widevine-partner/android
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sync oemcrypto files from cdm udc-dev to Android

Browse Source 
Changes included in this CL:

166806: Update OEMCrypto_GetDeviceInformation() | https://widevine-internal-review.googlesource.com/c/cdm/+/166806
166808: Update Android L3 after OEMCrypto_GetDeviceInformation() signature changes | https://widevine-internal-review.googlesource.com/c/cdm/+/166808
166809: Decode device info and write it to CSR payload | https://widevine-internal-review.googlesource.com/c/cdm/+/166809
167158: Fix Android include path and copy_files | https://widevine-internal-review.googlesource.com/c/cdm/+/167158
167159: Fix common typos and use inclusive language suggested by Android linter | https://widevine-internal-review.googlesource.com/c/cdm/+/167159

165618: Explicitly state python3 where needed. | https://widevine-internal-review.googlesource.com/c/cdm/+/165618

166757: Update Android.bp for Android | https://widevine-internal-review.googlesource.com/c/cdm/+/166757
164993: Refactor basic oemcrypto unit tests | https://widevine-internal-review.googlesource.com/c/cdm/+/164993
164978: Update OEMCrypto Unit Test Docs | https://widevine-internal-review.googlesource.com/c/cdm/+/164978
166941: Update make files for OEMCrypto | https://widevine-internal-review.googlesource.com/c/cdm/+/166941

165279: Refactor license unit tests | https://widevine-internal-review.googlesource.com/c/cdm/+/165279
165318: Refactor provisioning unit tests | https://widevine-internal-review.googlesource.com/c/cdm/+/165318
164800: Add extra check for renew on license load unit test | https://widevine-internal-review.googlesource.com/c/cdm/+/164800
165860: Remove duplicate definition of MaybeHex() | https://widevine-internal-review.googlesource.com/c/cdm/+/165860

164889: Updated CoreCommonRequestFromMessage and fix test | https://widevine-internal-review.googlesource.com/c/cdm/+/164889
164967: Add OPK pre-hook and post-hook error codes | https://widevine-internal-review.googlesource.com/c/cdm/+/164967
165140: Add hidden device_id_length to v18 provisioning message | https://widevine-internal-review.googlesource.com/c/cdm/+/165140
165204: Fix memory leak in oemcrypto test | https://widevine-internal-review.googlesource.com/c/cdm/+/165204

165958: Fix oemcrypto_generic_verify_fuzz mutator signature offset | https://widevine-internal-review.googlesource.com/c/cdm/+/165958

166037: Support SHA-256 in OEMCrypto Session Util | https://widevine-internal-review.googlesource.com/c/cdm/+/166037

Test: Run GtsMediaTests on Pixel 7
Bug: 270612144

Change-Id: Iff0820a2de7d043a820470a130af65b0dcadb759
This commit is contained in:
Cong Lin
2023-02-27 18:25:02 -08:00
parent 3f7ecbc43e
commit e8add8eed8
44 changed files with 302003 additions and 298675 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
libwvdrmengine/oemcrypto/util/include/oemcrypto_rsa_key.h
View File

@@ -122,6 +122,8 @@ class RsaPublicKey {
// private equivalent of this public key.
// The signature algorithm can be specified via the |algorithm| field.
// See RsaSignatureAlgorithm for details on each algorithm.
// For RSASSA-PSS, the hash algorithm can be specified via |hash_algorithm|.
// This parameter is ignored for other signature algorithms.
//
// Returns:
// OEMCrypto_SUCCESS if signature is valid
@@ -129,15 +131,17 @@ class RsaPublicKey {
// OEMCrypto_ERROR_UNKNOWN_FAILURE if any error occurs
OEMCryptoResult VerifySignature(
const uint8_t* message, size_t message_length, const uint8_t* signature,
size_t signature_length,
RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
size_t signature_length, RsaSignatureAlgorithm algorithm = kRsaPssDefault,
OEMCrypto_SignatureHashAlgorithm hash_algorithm = OEMCrypto_SHA1) const;
OEMCryptoResult VerifySignature(
const std::string& message, const std::string& signature,
RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
RsaSignatureAlgorithm algorithm = kRsaPssDefault,
OEMCrypto_SignatureHashAlgorithm hash_algorithm = OEMCrypto_SHA1) const;
OEMCryptoResult VerifySignature(
const std::vector<uint8_t>& message,
const std::vector<uint8_t>& signature,
RsaSignatureAlgorithm algorithm = kRsaPssDefault) const;
RsaSignatureAlgorithm algorithm = kRsaPssDefault,
OEMCrypto_SignatureHashAlgorithm hash_algorithm = OEMCrypto_SHA1) const;
// Encrypts the OEMCrypto session key used for deriving other keys.
// On success, |enc_session_key_size| is populated with the number
@@ -195,10 +199,10 @@ class RsaPublicKey {
bool InitFromSslHandle(const RSA* rsa_handle, uint32_t allowed_schemes);
// Signature specialization functions.
OEMCryptoResult VerifySignaturePss(const uint8_t* message,
size_t message_length,
const uint8_t* signature,
size_t signature_length) const;
OEMCryptoResult VerifySignaturePss(
const uint8_t* message, size_t message_length, const uint8_t* signature,
size_t signature_length,
OEMCrypto_SignatureHashAlgorithm hash_algorithm) const;
OEMCryptoResult VerifySignaturePkcs1Cast(const uint8_t* message,
size_t message_length,
const uint8_t* signature,

44
libwvdrmengine/oemcrypto/util/src/oemcrypto_rsa_key.cpp
View File

@@ -399,7 +399,8 @@ std::vector<uint8_t> RsaPublicKey::Serialize() const {
OEMCryptoResult RsaPublicKey::VerifySignature(
const uint8_t* message, size_t message_length, const uint8_t* signature,
size_t signature_length, RsaSignatureAlgorithm algorithm) const {
size_t signature_length, RsaSignatureAlgorithm algorithm,
OEMCrypto_SignatureHashAlgorithm hash_algorithm) const {
if (signature == nullptr || signature_length == 0) {
LOGE("Signature is missing");
return OEMCrypto_ERROR_INVALID_CONTEXT;
@@ -411,7 +412,7 @@ OEMCryptoResult RsaPublicKey::VerifySignature(
switch (algorithm) {
case kRsaPssDefault:
return VerifySignaturePss(message, message_length, signature,
signature_length);
signature_length, hash_algorithm);
case kRsaPkcs1Cast:
return VerifySignaturePkcs1Cast(message, message_length, signature,
signature_length);
@@ -422,7 +423,8 @@ OEMCryptoResult RsaPublicKey::VerifySignature(
OEMCryptoResult RsaPublicKey::VerifySignature(
const std::string& message, const std::string& signature,
RsaSignatureAlgorithm algorithm) const {
RsaSignatureAlgorithm algorithm,
OEMCrypto_SignatureHashAlgorithm hash_algorithm) const {
if (signature.empty()) {
LOGE("Signature should not be empty");
return OEMCrypto_ERROR_INVALID_CONTEXT;
@@ -430,18 +432,19 @@ OEMCryptoResult RsaPublicKey::VerifySignature(
return VerifySignature(reinterpret_cast<const uint8_t*>(message.data()),
message.size(),
reinterpret_cast<const uint8_t*>(signature.data()),
signature.size(), algorithm);
signature.size(), algorithm, hash_algorithm);
}
OEMCryptoResult RsaPublicKey::VerifySignature(
const std::vector<uint8_t>& message, const std::vector<uint8_t>& signature,
RsaSignatureAlgorithm algorithm) const {
RsaSignatureAlgorithm algorithm,
OEMCrypto_SignatureHashAlgorithm hash_algorithm) const {
if (signature.empty()) {
LOGE("Signature should not be empty");
return OEMCrypto_ERROR_INVALID_CONTEXT;
}
return VerifySignature(message.data(), message.size(), signature.data(),
signature.size(), algorithm);
signature.size(), algorithm, hash_algorithm);
}
OEMCryptoResult RsaPublicKey::EncryptSessionKey(
@@ -664,7 +667,8 @@ bool RsaPublicKey::InitFromSslHandle(const RSA* rsa_handle,
OEMCryptoResult RsaPublicKey::VerifySignaturePss(
const uint8_t* message, size_t message_length, const uint8_t* signature,
size_t signature_length) const {
size_t signature_length,
OEMCrypto_SignatureHashAlgorithm hash_algorithm) const {
// Step 0: Ensure the signature algorithm is supported by key.
if (!(allowed_schemes_ & kSign_RSASSA_PSS)) {
LOGE("RSA key cannot verify using PSS");
@@ -680,14 +684,34 @@ OEMCryptoResult RsaPublicKey::VerifySignaturePss(
LOGE("Failed to set PKEY RSA key");
return OEMCrypto_ERROR_UNKNOWN_FAILURE;
}
// Step 2a: Setup a EVP MD CTX for PSS Verification.
// Step 2a: Choose the correct digest algorithm.
const EVP_MD* digest = nullptr;
switch (hash_algorithm) {
case OEMCrypto_SHA1:
digest = EVP_sha1();
break;
case OEMCrypto_SHA2_256:
digest = EVP_sha256();
break;
case OEMCrypto_SHA2_384:
digest = EVP_sha384();
break;
case OEMCrypto_SHA2_512:
digest = EVP_sha512();
break;
}
if (digest == nullptr) {
LOGE("Unrecognized hash algorithm %d", hash_algorithm);
return OEMCrypto_ERROR_INVALID_CONTEXT;
}
// Step 2b: Setup an EVP MD CTX for PSS Verification.
ScopedEvpMdCtx md_ctx = EVP_MD_CTX_new();
if (!md_ctx) {
LOGE("Failed to allocate MD CTX");
return OEMCrypto_ERROR_UNKNOWN_FAILURE;
}
EVP_PKEY_CTX* pkey_ctx = nullptr; // Ownership is maintained by |md_ctx|
int res = EVP_DigestVerifyInit(md_ctx.get(), &pkey_ctx, EVP_sha1(), nullptr,
int res = EVP_DigestVerifyInit(md_ctx.get(), &pkey_ctx, digest, nullptr,
pkey.get());
if (res != 1) {
LOGE("Failed to initialize MD CTX for verification");
@@ -697,7 +721,7 @@ OEMCryptoResult RsaPublicKey::VerifySignaturePss(
LOGE("PKEY CTX is unexpectedly null");
return OEMCrypto_ERROR_UNKNOWN_FAILURE;
}
// Step 2b: Configure OEMCrypto RSASSA-PSS options.
// Step 2c: Configure OEMCrypto RSASSA-PSS options.
res = EVP_PKEY_CTX_set_rsa_padding(pkey_ctx, RSA_PKCS1_PSS_PADDING);
if (res != 1) {
LOGE("Failed to set PSS padding");