Allow Apps to Voluntarily Downgrade to L3 Crypto

This merges the following changes from the Widevine CDM repository: 564f4cc Add CdmClientPropertySet to CDM Adds an interface to the CDM that allows it to query its client for certain properties. In this case, this includes the ability to specify what security level is desired, as well as support for service ceritifcate privacy mode. 9cfbd3e Force Level 3 fallback Adds support for voluntarily invoking L3 crypto to the OEMCrypto wrapper. 95d12c1 Add pointer to CdmClientPropertySet class to OpenSession. Adds support for storing the property set on a session-by-session basis and choosing the appropriate crypto level. 17de442 Add Settable Properties for Clank to Android Adds support for setting the aforementioned properties to the DrmEngine bbe704d Fixes to force fallback to level three security Corrections to invoke provisioning, OEMCrypto API with configured security level rather than the default. Unit tests were also revised. Note that some parts of this are also support for the ability to use a service certificate-based privacy mode. The remaining code for supporting this mode is still forthcoming. Bug: 10109249 Change-Id: I2755e4dea1de3e8a56cff237360298f7b7f1bddc
2013-08-15 10:59:42 -07:00
parent 0fa3e16999
commit f6c2a60485
45 changed files with 2359 additions and 906 deletions
--- a/libwvdrmengine/cdm/core/src/license.cpp
+++ b/libwvdrmengine/cdm/core/src/license.cpp
@@ -9,6 +9,7 @@
 #include "log.h"
 #include "policy_engine.h"
 #include "properties.h"
+#include "privacy_crypto.h"
 #include "string_conversions.h"
 #include "wv_cdm_constants.h"

@@ -20,6 +21,41 @@ std::string kDeviceNameKey = "device_name";
 std::string kProductNameKey = "product_name";
 std::string kBuildInfoKey = "build_info";
 std::string kDeviceIdKey = "device_id";
+const unsigned char kServiceCertificateCAPublicKey[] = {
+    0x30, 0x82, 0x01, 0x8a, 0x02, 0x82, 0x01, 0x81, 0x00, 0xa5, 0x62, 0x07,
+    0xdf, 0xc8, 0x84, 0x74, 0xe1, 0x2a, 0xb7, 0xbb, 0xc0, 0x78, 0x76, 0xbe,
+    0x13, 0x3b, 0xe6, 0x2c, 0x09, 0x9d, 0x35, 0x3f, 0xf3, 0x0f, 0xe9, 0x61,
+    0x96, 0x20, 0x53, 0x6e, 0x78, 0x62, 0xe0, 0x10, 0xd2, 0xca, 0xe4, 0xdd,
+    0xd5, 0x96, 0xaf, 0x9a, 0xd7, 0x08, 0x47, 0xe4, 0x55, 0x1b, 0x83, 0xbe,
+    0x10, 0x66, 0x74, 0x08, 0xf2, 0x49, 0x79, 0xea, 0x29, 0x46, 0xc2, 0x65,
+    0x97, 0xa6, 0xcc, 0x4b, 0xa4, 0x08, 0xc3, 0x04, 0x17, 0x01, 0xb5, 0x11,
+    0x53, 0xe9, 0x68, 0x34, 0x3c, 0x26, 0x56, 0x44, 0x37, 0x5c, 0xb4, 0x7a,
+    0x1d, 0x5d, 0x6c, 0x58, 0xc2, 0x82, 0xa0, 0x92, 0xf1, 0x14, 0xf1, 0x22,
+    0xff, 0x64, 0xde, 0xdf, 0xb3, 0x3d, 0x9d, 0xa5, 0x86, 0xcd, 0xa0, 0x0a,
+    0x63, 0x08, 0xdd, 0x60, 0x5d, 0xfd, 0xa4, 0x01, 0xe3, 0xb6, 0x0e, 0x85,
+    0xe4, 0xc3, 0x37, 0x61, 0xd0, 0xe7, 0x12, 0xe9, 0xc4, 0xde, 0xf2, 0x59,
+    0x11, 0xe3, 0x5b, 0x02, 0x9f, 0x24, 0xb9, 0xb0, 0xbb, 0x31, 0xa0, 0xee,
+    0x6a, 0x2c, 0xb4, 0x30, 0xff, 0xe0, 0xf0, 0x93, 0xee, 0x3a, 0xae, 0xb2,
+    0x2e, 0x84, 0xa0, 0x47, 0x42, 0x51, 0xbb, 0xfa, 0xbb, 0x90, 0x97, 0x2c,
+    0x77, 0x45, 0xee, 0x2c, 0xfb, 0xec, 0x5d, 0xd8, 0xca, 0x49, 0x94, 0x53,
+    0x5d, 0x37, 0xaf, 0x86, 0x47, 0xda, 0xe2, 0xbd, 0xf0, 0x5f, 0x07, 0x53,
+    0x8a, 0x10, 0xd0, 0x9a, 0xd0, 0x7f, 0xe9, 0xef, 0xf6, 0xda, 0xea, 0x1e,
+    0x2e, 0x54, 0xec, 0x44, 0xde, 0x3a, 0xe1, 0xc8, 0xdb, 0x17, 0xe8, 0xc9,
+    0x3a, 0x81, 0x11, 0x4d, 0xb7, 0x2d, 0x09, 0x83, 0xab, 0x30, 0xb7, 0xf5,
+    0x1b, 0x03, 0x86, 0x21, 0xa9, 0xf5, 0xca, 0x15, 0x26, 0xaf, 0x39, 0xf3,
+    0x5d, 0x01, 0x7d, 0xe3, 0x19, 0x54, 0xd1, 0x2e, 0x10, 0x16, 0x9c, 0xee,
+    0xc3, 0xbd, 0xcc, 0xdb, 0x02, 0x82, 0xd0, 0x60, 0x0b, 0x42, 0x72, 0x85,
+    0xec, 0xdc, 0x41, 0x7c, 0xf1, 0x34, 0xd8, 0x27, 0x21, 0xf9, 0xa6, 0x82,
+    0x40, 0xd3, 0xc5, 0xc9, 0xf9, 0x6b, 0xc9, 0x12, 0x64, 0xe4, 0x3a, 0x3b,
+    0xc9, 0x8f, 0x3c, 0xd0, 0x2c, 0xb8, 0xb8, 0xf3, 0x05, 0x4a, 0xe9, 0x4c,
+    0x46, 0x2b, 0xb6, 0xe1, 0xed, 0x82, 0xb2, 0xf0, 0xd1, 0x72, 0x71, 0x04,
+    0x35, 0x19, 0xc1, 0x16, 0x17, 0xd6, 0x75, 0xe0, 0xab, 0xde, 0x8f, 0xe1,
+    0xc1, 0x49, 0x68, 0x0c, 0xc8, 0xce, 0x6d, 0x87, 0x50, 0x04, 0xb5, 0xd7,
+    0x24, 0xf4, 0x2e, 0x0c, 0x11, 0x35, 0xb2, 0x67, 0x85, 0x1b, 0x38, 0xff,
+    0x2f, 0x71, 0xf5, 0x30, 0x18, 0x1e, 0x6f, 0xd7, 0xf0, 0x33, 0x61, 0x53,
+    0x7e, 0x55, 0x7f, 0x0d, 0x60, 0x83, 0xf3, 0x8a, 0x2b, 0x67, 0xd5, 0xf0,
+    0x2e, 0x23, 0x23, 0x60, 0x0b, 0x83, 0x9c, 0xc2, 0x87, 0x02, 0x03, 0x01,
+    0x00, 0x01};
 }

 namespace wvcdm {
@@ -27,6 +63,8 @@ namespace wvcdm {
 // Protobuf generated classes.
 using video_widevine_server::sdk::ClientIdentification;
 using video_widevine_server::sdk::ClientIdentification_NameValue;
+using video_widevine_server::sdk::DeviceCertificate;
+using video_widevine_server::sdk::EncryptedClientIdentification;
 using video_widevine_server::sdk::LicenseRequest;
 using video_widevine_server::sdk::LicenseRequest_ContentIdentification;
 using video_widevine_server::sdk::LicenseRequest_ContentIdentification_CENC;
@@ -35,6 +73,7 @@ using video_widevine_server::sdk::
 using video_widevine_server::sdk::License;
 using video_widevine_server::sdk::License_KeyContainer;
 using video_widevine_server::sdk::LicenseError;
+using video_widevine_server::sdk::SignedDeviceCertificate;
 using video_widevine_server::sdk::SignedMessage;

 static std::vector<CryptoKey> ExtractContentKeys(const License& license) {
@@ -81,36 +120,65 @@ static std::vector<CryptoKey> ExtractContentKeys(const License& license) {
  return key_array;
 }

-CdmLicense::CdmLicense() : session_(NULL) {}
-
-CdmLicense::~CdmLicense() {}
-
 bool CdmLicense::Init(const std::string& token, CryptoSession* session,
                      PolicyEngine* policy_engine) {
-  if (token.size() == 0) return false;
-  if (session == NULL || !session->IsOpen()) return false;
+  if (token.size() == 0) {
+    LOGE("CdmLicense::Init: empty token provided");
+    return false;
+  }
+  if (session == NULL || !session->IsOpen()) {
+    LOGE("CdmLicense::Init: crypto session not provided or not open");
+    return false;
+  }
+  if (policy_engine == NULL) {
+    LOGE("CdmLicense::Init: no policy engine provided");
+    return false;
+  }
  token_ = token;
  session_ = session;
  policy_engine_ = policy_engine;
+  initialized_ = true;
  return true;
 }

 bool CdmLicense::PrepareKeyRequest(const CdmInitData& init_data,
                                   const CdmLicenseType license_type,
                                   const CdmAppParameterMap& app_parameters,
+                                   const CdmSessionId& session_id,
                                   CdmKeyMessage* signed_request,
                                   std::string* server_url) {
-  if (!session_ || token_.empty()) {
+  if (!initialized_) {
+    LOGE("CdmLicense::PrepareKeyRequest: not initialized");
    return false;
  }
-  if (init_data.empty()) {
-    LOGE("CdmLicense::PrepareKeyRequest : No init data provided;");
+  if (init_data.empty() && init_data_.empty()) {
+    LOGE("CdmLicense::PrepareKeyRequest: empty init data provided");
+    return false;
+  }
+  if (session_id.empty()) {
+    LOGE("CdmLicense::PrepareKeyRequest: empty session id provided");
    return false;
  }
  if (!signed_request) {
-    LOGE("CdmLicense::PrepareKeyRequest : No signed request provided.");
+    LOGE("CdmLicense::PrepareKeyRequest: no signed request provided");
    return false;
  }
+  if (!server_url) {
+    LOGE("CdmLicense::PrepareKeyRequest: no server url provided");
+    return false;
+  }
+
+  bool privacy_mode_enabled = Properties::UsePrivacyMode(session_id);
+  std::vector<uint8_t> cert = Properties::GetServiceCertificate(session_id);
+  std::string serialized_service_certificate(cert.begin(), cert.end());
+
+  if (serialized_service_certificate.empty())
+    serialized_service_certificate = service_certificate_;
+
+  if (privacy_mode_enabled && serialized_service_certificate.empty()) {
+    init_data_ = init_data;
+    return PrepareServiceCertificateRequest(signed_request, server_url);
+  }

  // TODO(gmorgan): Request ID owned by session?
  std::string request_id;
@@ -170,13 +238,71 @@ bool CdmLicense::PrepareKeyRequest(const CdmInitData& init_data,
    client_info->set_value(value);
  }

+  if (privacy_mode_enabled) {
+    EncryptedClientIdentification* encrypted_client_id =
+        license_request.mutable_encrypted_client_id();
+    DeviceCertificate service_certificate;
+
+    if (!service_certificate.ParseFromString(serialized_service_certificate)) {
+      LOGE(
+          "CdmLicense::PrepareKeyRequest: unable to parse retrieved "
+          "service certificate");
+      return false;
+    }
+
+    if (service_certificate.type() !=
+        video_widevine_server::sdk::DeviceCertificate_CertificateType_SERVICE) {
+      LOGE(
+          "CdmLicense::PrepareKeyRequest: retrieved certificate not of type"
+          " service, %d",
+          service_certificate.type());
+      return false;
+    }
+    encrypted_client_id->set_service_id(service_certificate.service_id());
+    encrypted_client_id->set_service_certificate_serial_number(
+        service_certificate.serial_number());
+
+    std::string iv(KEY_IV_SIZE, 0);
+    std::string key(KEY_SIZE, 0);
+
+    if (!session_->GetRandom(key.size(), reinterpret_cast<uint8_t*>(&key[0]))) {
+      return false;
+    }
+    if (!session_->GetRandom(iv.size(), reinterpret_cast<uint8_t*>(&iv[0]))) {
+      return false;
+    }
+    std::string id, enc_id, enc_key;
+    client_id->SerializeToString(&id);
+
+    AesCbcKey aes;
+    if (!aes.Init(key)) return false;
+    if (!aes.Encrypt(id, &enc_id, &iv)) return false;
+
+    RsaPublicKey rsa;
+    if (!rsa.Init(service_certificate.public_key())) return false;
+    if (!rsa.Encrypt(key, &enc_key)) return false;
+
+    encrypted_client_id->set_encrypted_client_id_iv(iv);
+    encrypted_client_id->set_encrypted_privacy_key(enc_key);
+    encrypted_client_id->set_encrypted_client_id(enc_id);
+    license_request.clear_client_id();
+  }
+
  // Content Identification may be a cenc_id, a webm_id or a license_id
  LicenseRequest_ContentIdentification* content_id =
      license_request.mutable_content_id();

  LicenseRequest_ContentIdentification_CENC* cenc_content_id =
      content_id->mutable_cenc_id();
-  cenc_content_id->add_pssh(init_data);
+
+  if (!init_data.empty()) {
+    cenc_content_id->add_pssh(init_data);
+  } else if (privacy_mode_enabled && !init_data_.empty()) {
+    cenc_content_id->add_pssh(init_data_);
+  } else {
+    LOGD("CdmLicense::PrepareKeyRequest: init data not available");
+    return false;
+  }

  switch (license_type) {
    case kLicenseTypeOffline:
@@ -187,7 +313,7 @@ bool CdmLicense::PrepareKeyRequest(const CdmInitData& init_data,
      break;
    default:
      LOGD("CdmLicense::PrepareKeyRequest: Unknown license type = %d",
-          license_type);
+           license_type);
      return false;
      break;
  }
@@ -205,7 +331,7 @@ bool CdmLicense::PrepareKeyRequest(const CdmInitData& init_data,
  if (!session_->GenerateNonce(&nonce)) {
    return false;
  }
-  license_request.set_key_control_nonce(UintToString(nonce));
+  license_request.set_key_control_nonce(nonce);
  LOGD("PrepareKeyRequest: nonce=%u", nonce);
  license_request.set_protocol_version(video_widevine_server::sdk::VERSION_2_1);

@@ -245,8 +371,8 @@ bool CdmLicense::PrepareKeyRequest(const CdmInitData& init_data,
 bool CdmLicense::PrepareKeyUpdateRequest(bool is_renewal,
                                         CdmKeyMessage* signed_request,
                                         std::string* server_url) {
-  if (!session_) {
-    LOGE("CdmLicense::PrepareKeyUpdateRequest: Invalid crypto session");
+  if (!initialized_) {
+    LOGE("CdmLicense::PrepareKeyUpdateRequest: not initialized");
    return false;
  }
  if (!signed_request) {
@@ -274,7 +400,7 @@ bool CdmLicense::PrepareKeyUpdateRequest(bool is_renewal,
  if (!session_->GenerateNonce(&nonce)) {
    return false;
  }
-  license_request.set_key_control_nonce(UintToString(nonce));
+  license_request.set_key_control_nonce(nonce);
  LOGD("PrepareKeyUpdateRequest: nonce=%u", nonce);
  license_request.set_protocol_version(video_widevine_server::sdk::VERSION_2_1);

@@ -289,7 +415,8 @@ bool CdmLicense::PrepareKeyUpdateRequest(bool is_renewal,
    return false;

  if (license_request_signature.empty()) {
-    LOGE("CdmLicense::PrepareKeyUpdateRequest: empty license request"
+    LOGE(
+        "CdmLicense::PrepareKeyUpdateRequest: empty license request"
        " signature");
    return false;
  }
@@ -307,28 +434,46 @@ bool CdmLicense::PrepareKeyUpdateRequest(bool is_renewal,

 CdmResponseType CdmLicense::HandleKeyResponse(
    const CdmKeyResponse& license_response) {
-  if (!session_) {
+  if (!initialized_) {
+    LOGE("CdmLicense::HandleKeyResponse: not initialized");
    return KEY_ERROR;
  }
  if (license_response.empty()) {
-    LOGE("CdmLicense::HandleKeyResponse : Empty license response.");
+    LOGE("CdmLicense::HandleKeyResponse: empty license response");
    return KEY_ERROR;
  }

+  if (service_certificate_response_pending_)
+    return CdmLicense::HandleServiceCertificateResponse(license_response);
+
  SignedMessage signed_response;
-  if (!signed_response.ParseFromString(license_response)) return KEY_ERROR;
+  if (!signed_response.ParseFromString(license_response)) {
+    LOGE(
+        "CdmLicense::HandleKeyResponse: unable to parse signed license"
+        " response");
+    return KEY_ERROR;
+  }

  if (signed_response.type() == SignedMessage::ERROR) {
    return HandleKeyErrorResponse(signed_response);
  }

-  if (!signed_response.has_signature()) return KEY_ERROR;
+  if (!signed_response.has_signature()) {
+    LOGE("CdmLicense::HandleKeyResponse: license response is not signed");
+    return KEY_ERROR;
+  }

  License license;
-  if (!license.ParseFromString(signed_response.msg())) return KEY_ERROR;
+  if (!license.ParseFromString(signed_response.msg())) {
+    LOGE("CdmLicense::HandleKeyResponse: unable to parse license response");
+    return KEY_ERROR;
+  }

  if (Properties::use_certificates_as_identification()) {
-    if (!signed_response.has_session_key()) return KEY_ERROR;
+    if (!signed_response.has_session_key()) {
+      LOGE("CdmLicense::HandleKeyResponse: no session keys present");
+      return KEY_ERROR;
+    }

    if (!session_->GenerateDerivedKeys(key_request_,
                                       signed_response.session_key()))
@@ -349,6 +494,10 @@ CdmResponseType CdmLicense::HandleKeyResponse(
    }

    if (mac_key_iv.size() != KEY_IV_SIZE || mac_key.size() != MAC_KEY_SIZE) {
+      LOGE(
+          "CdmLicense::HandleKeyResponse: mac key/iv size error"
+          "(key/iv size expected: %d/%d, actual: %d/%d",
+          MAC_KEY_SIZE, KEY_IV_SIZE, mac_key.size(), mac_key_iv.size());
      return KEY_ERROR;
    }
  }
@@ -374,9 +523,9 @@ CdmResponseType CdmLicense::HandleKeyResponse(
 }

 CdmResponseType CdmLicense::HandleKeyUpdateResponse(
-    bool is_renewal,
-    const CdmKeyResponse& license_response) {
-  if (!session_) {
+    bool is_renewal, const CdmKeyResponse& license_response) {
+  if (!initialized_) {
+    LOGE("CdmLicense::HandleKeyUpdateResponse: not initialized");
    return KEY_ERROR;
  }
  if (license_response.empty()) {
@@ -401,7 +550,8 @@ CdmResponseType CdmLicense::HandleKeyUpdateResponse(

  License license;
  if (!license.ParseFromString(signed_response.msg())) {
-    LOGE("CdmLicense::HandleKeyUpdateResponse: Unable to parse license"
+    LOGE(
+        "CdmLicense::HandleKeyUpdateResponse: Unable to parse license"
        " from signed message");
    return KEY_ERROR;
  }
@@ -423,15 +573,12 @@ CdmResponseType CdmLicense::HandleKeyUpdateResponse(
  // merge from Eureka)
  policy_engine_->UpdateLicense(license);

-  if (!is_renewal)
-    return KEY_ADDED;
+  if (!is_renewal) return KEY_ADDED;

  std::vector<CryptoKey> key_array = ExtractContentKeys(license);

-  if (session_->RefreshKeys(signed_response.msg(),
-                            signed_response.signature(),
-                            key_array.size(),
-                            &key_array[0])) {
+  if (session_->RefreshKeys(signed_response.msg(), signed_response.signature(),
+                            key_array.size(), &key_array[0])) {
    return KEY_ADDED;
  } else {
    return KEY_ERROR;
@@ -439,13 +586,14 @@ CdmResponseType CdmLicense::HandleKeyUpdateResponse(
 }

 bool CdmLicense::RestoreOfflineLicense(
-    CdmKeyMessage& license_request,
-    CdmKeyResponse& license_response,
+    CdmKeyMessage& license_request, CdmKeyResponse& license_response,
    CdmKeyResponse& license_renewal_response) {

  if (license_request.empty() || license_response.empty()) {
-    LOGE("CdmLicense::RestoreOfflineLicense: key_request or response empty: "
-         "%u %u", license_request.size(), license_response.size());
+    LOGE(
+        "CdmLicense::RestoreOfflineLicense: key_request or response empty: "
+        "%u %u",
+        license_request.size(), license_response.size());
    return false;
  }

@@ -456,36 +604,139 @@ bool CdmLicense::RestoreOfflineLicense(
  }

  if (signed_request.type() != SignedMessage::LICENSE_REQUEST) {
-    LOGE("CdmLicense::RestoreOfflineLicense: license request type: expected = "
+    LOGE(
+        "CdmLicense::RestoreOfflineLicense: license request type: expected = "
        "%d, actual = %d",
-        SignedMessage::LICENSE_REQUEST,
-        signed_request.type());
+        SignedMessage::LICENSE_REQUEST, signed_request.type());
    return false;
  }

  if (Properties::use_certificates_as_identification()) {
    key_request_ = signed_request.msg();
-  }
-  else {
-    if (!session_->GenerateDerivedKeys(signed_request.msg()))
-      return false;
+  } else {
+    if (!session_->GenerateDerivedKeys(signed_request.msg())) return false;
  }

  CdmResponseType sts = HandleKeyResponse(license_response);

-  if (sts != KEY_ADDED)
-    return false;
+  if (sts != KEY_ADDED) return false;

  if (!license_renewal_response.empty()) {
    sts = HandleKeyUpdateResponse(true, license_renewal_response);

-    if (sts != KEY_ADDED)
-      return false;
+    if (sts != KEY_ADDED) return false;
  }

  return true;
 }

+bool CdmLicense::PrepareServiceCertificateRequest(CdmKeyMessage* signed_request,
+                                                  std::string* server_url) {
+  if (!initialized_) {
+    LOGE("CdmLicense::PrepareServiceCertificateRequest: not initialized");
+    return false;
+  }
+  if (!signed_request) {
+    LOGE(
+        "CdmLicense::PrepareServiceCertificateRequest: no signed request"
+        " provided");
+    return false;
+  }
+  if (!server_url) {
+    LOGE(
+        "CdmLicense::PrepareServiceCertificateRequest: no server url"
+        " provided");
+    return false;
+  }
+  SignedMessage signed_message;
+  signed_message.set_type(SignedMessage::SERVICE_CERTIFICATE_REQUEST);
+  signed_message.SerializeToString(signed_request);
+  *server_url = server_url_;
+  service_certificate_response_pending_ = true;
+
+  return true;
+}
+
+CdmResponseType CdmLicense::HandleServiceCertificateResponse(
+    const CdmKeyResponse& service_certificate_response) {
+  if (!initialized_) {
+    LOGE("CdmLicense::HandleServiceCertificateResponse: not initialized");
+    return KEY_ERROR;
+  }
+  if (service_certificate_response.empty()) {
+    LOGE(
+        "CdmLicense::HandleServiceCertificateResponse: empty service "
+        "certificate response");
+    return KEY_ERROR;
+  }
+
+  SignedMessage signed_response;
+  if (!signed_response.ParseFromString(service_certificate_response))
+    return KEY_ERROR;
+
+  switch (signed_response.type()) {
+    case SignedMessage::ERROR:
+      return HandleKeyErrorResponse(signed_response);
+    case SignedMessage::SERVICE_CERTIFICATE:
+      break;  // expected message type
+    default:
+      LOGE(
+          "CdmLicense::HandleServiceCertificateResponse: unexpected signed"
+          "message type: %d",
+          signed_response.type());
+      return KEY_ERROR;
+  }
+
+  SignedDeviceCertificate signed_service_certificate;
+  if (!signed_service_certificate.ParseFromString(signed_response.msg())) {
+    LOGE(
+        "CdmLicense::HandleServiceCertificateResponse: unable to parse"
+        "signed device certificate");
+    return KEY_ERROR;
+  }
+
+  RsaPublicKey root_ca_key;
+  std::vector<uint8_t> ca_public_key(
+      &kServiceCertificateCAPublicKey[0],
+      &kServiceCertificateCAPublicKey[sizeof(kServiceCertificateCAPublicKey)]);
+  if (!root_ca_key.Init(b2a_hex(ca_public_key))) {
+    LOGE(
+        "CdmLicense::HandleServiceCertificateResponse: public key"
+        "initialization failed");
+    return KEY_ERROR;
+  }
+
+  if (!root_ca_key.VerifySignature(
+          signed_service_certificate.device_certificate(),
+          signed_service_certificate.signature())) {
+    LOGE(
+        "CdmLicense::HandleServiceCertificateResponse: service "
+        "certificate verification failed");
+    return KEY_ERROR;
+  }
+
+  DeviceCertificate service_certificate;
+  if (!service_certificate.ParseFromString(
+          signed_service_certificate.device_certificate())) {
+    LOGE(
+        "CdmLicense::HandleServiceCertificateResponse: unable to parse "
+        "retrieved service certificate");
+    return KEY_ERROR;
+  }
+
+  if (service_certificate.type() !=
+      video_widevine_server::sdk::DeviceCertificate_CertificateType_SERVICE) {
+    LOGE(
+        "CdmLicense::HandleServiceCertificateResponse: certificate not of type"
+        " service, %d",
+        service_certificate.type());
+    return KEY_ERROR;
+  }
+
+  service_certificate_ = signed_service_certificate.device_certificate();
+  return NEED_KEY;
+}
+
 CdmResponseType CdmLicense::HandleKeyErrorResponse(
    const SignedMessage& signed_message) {

@@ -496,14 +747,14 @@ CdmResponseType CdmLicense::HandleKeyErrorResponse(
  }

  switch (license_error.error_code()) {
-    case LicenseError::INVALID_CREDENTIALS:
+    case LicenseError::INVALID_DEVICE_CERTIFICATE:
      return NEED_PROVISIONING;
-    case LicenseError::REVOKED_CREDENTIALS:
+    case LicenseError::REVOKED_DEVICE_CERTIFICATE:
      return DEVICE_REVOKED;
    case LicenseError::SERVICE_UNAVAILABLE:
    default:
      LOGW("CdmLicense::HandleKeyErrorResponse: Unknwon error type = %d",
-          license_error.error_code());
+           license_error.error_code());
      return KEY_ERROR;
  }
 }