALID_ARGUMENT matching real KeyMint HAL behavior. 2. The unsupported-algorithm path (e.g. 3DES, which has no JCA mapping in this branch) threw SECURE_HW_COMMUNICATION_FAILED (-49), the same numeric code InterceptorUtils labels as Error::Km(UNSUPPORTED_TAG). That confuses diagnosis since -49 is exactly the symptom the BYO fix series was just chasing. Use KEYMINT_INVALID_ARGUMENT (-38) which is what real KeyMint returns for unsupported algorithms in this context. Surfaced by adversarial audit of f384871's broadened forceGenerate gate, which now routes any attestationKey != null to software unconditionally. --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 1c0e973..e65a830 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -536,11 +536,17 @@ class KeyMintSecurityLevelInterceptor( parsedParams.algorithm != Algorithm.RSA if (isSymmetric) { + if (attestationKey != null) { + throw android.os.ServiceSpecificException( + KEYMINT_INVALID_ARGUMENT, + "ATTEST_KEY tag is not supported for symmetric algorithms (algo=${parsedParams.algorithm})", + ) + } val algoName = when (parsedParams.algorithm) { Algorithm.AES -> "AES" Algorithm.HMAC -> "HmacSHA256" else -> throw android.os.ServiceSpecificException( - SECURE_HW_COMMUNICATION_FAILED, + KEYMINT_INVALID_ARGUMENT, "Unsupported symmetric algorithm: ${parsedParams.algorithm}", ) }