diff options
| -rw-r--r-- | crypto/ext4crypt/Decrypt.cpp | 484 |
1 files changed, 319 insertions, 165 deletions
diff --git a/crypto/ext4crypt/Decrypt.cpp b/crypto/ext4crypt/Decrypt.cpp index 4a8494e5e..c062f8ae4 100644 --- a/crypto/ext4crypt/Decrypt.cpp +++ b/crypto/ext4crypt/Decrypt.cpp @@ -433,7 +433,8 @@ sp<IBinder> getKeystoreBinderRetry() { namespace keystore { -#define SYNTHETIC_PASSWORD_VERSION 1 +#define SYNTHETIC_PASSWORD_VERSION_V1 1 +#define SYNTHETIC_PASSWORD_VERSION 2 #define SYNTHETIC_PASSWORD_PASSWORD_BASED 0 #define SYNTHETIC_PASSWORD_KEY_PREFIX "USRSKEY_synthetic_password_" @@ -542,186 +543,339 @@ std::string unwrapSyntheticPasswordBlob(const std::string& spblob_path, const st printf("Failed to read '%s'\n", spblob_file.c_str()); return disk_decryption_secret_key; } - const unsigned char* byteptr = (const unsigned char*)spblob_data.data(); - if (*byteptr != SYNTHETIC_PASSWORD_VERSION) { - printf("SYNTHETIC_PASSWORD_VERSION does not match\n"); + unsigned char* byteptr = (unsigned char*)spblob_data.data(); + if (*byteptr != SYNTHETIC_PASSWORD_VERSION && *byteptr != SYNTHETIC_PASSWORD_VERSION_V1) { + printf("Unsupported synthetic password version %i\n", *byteptr); return disk_decryption_secret_key; } + const unsigned char* synthetic_password_version = byteptr; byteptr++; if (*byteptr != SYNTHETIC_PASSWORD_PASSWORD_BASED) { printf("spblob data is not SYNTHETIC_PASSWORD_PASSWORD_BASED\n"); return disk_decryption_secret_key; } byteptr++; // Now we're pointing to the blob data itself - /* We're now going to handle decryptSPBlob: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#115 - * Called from https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#879 - * This small function ends up being quite a headache. The call to get data from the keystore basically is not needed in TWRP at this time. - * The keystore data seems to be the serialized data from an entire class in Java. Specifically I think it represents: - * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java - * or perhaps - * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java - * but the only things we "need" from this keystore are a user ID and the keyAlias which ends up being USRSKEY_synthetic_password_{handle_str} - * the latter of which we already have. We may need to figure out how to get the user ID if we ever support decrypting mulitple users. - * There are 2 calls to a Java decrypt funcion that is overloaded. These 2 calls go in completely different directions despite the seemingly - * similar use of decrypt() and decrypt parameters. To figure out where things were going, I added logging to: - * https://android.googlesource.com/platform/libcore/+/android-8.0.0_r23/ojluni/src/main/java/javax/crypto/Cipher.java#2575 - * Logger.global.severe("Cipher tryCombinations " + prov.getName() + " - " + prov.getInfo()); - * To make logging work in libcore, import java.util.logging.Logger; and either set a better logging level or modify the framework to log everything - * regardless of logging level. This will give you some strings that you can grep for and find the actual crypto provider in use. In our case there were - * 2 different providers in use. The first stage to get the intermediate key used: - * https://android.googlesource.com/platform/external/conscrypt/+/android-8.0.0_r23/common/src/main/java/org/conscrypt/OpenSSLProvider.java - * which is a pretty straight-forward OpenSSL implementation of AES/GCM/NoPadding. */ - // First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102 - void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size); - if (!personalized_application_id) { - printf("malloc personalized_application_id\n"); - return disk_decryption_secret_key; - } - //printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n"); - // Now we'll decrypt using openssl AES/GCM/NoPadding - OpenSSL_add_all_ciphers(); - int actual_size=0, final_size=0; - EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new(); - const unsigned char* iv = (const unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob - //printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n"); - const unsigned char* cipher_text = (const unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV - //printf("cipher_text: "); output_hex((const unsigned char*)cipher_text, spblob_data.size() - 2 - 12); printf("\n"); - const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID - //printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n"); - EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, iv); - std::vector<unsigned char> intermediate_key; - intermediate_key.resize(spblob_data.size() - 2 - 12, '\0'); - EVP_DecryptUpdate(d_ctx, &intermediate_key[0], &actual_size, cipher_text, spblob_data.size() - 2 - 12); - unsigned char tag[AES_BLOCK_SIZE]; - EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag); - EVP_DecryptFinal_ex(d_ctx, &intermediate_key[actual_size], &final_size); - EVP_CIPHER_CTX_free(d_ctx); - free(personalized_application_id); - //printf("spblob_data size: %lu actual_size %i, final_size: %i\n", spblob_data.size(), actual_size, final_size); - intermediate_key.resize(actual_size + final_size - 16, '\0');// not sure why we have to trim the size by 16 as I don't see where this is done in Java side - //printf("intermediate key: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n"); - - // When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation - if (auth_token_len > 0) { - /*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len); - if (!auth_result.isOk()) { - // The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0 - printf("keystore error adding auth token\n"); - return disk_decryption_secret_key; - }*/ - // The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and - // run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be - // deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if - // the /auth_token file never gets deleted. - int auth_wait_count = 20; - while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0) - usleep(5000); - if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) { - printf("error during keymaster_auth service\n"); - /* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc - * service keystore_auth /sbin/keystore_auth - * disabled - * oneshot - * user system - * group root - * seclabel u:r:recovery:s0 - * - * And check dmesg for error codes regarding this service if needed. */ + if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION_V1) { + printf("spblob v1\n"); + /* We're now going to handle decryptSPBlob: https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#115 + * Called from https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#879 + * This small function ends up being quite a headache. The call to get data from the keystore basically is not needed in TWRP at this time. + * The keystore data seems to be the serialized data from an entire class in Java. Specifically I think it represents: + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java + * or perhaps + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java + * but the only things we "need" from this keystore are a user ID and the keyAlias which ends up being USRSKEY_synthetic_password_{handle_str} + * the latter of which we already have. We may need to figure out how to get the user ID if we ever support decrypting mulitple users. + * There are 2 calls to a Java decrypt funcion that is overloaded. These 2 calls go in completely different directions despite the seemingly + * similar use of decrypt() and decrypt parameters. To figure out where things were going, I added logging to: + * https://android.googlesource.com/platform/libcore/+/android-8.0.0_r23/ojluni/src/main/java/javax/crypto/Cipher.java#2575 + * Logger.global.severe("Cipher tryCombinations " + prov.getName() + " - " + prov.getInfo()); + * To make logging work in libcore, import java.util.logging.Logger; and either set a better logging level or modify the framework to log everything + * regardless of logging level. This will give you some strings that you can grep for and find the actual crypto provider in use. In our case there were + * 2 different providers in use. The first stage to get the intermediate key used: + * https://android.googlesource.com/platform/external/conscrypt/+/android-8.0.0_r23/common/src/main/java/org/conscrypt/OpenSSLProvider.java + * which is a pretty straight-forward OpenSSL implementation of AES/GCM/NoPadding. */ + // First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102 + void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size); + if (!personalized_application_id) { + printf("malloc personalized_application_id\n"); return disk_decryption_secret_key; } - } + //printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n"); + // Now we'll decrypt using openssl AES/GCM/NoPadding + OpenSSL_add_all_ciphers(); + int actual_size=0, final_size=0; + EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new(); + const unsigned char* iv = (const unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob + //printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n"); + const unsigned char* cipher_text = (const unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV + //printf("cipher_text: "); output_hex((const unsigned char*)cipher_text, spblob_data.size() - 2 - 12); printf("\n"); + const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID + //printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n"); + EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, iv); + std::vector<unsigned char> intermediate_key; + intermediate_key.resize(spblob_data.size() - 2 - 12, '\0'); + EVP_DecryptUpdate(d_ctx, &intermediate_key[0], &actual_size, cipher_text, spblob_data.size() - 2 - 12); + unsigned char tag[AES_BLOCK_SIZE]; + EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag); + EVP_DecryptFinal_ex(d_ctx, &intermediate_key[actual_size], &final_size); + EVP_CIPHER_CTX_free(d_ctx); + free(personalized_application_id); + //printf("spblob_data size: %lu actual_size %i, final_size: %i\n", spblob_data.size(), actual_size, final_size); + intermediate_key.resize(actual_size + final_size - 16, '\0');// not sure why we have to trim the size by 16 as I don't see where this is done in Java side + //printf("intermediate key: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n"); + + // When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation + if (auth_token_len > 0) { + /*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len); + if (!auth_result.isOk()) { + // The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0 + printf("keystore error adding auth token\n"); + return disk_decryption_secret_key; + }*/ + // The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and + // run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be + // deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if + // the /auth_token file never gets deleted. + int auth_wait_count = 20; + while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0) + usleep(5000); + if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) { + printf("error during keymaster_auth service\n"); + /* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc + * service keystore_auth /sbin/keystore_auth + * disabled + * oneshot + * user system + * group root + * seclabel u:r:recovery:s0 + * + * And check dmesg for error codes regarding this service if needed. */ + return disk_decryption_secret_key; + } + } - int32_t ret; + int32_t ret; - /* We only need a keyAlias which is USRSKEY_synthetic_password_b6f71045af7bd042 which we find and a uid which is -1 or 1000, I forget which - * as the key data will be read again by the begin function later via the keystore. - * The data is in a hidl_vec format which consists of a type and a value. */ - /*::keystore::hidl_vec<uint8_t> data; - std::string keystoreid = SYNTHETIC_PASSWORD_KEY_PREFIX; - keystoreid += handle_str; + /* We only need a keyAlias which is USRSKEY_synthetic_password_b6f71045af7bd042 which we find and a uid which is -1 or 1000, I forget which + * as the key data will be read again by the begin function later via the keystore. + * The data is in a hidl_vec format which consists of a type and a value. */ + /*::keystore::hidl_vec<uint8_t> data; + std::string keystoreid = SYNTHETIC_PASSWORD_KEY_PREFIX; + keystoreid += handle_str; - ret = service->get(String16(keystoreid.c_str()), user_id, &data); - if (ret < 0) { - printf("Could not connect to keystore service %i\n", ret); - return disk_decryption_secret_key; - } else if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*//*) { - printf("keystore error: (%d)\n", /*responses[ret],*//* ret); - return disk_decryption_secret_key; - } else { - printf("keystore returned: "); output_hex(&data[0], data.size()); printf("\n"); - }*/ - - // Now we'll break up the intermediate key into the IV (first 12 bytes) and the cipher text (the rest of it). - std::vector<unsigned char> nonce = intermediate_key; - nonce.resize(12); - intermediate_key.erase (intermediate_key.begin(),intermediate_key.begin()+12); - //printf("nonce: "); output_hex((const unsigned char*)nonce.data(), nonce.size()); printf("\n"); - //printf("cipher text: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n"); - - /* Now we will begin the second decrypt call found in - * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#122 - * This time we will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java - * and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java - * First we set some algorithm parameters as seen in two places: - * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297 - * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */ - size_t maclen = 128; - ::keystore::AuthorizationSetBuilder begin_params; - begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES); - begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM); - begin_params.Padding(::keystore::PaddingMode::NONE); - begin_params.Authorization(::keystore::TAG_NONCE, nonce); - begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen); - //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); - //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, mKeymasterBlockMode); - //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_PADDING, mKeymasterPadding); - //keymasterArgs.addUnsignedInt(KeymasterDefs.KM_TAG_MAC_LENGTH, mTagLengthBits); - ::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt - entropy.resize(0); - std::string keystore_alias = SYNTHETIC_PASSWORD_KEY_PREFIX; - keystore_alias += keystore_alias_subid; - String16 keystore_alias16(keystore_alias.c_str()); - ::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT; - OperationResult begin_result; - // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63 - service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result); - ret = begin_result.resultCode; - if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { - printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret); - return disk_decryption_secret_key; - } else { - //printf("keystore begin operation successful\n"); - } - ::keystore::hidl_vec<::keystore::KeyParameter> empty_params; - empty_params.resize(0); - OperationResult update_result; - // The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64 - // See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208 - service->update(begin_result.token, empty_params, intermediate_key, &update_result); - ret = update_result.resultCode; - if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { - printf("keystore update error: (%d)\n", /*responses[ret],*/ ret); + ret = service->get(String16(keystoreid.c_str()), user_id, &data); + if (ret < 0) { + printf("Could not connect to keystore service %i\n", ret); + return disk_decryption_secret_key; + } else if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*//*) { + printf("keystore error: (%d)\n", /*responses[ret],*//* ret); + return disk_decryption_secret_key; + } else { + printf("keystore returned: "); output_hex(&data[0], data.size()); printf("\n"); + }*/ + + // Now we'll break up the intermediate key into the IV (first 12 bytes) and the cipher text (the rest of it). + std::vector<unsigned char> nonce = intermediate_key; + nonce.resize(12); + intermediate_key.erase (intermediate_key.begin(),intermediate_key.begin()+12); + //printf("nonce: "); output_hex((const unsigned char*)nonce.data(), nonce.size()); printf("\n"); + //printf("cipher text: "); output_hex((const unsigned char*)intermediate_key.data(), intermediate_key.size()); printf("\n"); + + /* Now we will begin the second decrypt call found in + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#122 + * This time we will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java + * and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java + * First we set some algorithm parameters as seen in two places: + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297 + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */ + size_t maclen = 128; + ::keystore::AuthorizationSetBuilder begin_params; + begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES); + begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM); + begin_params.Padding(::keystore::PaddingMode::NONE); + begin_params.Authorization(::keystore::TAG_NONCE, nonce); + begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen); + //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_AES); + //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_BLOCK_MODE, mKeymasterBlockMode); + //keymasterArgs.addEnum(KeymasterDefs.KM_TAG_PADDING, mKeymasterPadding); + //keymasterArgs.addUnsignedInt(KeymasterDefs.KM_TAG_MAC_LENGTH, mTagLengthBits); + ::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt + entropy.resize(0); + std::string keystore_alias = SYNTHETIC_PASSWORD_KEY_PREFIX; + keystore_alias += keystore_alias_subid; + String16 keystore_alias16(keystore_alias.c_str()); + ::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT; + OperationResult begin_result; + // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63 + service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result); + ret = begin_result.resultCode; + if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { + printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret); + return disk_decryption_secret_key; + } else { + //printf("keystore begin operation successful\n"); + } + ::keystore::hidl_vec<::keystore::KeyParameter> empty_params; + empty_params.resize(0); + OperationResult update_result; + // The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64 + // See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208 + service->update(begin_result.token, empty_params, intermediate_key, &update_result); + ret = update_result.resultCode; + if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { + printf("keystore update error: (%d)\n", /*responses[ret],*/ ret); + return disk_decryption_secret_key; + } else { + //printf("keystore update operation successful\n"); + //printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password + } + // We must use the data in update_data.data before we call finish below or the data will be gone + // The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153 + // We now have the disk decryption key! + disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)&update_result.data[0], update_result.data.size()); + //printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str()); + ::keystore::hidl_vec<uint8_t> signature; + OperationResult finish_result; + service->finish(begin_result.token, empty_params, signature, entropy, &finish_result); + ret = finish_result.resultCode; + if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { + printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret); + return disk_decryption_secret_key; + } else { + //printf("keystore finish operation successful\n"); + } + stop_keystore(); return disk_decryption_secret_key; - } else { - //printf("keystore update operation successful\n"); - //printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password - } - // We must use the data in update_data.data before we call finish below or the data will be gone - // The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153 - // We now have the disk decryption key! - disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)&update_result.data[0], update_result.data.size()); - //printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str()); - ::keystore::hidl_vec<uint8_t> signature; - OperationResult finish_result; - service->finish(begin_result.token, empty_params, signature, entropy, &finish_result); - ret = finish_result.resultCode; - if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { - printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret); + } else if (*synthetic_password_version == SYNTHETIC_PASSWORD_VERSION) { + printf("spblob v2\n"); + /* Version 2 of the spblob is basically the same as version 1, but the order of getting the intermediate key and disk decryption key have been flip-flopped + * as seen in https://android.googlesource.com/platform/frameworks/base/+/5025791ac6d1538224e19189397de8d71dcb1a12 + */ + /* First decrypt call found in + * https://android.googlesource.com/platform/frameworks/base/+/android-8.1.0_r18/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#135 + * We will use https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreCipherSpiBase.java + * and https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java + * First we set some algorithm parameters as seen in two places: + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#297 + * https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/AndroidKeyStoreAuthenticatedAESCipherSpi.java#216 */ + // When using secdis (aka not weaver) you must supply an auth token to the keystore prior to the begin operation + if (auth_token_len > 0) { + /*::keystore::KeyStoreServiceReturnCode auth_result = service->addAuthToken(auth_token, auth_token_len); + if (!auth_result.isOk()) { + // The keystore checks the uid of the calling process and will return a permission denied on this operation for user 0 + printf("keystore error adding auth token\n"); + return disk_decryption_secret_key; + }*/ + // The keystore refuses to allow the root user to supply auth tokens, so we write the auth token to a file earlier and + // run a separate service that runs user the system user to add the auth token. We wait for the auth token file to be + // deleted by the keymaster_auth service and check for a /auth_error file in case of errors. We quit after after a while if + // the /auth_token file never gets deleted. + int auth_wait_count = 20; + while (access("/auth_token", F_OK) == 0 && auth_wait_count-- > 0) + usleep(5000); + if (auth_wait_count == 0 || access("/auth_error", F_OK) == 0) { + printf("error during keymaster_auth service\n"); + /* If you are getting this error, make sure that you have the keymaster_auth service defined in your init scripts, preferrably in init.recovery.{ro.hardware}.rc + * service keystore_auth /sbin/keystore_auth + * disabled + * oneshot + * user system + * group root + * seclabel u:r:recovery:s0 + * + * And check dmesg for error codes regarding this service if needed. */ + return disk_decryption_secret_key; + } + } + int32_t ret; + size_t maclen = 128; + unsigned char* iv = (unsigned char*)byteptr; // The IV is the first 12 bytes of the spblob + ::keystore::hidl_vec<uint8_t> iv_hidlvec; + iv_hidlvec.setToExternal((unsigned char*)byteptr, 12); + //printf("iv: "); output_hex((const unsigned char*)iv, 12); printf("\n"); + unsigned char* cipher_text = (unsigned char*)byteptr + 12; // The cipher text comes immediately after the IV + ::keystore::hidl_vec<uint8_t> cipher_text_hidlvec; + cipher_text_hidlvec.setToExternal(cipher_text, spblob_data.size() - 14 /* 1 each for version and SYNTHETIC_PASSWORD_PASSWORD_BASED and 12 for the iv */); + ::keystore::AuthorizationSetBuilder begin_params; + begin_params.Authorization(::keystore::TAG_ALGORITHM, ::keystore::Algorithm::AES); + begin_params.Authorization(::keystore::TAG_BLOCK_MODE, ::keystore::BlockMode::GCM); + begin_params.Padding(::keystore::PaddingMode::NONE); + begin_params.Authorization(::keystore::TAG_NONCE, iv_hidlvec); + begin_params.Authorization(::keystore::TAG_MAC_LENGTH, maclen); + ::keystore::hidl_vec<uint8_t> entropy; // No entropy is needed for decrypt + entropy.resize(0); + std::string keystore_alias = SYNTHETIC_PASSWORD_KEY_PREFIX; + keystore_alias += keystore_alias_subid; + String16 keystore_alias16(keystore_alias.c_str()); + ::keystore::KeyPurpose purpose = ::keystore::KeyPurpose::DECRYPT; + OperationResult begin_result; + // These parameters are mostly driven by the cipher.init call https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#63 + service->begin(binder, keystore_alias16, purpose, true, begin_params.hidl_data(), entropy, -1, &begin_result); + ret = begin_result.resultCode; + if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { + printf("keystore begin error: (%d)\n", /*responses[ret],*/ ret); + return disk_decryption_secret_key; + } /*else { + printf("keystore begin operation successful\n"); + }*/ + ::keystore::hidl_vec<::keystore::KeyParameter> empty_params; + empty_params.resize(0); + OperationResult update_result; + // The cipher.doFinal call triggers an update to the keystore followed by a finish https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#64 + // See also https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/keystore/java/android/security/keystore/KeyStoreCryptoOperationChunkedStreamer.java#208 + service->update(begin_result.token, empty_params, cipher_text_hidlvec, &update_result); + ret = update_result.resultCode; + if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { + printf("keystore update error: (%d)\n", /*responses[ret],*/ ret); + return disk_decryption_secret_key; + } /*else { + printf("keystore update operation successful\n"); + printf("keystore update returned: "); output_hex(&update_result.data[0], update_result.data.size()); printf("\n"); // this ends up being the synthetic password + }*/ + //printf("keystore resulting data: "); output_hex((unsigned char*)&update_result.data[0], update_result.data.size()); printf("\n"); + // We must copy the data in update_data.data before we call finish below or the data will be gone + size_t keystore_result_size = update_result.data.size(); + unsigned char* keystore_result = (unsigned char*)malloc(keystore_result_size); + if (!keystore_result) { + printf("malloc on keystore_result\n"); + return disk_decryption_secret_key; + } + memcpy(keystore_result, &update_result.data[0], update_result.data.size()); + //printf("keystore_result data: "); output_hex(keystore_result, keystore_result_size); printf("\n"); + ::keystore::hidl_vec<uint8_t> signature; + OperationResult finish_result; + service->finish(begin_result.token, empty_params, signature, entropy, &finish_result); + ret = finish_result.resultCode; + if (ret != 1 /*android::keystore::ResponseCode::NO_ERROR*/) { + printf("keystore finish error: (%d)\n", /*responses[ret],*/ ret); + free(keystore_result); + return disk_decryption_secret_key; + } /*else { + printf("keystore finish operation successful\n"); + }*/ + stop_keystore(); + + /* Now we do the second decrypt call as seen in: + * https://android.googlesource.com/platform/frameworks/base/+/android-8.1.0_r18/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#136 + */ + const unsigned char* intermediate_iv = keystore_result; + //printf("intermediate_iv: "); output_hex((const unsigned char*)intermediate_iv, 12); printf("\n"); + const unsigned char* intermediate_cipher_text = (const unsigned char*)keystore_result + 12; // The cipher text comes immediately after the IV + int cipher_size = keystore_result_size - 12; + //printf("intermediate_cipher_text: "); output_hex((const unsigned char*)intermediate_cipher_text, cipher_size); printf("\n"); + // First we personalize as seen https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordCrypto.java#102 + void* personalized_application_id = PersonalizedHashBinary(PERSONALISATION_APPLICATION_ID, (const char*)application_id, application_id_size); + if (!personalized_application_id) { + printf("malloc personalized_application_id\n"); + free(keystore_result); + return disk_decryption_secret_key; + } + //printf("personalized application id: "); output_hex((unsigned char*)personalized_application_id, SHA512_DIGEST_LENGTH); printf("\n"); + // Now we'll decrypt using openssl AES/GCM/NoPadding + OpenSSL_add_all_ciphers(); + int actual_size=0, final_size=0; + EVP_CIPHER_CTX *d_ctx = EVP_CIPHER_CTX_new(); + const unsigned char* key = (const unsigned char*)personalized_application_id; // The key is the now personalized copy of the application ID + //printf("key: "); output_hex((const unsigned char*)key, 32); printf("\n"); + EVP_DecryptInit(d_ctx, EVP_aes_256_gcm(), key, intermediate_iv); + unsigned char* secret_key = (unsigned char*)malloc(cipher_size); + EVP_DecryptUpdate(d_ctx, secret_key, &actual_size, intermediate_cipher_text, cipher_size); + unsigned char tag[AES_BLOCK_SIZE]; + EVP_CIPHER_CTX_ctrl(d_ctx, EVP_CTRL_GCM_SET_TAG, 16, tag); + EVP_DecryptFinal_ex(d_ctx, secret_key + actual_size, &final_size); + EVP_CIPHER_CTX_free(d_ctx); + free(personalized_application_id); + free(keystore_result); + int secret_key_real_size = actual_size - 16; + //printf("secret key: "); output_hex((const unsigned char*)secret_key, secret_key_real_size); printf("\n"); + // The payload data from the keystore update is further personalized at https://android.googlesource.com/platform/frameworks/base/+/android-8.0.0_r23/services/core/java/com/android/server/locksettings/SyntheticPasswordManager.java#153 + // We now have the disk decryption key! + disk_decryption_secret_key = PersonalizedHash(PERSONALIZATION_FBE_KEY, (const char*)secret_key, secret_key_real_size); + //printf("disk_decryption_secret_key: '%s'\n", disk_decryption_secret_key.c_str()); + free(secret_key); return disk_decryption_secret_key; - } else { - //printf("keystore finish operation successful\n"); } - stop_keystore(); return disk_decryption_secret_key; } |