cleanup android key agreement auth

a-sit-plus · Jan 14, 2025 · f77d295 · f77d295
1 parent 496dd0b
commit f77d295
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 32 deletions.
diff --git a/docs/docs/features.md b/docs/docs/features.md
@@ -52,6 +52,7 @@ from certain (otherwise) hard requirements for Devices launched with later Andro
 Hence, a device launched with Android&nbsp;10, and later updated to Android&nbsp;12 may still not support key agreement in
 hardware.
 The Supreme crypto provider will return a failure, in if key agreement is not supported in hardware.
+TODO: will fail for auth on every use! Bug in Android; fix hidden behind a feature flag
 
 ## Supported Algorithms
 

diff --git a/supreme/src/androidMain/kotlin/at/asitplus/signum/supreme/agreement/KeyAgreement.android.kt b/supreme/src/androidMain/kotlin/at/asitplus/signum/supreme/agreement/KeyAgreement.android.kt
@@ -15,6 +15,7 @@ import at.asitplus.signum.supreme.os.PlatformSigningProvider
 import at.asitplus.signum.supreme.os.PlatformSigningProviderSignerSigningConfigurationBase
 import at.asitplus.signum.supreme.os.needsAuthenticationForEveryUse
 import at.asitplus.signum.supreme.sign.Signer
+import org.w3c.dom.Notation
 
 actual suspend fun Signer.ECDSA.performAgreement(
     publicKey: CryptoPublicKey.EC,
@@ -24,31 +25,22 @@ actual suspend fun Signer.ECDSA.performAgreement(
 
     return if (this is AndroidKeystoreSigner) {
         val resolvedConfig = DSL.resolve(::AndroidSignerSigningConfiguration, config)
-        javax.crypto.KeyAgreement.getInstance("ECDH", "AndroidKeyStore").also {
-
-            if (needsAuthenticationForEveryUse) {
+        val agreement = javax.crypto.KeyAgreement.getInstance("ECDH", "AndroidKeyStore").also {
+            try {
                 it.init(jcaPrivateKey)
+            } catch (_: UserNotAuthenticatedException) {
                 attemptBiometry(
-                    DSL.ConfigStack(resolvedConfig.unlockPrompt.v, resolvedConfig.unlockPrompt.v),
-                    null //TODO ????
+                    DSL.ConfigStack(
+                        resolvedConfig.unlockPrompt.v,
+                        resolvedConfig.unlockPrompt.v //TODO
+                    ),
+                    null
                 )
-            } else {
-                try {
-                    it.init(jcaPrivateKey)
-                } catch (_: UserNotAuthenticatedException) {
-                    attemptBiometry(
-                        DSL.ConfigStack(
-                            resolvedConfig.unlockPrompt.v,
-                            resolvedConfig.unlockPrompt.v
-                        ),
-                        null
-                    )
-                    it.init(jcaPrivateKey)
-                }
+                it.init(jcaPrivateKey)
             }
-            it.doPhase(publicKey.toJcaPublicKey().getOrThrow(), true)
-        }.generateSecret()
-
+        }
+        agreement.doPhase(publicKey.toJcaPublicKey().getOrThrow(), true)
+        agreement.generateSecret()
     } else {
         javax.crypto.KeyAgreement.getInstance("ECDH", "AndroidKeyStore").also {
             @OptIn(HazardousMaterials::class)

diff --git a/supreme/src/androidMain/kotlin/at/asitplus/signum/supreme/os/AndroidKeyStoreProvider.kt b/supreme/src/androidMain/kotlin/at/asitplus/signum/supreme/os/AndroidKeyStoreProvider.kt
@@ -215,7 +215,7 @@ object AndroidKeyStoreProvider:
         KeyPairGenerator.getInstance(when(config._algSpecific.v) {
             is SigningKeyConfiguration.RSAConfiguration -> KeyProperties.KEY_ALGORITHM_RSA
             is SigningKeyConfiguration.ECConfiguration -> KeyProperties.KEY_ALGORITHM_EC
-        }, "AndroidKeyStore").apply {
+        }, "AndroidKeyStore"/*TODO not for ephemeral key*/).apply {
             initialize(spec)
         }.generateKeyPair()
         return@catching getSignerForKey(alias, config.signer.v).getOrThrow()

diff --git a/supreme/src/commonMain/kotlin/at/asitplus/signum/supreme/agreement/KeyAgreement.kt b/supreme/src/commonMain/kotlin/at/asitplus/signum/supreme/agreement/KeyAgreement.kt
@@ -26,6 +26,18 @@ suspend fun Signer.ECDSA.keyAgreement(
     performAgreement(publicKey, config)
 }
 
+/**
+ * Elliptic-curve Diffie-Hellman key agreement.
+ * Curves of public key and signer need to match!
+ *
+ * [config] can be used to display a custom authentication prompt
+ */
+suspend fun CryptoPublicKey.EC.keyAgreement(
+    signer: Signer.ECDSA,
+    config: DSLConfigureFn<PlatformSigningProviderSignerSigningConfigurationBase> = null
+) = signer.keyAgreement(this, config)
+
+
 /**
  * Elliptic-curve Diffie-Hellman key agreement.
  * Curves of public key and signer need to match!
@@ -44,16 +56,6 @@ suspend fun CryptoPrivateKey.WithPublicKey<CryptoPublicKey.EC>.keyAgreement(publ
 suspend fun CryptoPublicKey.EC.keyAgreement(privateKey: CryptoPrivateKey.WithPublicKey<CryptoPublicKey.EC>) =
     privateKey.keyAgreement(this)
 
-/**
- * Elliptic-curve Diffie-Hellman key agreement.
- * Curves of public key and signer need to match!
- *
- * [config] can be used to display a custom authentication prompt
- */
-suspend fun CryptoPublicKey.EC.keyAgreement(
-    signer: Signer.ECDSA,
-    config: DSLConfigureFn<PlatformSigningProviderSignerSigningConfigurationBase> = null
-) = signer.keyAgreement(this, config)
 
 internal expect suspend fun Signer.ECDSA.performAgreement(
     publicKey: CryptoPublicKey.EC,