jzy/TEESimulator-RS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden software gen symmetric branch errors

Browse Source 
doSoftwareKeyGen's symmetric branch (AES/HMAC/3DES) previously did
two things wrong:

1. It accepted attestationKey != null silently and then ignored the
   reference: the symmetric path never consults attestationKey, so a
   caller asking for BYO on a symmetric key would have received a key
   with no certificate chain and no signal that BYO was dropped.
   Reject early with KEYMINT_INVALID_ARGUMENT matching real KeyMint
   HAL behavior.

2. The unsupported-algorithm path (e.g. 3DES, which has no JCA
   mapping in this branch) threw SECURE_HW_COMMUNICATION_FAILED
   (-49), the same numeric code InterceptorUtils labels as
   Error::Km(UNSUPPORTED_TAG). That confuses diagnosis since -49 is
   exactly the symptom the BYO fix series was just chasing. Use
   KEYMINT_INVALID_ARGUMENT (-38) which is what real KeyMint returns
   for unsupported algorithms in this context.

Surfaced by adversarial audit of 66a8c7f's broadened forceGenerate
gate, which now routes any attestationKey != null to software
unconditionally.
This commit is contained in:
Enginex0
2026-05-20 03:58:53 +01:00
parent 240728f98d
commit 684542f4b1
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+7 -1
View File
@@ -536,11 +536,17 @@ class KeyMintSecurityLevelInterceptor(
parsedParams.algorithm != Algorithm.RSA parsedParams.algorithm != Algorithm.RSA
if (isSymmetric) { if (isSymmetric) {
if (attestationKey != null) {
throw android.os.ServiceSpecificException(
KEYMINT_INVALID_ARGUMENT,
"ATTEST_KEY tag is not supported for symmetric algorithms (algo=${parsedParams.algorithm})",
)
}
val algoName = when (parsedParams.algorithm) { val algoName = when (parsedParams.algorithm) {
Algorithm.AES -> "AES" Algorithm.AES -> "AES"
Algorithm.HMAC -> "HmacSHA256" Algorithm.HMAC -> "HmacSHA256"
else -> throw android.os.ServiceSpecificException( else -> throw android.os.ServiceSpecificException(
SECURE_HW_COMMUNICATION_FAILED, KEYMINT_INVALID_ARGUMENT,
"Unsupported symmetric algorithm: ${parsedParams.algorithm}", "Unsupported symmetric algorithm: ${parsedParams.algorithm}",
) )
} }