commit d7b96bc64f403f56e5f82bf85fb02a1f3e94feb0
author TreeHugger Robot <treehugger-gerrit@google.com> Wed Aug 11 23:16:01 2021 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Wed Aug 11 23:16:01 2021 +0000
tree 3aeb8f8e227c527d632583fff1cadf78f932191f
parent 2160b23d148997136e8e160b7af2217c4d2d7c41
parent 8f19fd90e3c9c1fcb3056129f356f875c95b839c

Merge "Add ROLLBACK_RESISTANCE tag to key usage" into sc-dev am: 8f19fd90e3

Original change: https://googleplex-android-review.googlesource.com/c/platform/system/vold/+/15534270

Change-Id: Ieaa3ce08c20df998a8141c77a7f771e40e1c6d0a

KeyStorage.cpp

diff --git a/KeyStorage.cpp b/KeyStorage.cpp
index 6aab4bd..e84fe75 100644
--- a/KeyStorage.cpp
+++ b/KeyStorage.cpp
@@ -383,7 +383,9 @@
                                    const km::AuthorizationSet& keyParams, const KeyBuffer& message,
                                    std::string* ciphertext) {
     km::AuthorizationSet opParams =
-            km::AuthorizationSetBuilder().Authorization(km::TAG_PURPOSE, km::KeyPurpose::ENCRYPT);
+            km::AuthorizationSetBuilder()
+                    .Authorization(km::TAG_ROLLBACK_RESISTANCE)
+                    .Authorization(km::TAG_PURPOSE, km::KeyPurpose::ENCRYPT);
     km::AuthorizationSet outParams;
     auto opHandle = BeginKeystoreOp(keystore, dir, keyParams, opParams, &outParams);
     if (!opHandle) return false;
@@ -412,6 +414,7 @@
     auto bodyAndMac = ciphertext.substr(GCM_NONCE_BYTES);
     auto opParams = km::AuthorizationSetBuilder()
                             .Authorization(km::TAG_NONCE, nonce)
+                            .Authorization(km::TAG_ROLLBACK_RESISTANCE)
                             .Authorization(km::TAG_PURPOSE, km::KeyPurpose::DECRYPT);
     auto opHandle = BeginKeystoreOp(keystore, dir, keyParams, opParams, nullptr);
     if (!opHandle) return false;