android/libwvdrmengine/cdm/core/src/device_certificate.proto

// Copyright 2013 Google Inc. All Rights Reserved.
// Author: tinskip@google.com (Thomas Inskip)
//
// Description:
//   Device certificate and certificate status list format definitions.

syntax = "proto2";

package video_widevine_server.sdk;

option optimize_for = LITE_RUNTIME;
option java_outer_classname = "DeviceCertificateProtos";
option java_package = "com.google.video.widevine.protos";

// Certificate definition for user devices, intermediate, and root certificates.
message DeviceCertificate {
  enum CertificateType {
    ROOT = 0;
    INTERMEDIATE = 1;
    USER_DEVICE = 2;
  }

  // Type of certificate. Required.
  optional CertificateType type = 1;
  // 128-bit globally unique serial number of certificate.
  // Value is 0 for root certificate. Required.
  optional bytes serial_number = 2;
  // POSIX time, in seconds, when the certificate was created. Required.
  optional uint32 creation_time_seconds = 3;
  // Device public key. PKCS#1 ASN.1 DER-encoded. Required.
  optional bytes public_key = 4;
  // Widevine system ID for the device. Required for intermediate and
  // user device certificates.
  optional uint32 system_id = 5;
  // True if the certificate corresponds to a test (non production) device.
  // Optional.
  optional bool test_device = 6 [default = false];
}

// DeviceCertificate signed with intermediate or root certificate private key.
message SignedDeviceCertificate {
  // Serialized DeviceCertificate. Required.
  optional bytes device_certificate = 1;
  // Signature of device_certificate. Signed with root or intermediate
  // certificate private key using RSASSA-PSS. Required.
  optional bytes signature = 2;
  // Intermediate signing certificate. Present only for user device
  // certificates. All others signed with root certificate private key.
  optional SignedDeviceCertificate signer = 3;
}

// Contains device model information for a provisioned device.
message ProvisionedDeviceInfo {
  enum WvSecurityLevel {
    // Defined in Widevine Security Integration Guide for DASH on Android:
    // https://docs.google.com/a/google.com/document/d/1Zum-fcJeoIw6KG1kDP_KepIE5h9gAZg0PaMtemBvk9c/edit#heading=h.1t3h5sf
    LEVEL_UNSPECIFIED = 0;
    LEVEL_1 = 1;
    LEVEL_2 = 2;
    LEVEL_3 = 3;
  }

  // Widevine system ID for the device. Mandatory.
  optional uint32 system_id = 1;
  // Name of system-on-a-chip. Optional.
  optional string soc = 2;
  // Name of manufacturer. Optional.
  optional string manufacturer = 3;
  // Manufacturer's model name. Matches "brand" in device metadata. Optional.
  optional string model = 4;
  // Type of device (Phone, Tablet, TV, etc).
  optional string device_type = 5;
  // Device model year. Optional.
  optional uint32 model_year = 6;
  // Widevine-defined security level. Optional.
  optional WvSecurityLevel security_level = 7 [default = LEVEL_UNSPECIFIED];
  // True if the certificate corresponds to a test (non production) device.
  // Optional.
  optional bool test_device = 8 [default = false];
}

// Contains the status of the root or an intermediate DeviceCertificate.
message DeviceCertificateStatus {
  enum CertificateStatus {
    VALID = 0;
    REVOKED = 1;
  };

  // Serial number of the DeviceCertificate to which this message refers.
  // Required.
  optional bytes serial_number = 1;
  // Status of the certificate. Optional.
  optional CertificateStatus status = 2 [default = VALID];
  // Current version of a valid certificate. Present only if status = VALID.
  optional uint32 current_certificate_version = 3;
  // Device model information about the device to which the certificate
  // corresponds. Required.
  optional ProvisionedDeviceInfo device_info = 4;
}

// List of DeviceCertificateStatus. Used to propagate certificate revocation and
// update list.
message DeviceCertificateStatusList {
  // POSIX time, in seconds, when the list was created. Required.
  optional uint32 creation_time_seconds = 1;
  // DeviceCertificateStatus for each certifificate.
  repeated DeviceCertificateStatus certificate_status = 2;
}

// Signed CertificateStatusList
message SignedCertificateStatusList {
  // Serialized CertificateStatusList. Required.
  optional bytes certificate_status_list = 1;
  // Signature of certificate_status_list. Signed with root certificate private
  // key using RSASSA-PSS. Required.
  optional bytes signature = 2;
}