docs(release): add v4.8.1 changelog for StrongBox op rejection fix

fix(interception): enforce StrongBox op limit for software-generated keys
trackAndEnforceOpLimit was only called in the Domain.KEY_ID not-found path, so software-generated keys (found via Domain.APP) bypassed the STRONGBOX_MAX_CONCURRENT_OPS=4 limit entirely. DuckDetector's concurrent signing handles test created 24+ operations that all succeeded via LRU pruning instead of being rejected with TOO_MANY_OPERATIONS (-29).
2026-03-18 03:24:58 +01:00 · 2026-03-18 03:21:34 +01:00 · 2026-03-17 19:56:45 +01:00
2 changed files with 22 additions and 0 deletions
@@ -267,6 +267,8 @@ class KeyMintSecurityLevelInterceptor(
            }
        }

+        trackAndEnforceOpLimit(callingUid, txId)?.let { return it }
+
        SystemLogger.info("[TX_ID: $txId] Creating SOFTWARE operation for uid=$callingUid.")

        val params = data.createTypedArray(KeyParameter.CREATOR)!!
@@ -1,3 +1,23 @@
+## TEESimulator-RS v4.8.1: StrongBox Op Rejection Fix
+
+- **StrongBox op limit gate fix** — `trackAndEnforceOpLimit` was only called in the `Domain.KEY_ID` not-found path, so software-generated keys (found via `Domain.APP`) bypassed `STRONGBOX_MAX_CONCURRENT_OPS=4` entirely. DuckDetector's concurrent signing handles test created 24+ operations that all succeeded via LRU pruning instead of being rejected with `TOO_MANY_OPERATIONS (-29)`. Now enforced for all StrongBox createOperation paths.
+
+---
+
+## TEESimulator-RS v4.8: StrongBox Hardening & LRU Pruning
+
+Tested against DuckDetector on OnePlus (Android 16, KSU). Tamper score dropped from 32 to 8.
+
+- **LRU operation pruning** — Concurrent software operations capped at 15 per UID (TEE) and 4 per UID (StrongBox), with oldest-first eviction. Pruned operations return `INVALID_OPERATION_HANDLE (-28)`, matching AOSP keystore2 malus-based pruning.
+- **StrongBox param guard** — Unsupported StrongBox params (RSA >2048-bit, non-P256 EC curves) forwarded to real HAL for proper rejection instead of generating in software.
+- **StrongBox timing** — Key generation floors at 250ms, signing at 80ms on StrongBox security level to match real secure element latency.
+- **StrongBox op limit** — Sliding-window enforcer caps concurrent StrongBox operations for both software and hardware key paths, returning `TOO_MANY_OPERATIONS (-29)` when exceeded.
+- **ECDSA algorithm alias** — Accept "ECDSA" in addition to "EC" as JCA private key algorithm name. Fixes SIGSEGV crash on Android 10 devices where the provider reports EC keys as "ECDSA". Closes #4.
+- **createOperation domain handling** — Software-generated keys now found via both `Domain.APP` (alias) and `Domain.KEY_ID` (nspace) lookup paths.
+- **Permission guards** — Device ID attestation tags (IMEI, MEID, serial) require caller permission checks.
+
+---
+
 ## TEESimulator-RS v4.7: Operation & Attestation Fixes

 Tested against [KeyDetector](https://github.com/XiaoTong6666/KeyDetector) and [Key Attestation](https://github.com/nickel-lang/nickel) on OnePlus (Android 16) and Xiaomi Redmi 14C (Android 14).
Author	SHA1	Message	Date
Enginex0	03c71bd202	docs(release): add v4.8.1 changelog for StrongBox op rejection fix	2026-03-18 03:24:58 +01:00
Enginex0	7e2fc0b288	fix(interception): enforce StrongBox op limit for software-generated keys trackAndEnforceOpLimit was only called in the Domain.KEY_ID not-found path, so software-generated keys (found via Domain.APP) bypassed the STRONGBOX_MAX_CONCURRENT_OPS=4 limit entirely. DuckDetector's concurrent signing handles test created 24+ operations that all succeeded via LRU pruning instead of being rejected with TOO_MANY_OPERATIONS (-29).	2026-03-18 03:21:34 +01:00
Enginex0	258a65ba59	docs(release): add v4.8 changelog for StrongBox hardening and LRU pruning	2026-03-17 19:56:45 +01:00