fix(keygen): forward symmetric algorithms to HAL and add missing JCA mappings

Symmetric keys (AES/HMAC/3DES) don't have KeyPairs or attestation
certs — routing them through doSoftwareKeyGen crashes with
"Unsupported algorithm: 32". Skip the software path entirely and
let the real HAL handle them.

Also adds CTR block mode, RSA_PKCS1_1_5_SIGN cipher padding, and
RSA_PSS signature padding to JcaAlgorithmMapper.

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -286,6 +286,15 @@ class KeyMintSecurityLevelInterceptor(
                     return InterceptorUtils.createErrorReply(KEYMINT_CANNOT_ATTEST_IDS)
                 }
 
+                val isSymmetric = parsedParams.algorithm == Algorithm.AES ||
+                    parsedParams.algorithm == Algorithm.HMAC ||
+                    parsedParams.algorithm == Algorithm.TRIPLE_DES
+
+                if (isSymmetric) {
+                    SystemLogger.debug("[TX_ID: $txId] Symmetric algorithm ${parsedParams.algorithm} → forwarding to HAL")
+                    return TransactionResult.ContinueAndSkipPost
+                }
+
                 val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
                 val isAttestKeyRequest = parsedParams.isAttestKey()
 

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt

@@ -34,16 +34,17 @@ private object JcaAlgorithmMapper {
                 Digest.SHA_2_512 -> "SHA512"
                 else -> "NONE"
             }
-        val keyAlgo =
-            when (params.algorithm) {
-                Algorithm.EC -> "ECDSA"
-                Algorithm.RSA -> "RSA"
-                else ->
-                    throw IllegalArgumentException(
-                        "Unsupported signature algorithm: ${params.algorithm}"
-                    )
+        return when (params.algorithm) {
+            Algorithm.EC -> "${digest}withECDSA"
+            Algorithm.RSA -> {
+                val isPss = params.padding.firstOrNull() == PaddingMode.RSA_PSS
+                if (isPss) "${digest}withRSA/PSS" else "${digest}withRSA"
             }
-        return "${digest}with${keyAlgo}"
+            else ->
+                throw IllegalArgumentException(
+                    "Unsupported signature algorithm: ${params.algorithm}"
+                )
+        }
     }
 
     fun mapCipherAlgorithm(params: KeyMintAttestation): String {
@@ -60,16 +61,18 @@ private object JcaAlgorithmMapper {
             when (params.blockMode.firstOrNull()) {
                 BlockMode.ECB -> "ECB"
                 BlockMode.CBC -> "CBC"
+                BlockMode.CTR -> "CTR"
                 BlockMode.GCM -> "GCM"
-                else -> "ECB" // Default for RSA
+                else -> "ECB"
             }
         val padding =
             when (params.padding.firstOrNull()) {
                 PaddingMode.NONE -> "NoPadding"
                 PaddingMode.PKCS7 -> "PKCS7Padding"
                 PaddingMode.RSA_PKCS1_1_5_ENCRYPT -> "PKCS1Padding"
+                PaddingMode.RSA_PKCS1_1_5_SIGN -> "PKCS1Padding"
                 PaddingMode.RSA_OAEP -> "OAEPPadding"
-                else -> "NoPadding" // Default for GCM
+                else -> "NoPadding"
             }
         return "$keyAlgo/$blockMode/$padding"
     }