1 /* 2 * Copyright (c) 2021-2024 Huawei Device Co., Ltd. 3 * Licensed under the Apache License, Version 2.0 (the "License"); 4 * you may not use this file except in compliance with the License. 5 * You may obtain a copy of the License at 6 * 7 * http://www.apache.org/licenses/LICENSE-2.0 8 * 9 * Unless required by applicable law or agreed to in writing, software 10 * distributed under the License is distributed on an "AS IS" BASIS, 11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 * See the License for the specific language governing permissions and 13 * limitations under the License. 14 */ 15 #ifndef STORAGE_DAEMON_CRYPTO_BASEKEY_H 16 #define STORAGE_DAEMON_CRYPTO_BASEKEY_H 17 18 #include <string> 19 20 #include "key_blob.h" 21 #include "openssl_crypto.h" 22 23 namespace OHOS { 24 namespace StorageDaemon { 25 const uint8_t RETRIEVE_KEY = 0x0; 26 const uint8_t FIRST_CREATE_KEY = 0x6c; 27 const uint8_t USER_LOGOUT = 0x0; 28 const uint8_t USER_DESTROY = 0x1; 29 const uint32_t USER_UNLOCK = 0x2; 30 const uint32_t USER_ADD_AUTH = 0x0; 31 const uint32_t USER_CHANGE_AUTH = 0x1; 32 const std::string SUFFIX_NEED_UPDATE = "/need_update"; 33 const std::string PATH_KEY_VERSION = "/version_"; 34 const std::vector<uint8_t> NULL_SECRET = { '!' }; 35 class BaseKey : public std::enable_shared_from_this<BaseKey> { 36 public: 37 BaseKey() = delete; 38 BaseKey(const std::string &dir, uint8_t keyLen = CRYPTO_AES_256_XTS_KEY_SIZE); 39 ~BaseKey() = default; 40 41 /* key operations */ 42 bool InitKey(bool needGenerateKey); 43 #ifdef USER_CRYPTO_MIGRATE_KEY 44 bool StoreKey(const UserAuth &auth, bool needGenerateShield = true); 45 #else 46 bool StoreKey(const UserAuth &auth); 47 #endif 48 bool UpdateKey(const std::string &keypath = "", bool needSyncCandidate = true); 49 bool RestoreKey(const UserAuth &auth, bool needSyncCandidate = true); 50 virtual bool ActiveKey(uint32_t flag, const std::string &mnt = MNT_DATA) = 0; 51 virtual bool InactiveKey(uint32_t flag, const std::string &mnt = MNT_DATA) = 0; 52 virtual bool LockUserScreen(uint32_t flag, uint32_t sdpClass, const std::string &mnt = MNT_DATA) = 0; 53 virtual bool UnlockUserScreen(uint32_t flag, uint32_t sdpClass, const std::string &mnt = MNT_DATA) = 0; 54 virtual bool GenerateAppkey(uint32_t userId, uint32_t hashId, std::string &keyId) = 0; 55 virtual bool DeleteAppkey(const std::string keyId) = 0; 56 virtual bool AddClassE(bool &isNeedEncryptClassE, bool &isSupport, uint32_t status) = 0; 57 virtual bool DeleteClassEPinCode(uint32_t userId) = 0; 58 virtual bool DecryptClassE(const UserAuth &auth, bool &isSupport, bool &eBufferStatue, uint32_t user, 59 bool needSyncCandidate) = 0; 60 virtual bool EncryptClassE(const UserAuth &auth, bool &isSupport, uint32_t user, uint32_t status) = 0; 61 virtual bool ChangePinCodeClassE(bool &isFbeSupport, uint32_t userId) = 0; 62 virtual bool LockUece(bool &isFbeSupport) = 0; 63 bool DoRestoreKeyEx(const UserAuth &auth, const std::string &keypath); 64 bool EncryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey, KeyBlob &encryptedKey); 65 bool DecryptKeyBlob(const UserAuth &auth, const std::string &keyPath, KeyBlob &planKey, KeyBlob &decryptedKey); 66 bool RenameKeyPath(const std::string &keyPath); 67 bool ClearKey(const std::string &mnt = MNT_DATA); 68 void WipingActionDir(std::string &path); 69 bool UpgradeKeys(); 70 bool KeyDescIsEmpty(); 71 KeyInfo keyInfo_; GetDir()72 std::string GetDir() const 73 { 74 return dir_; 75 } 76 enum class KeyEncryptType { 77 KEY_CRYPT_HUKS, 78 KEY_CRYPT_OPENSSL, 79 KEY_CRYPT_HUKS_OPENSSL 80 }; 81 82 protected: 83 static bool SaveKeyBlob(const KeyBlob &blob, const std::string &path); 84 std::string GetCandidateDir() const; 85 std::string dir_ {}; 86 87 private: 88 #ifdef USER_CRYPTO_MIGRATE_KEY 89 bool DoStoreKey(const UserAuth &auth, bool needGenerateShield = true); 90 #else 91 bool DoStoreKey(const UserAuth &auth); 92 #endif 93 bool LoadAndSaveShield(const UserAuth &auth, const std::string &pathShield, bool needGenerateShield, 94 KeyContext &keyCtx); 95 bool SaveAndCleanKeyBuff(const std::string &keyPath, KeyContext &keyCtx); 96 bool DoRestoreKey(const UserAuth &auth, const std::string &keypath); 97 bool DoRestoreKeyCeEceSece(const UserAuth &auth, const std::string &path, const uint32_t keyType); 98 bool DoRestoreKeyDe(const UserAuth &auth, const std::string &path); 99 bool DoRestoreKeyOld(const UserAuth &auth, const std::string &keypath); 100 bool DoUpdateRestore(const UserAuth &auth, const std::string &keyPath); 101 static bool GenerateAndSaveKeyBlob(KeyBlob &blob, const std::string &path, const uint32_t size); 102 static bool GenerateKeyBlob(KeyBlob &blob, const uint32_t size); 103 static bool LoadKeyBlob(KeyBlob &blob, const std::string &path, const uint32_t size); 104 bool EncryptDe(const UserAuth &auth, const std::string &path); 105 bool EncryptEceSece(const UserAuth &auth, const uint32_t keyType, KeyContext &keyCtx); 106 bool Decrypt(const UserAuth &auth); 107 bool DecryptReal(const UserAuth &auth, const uint32_t keyType, KeyContext &keyCtx); 108 bool CheckAndUpdateVersion(); 109 bool CombKeyCtx(const KeyBlob &nonce, const KeyBlob &rndEnc, const KeyBlob &aad, KeyBlob &keyOut); 110 bool SplitKeyCtx(const KeyBlob &keyIn, KeyBlob &nonce, KeyBlob &rndEnc, KeyBlob &aad); 111 void CombKeyBlob(const KeyBlob &encAad, const KeyBlob &end, KeyBlob &keyOut); 112 void SplitKeyBlob(const KeyBlob &keyIn, KeyBlob &encAad, KeyBlob &nonce, uint32_t start); 113 void ClearKeyContext(KeyContext &keyCtx); 114 bool InitKeyContext(const UserAuth &auth, const std::string &keyPath, KeyContext &keyCtx); 115 int GetCandidateVersion() const; 116 std::string GetNextCandidateDir() const; 117 void SyncKeyDir() const; 118 void DoLatestBackUp() const; 119 uint32_t GetTypeFromDir(); 120 uint32_t GetIdFromDir(); 121 122 KeyContext keyContext_ {}; 123 uint8_t keyLen_ {}; 124 KeyEncryptType keyEncryptType_; 125 std::string KeyEncryptTypeToString(KeyEncryptType keyEncryptType_) const; 126 }; 127 } // namespace StorageDaemon 128 } // namespace OHOS 129 130 #endif // STORAGE_DAEMON_CRYPTO_BASEKEY_H 131