Merge changes from topic "RKP_metrics" * changes: Add Security Level and the four key states to RkpPoolStats Remove obsolete keystore2 atoms.
diff --git a/stats/atoms.proto b/stats/atoms.proto index 4653f00..874b6f6 100644 --- a/stats/atoms.proto +++ b/stats/atoms.proto
@@ -507,10 +507,7 @@ RebootEscrowRebootReported reboot_escrow_reboot_reported = 341 [(module) = "framework"]; MediametricsMediaParserReported mediametrics_mediaparser_reported = 316; BinderLatencyReported binder_latency_reported = 342 [(module) = "framework"]; - Keystore2KeyCreationEventReported keystore2_key_creation_event_reported = 360; - Keystore2KeyOperationEventReported keystore2_key_operation_event_reported = 361; - Keystore2CrashEventReported keystore2_crash_event_reported = 362; - RkpErrorReported rkp_error_reported = 363; + // 360-363 are reserved. OdrefreshReported odrefresh_reported = 366 [(module) = "art"]; NetworkIpReachabilityMonitorReported network_ip_reachability_monitor_reported = 367 [(module) = "network_stack"]; @@ -12096,216 +12093,6 @@ } /** - * Logs: creation of different types of cryptographic keys in keystore2. - * Logged from: system/security/keystore2/metrics.rs - */ -message Keystore2KeyCreationEventReported { - - enum Algorithm { - // ALGORITHM is prepended because UNSPECIFIED exists in other enums as well. - ALGORITHM_UNSPECIFIED = 0; - // Asymmetric algorithms. - RSA = 1; - // 2 removed, do not reuse. - EC = 3; - // Block cipher algorithms - AES = 32; - TRIPLE_DES = 33; - // MAC algorithms - HMAC = 128; - }; - // Algorithm associated with the key - optional Algorithm algorithm = 1; - - // Size of the key, based on the algorithm used. - optional int32 key_size = 2; - - enum KeyOrigin { - // Unspecified takes 0. Other values are incremented by 1 compared to keymint spec. - ORIGIN_UNSPECIFIED = 0; - // Generated in keymaster. Should not exist outside the TEE. - GENERATED = 1; - // Derived inside keymaster. Likely exists off-device. - DERIVED = 2; - // Imported into keymaster. Existed as cleartext in Android. - IMPORTED = 3; - // Previously used for another purpose that is now obsolete. - RESERVED = 4; - // Securely imported into Keymaster. - SECURELY_IMPORTED = 5; - }; - // Logs whether the key was generated, imported, securely imported, or derived. - optional KeyOrigin key_origin = 3; - - enum HardwareAuthenticatorType { - // Unspecified takes 0. Other values are incremented by 1 compared to keymint spec. - AUTH_TYPE_UNSPECIFIED = 0; - NONE = 1; - PASSWORD = 2; - FINGERPRINT = 3; - ANY = 5; - }; - /** - * What auth types does this key require? If none, - * then no auth required. - */ - optional HardwareAuthenticatorType user_auth_type = 4; - - /** - * If user authentication is required, is the requirement time based? If it - * is time based then this field indicates the time out in seconds. - */ - optional int32 user_auth_key_timeout_seconds = 5; - - /** - * Padding mode, digest, block_mode and purpose should ideally be repeated - * fields. However, since statsd does not support repeated fields in - * pushed atoms, they are represented using bitmaps. - */ - - /** - * Track which padding mode is being used. - * Bitmap composition is given by PaddingModeBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 padding_mode_bitmap = 6; - - /** - * Track which digest is being used. - * Bitmap composition is given by DigestBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 digest_bitmap = 7; - - /** - * Track which block mode is being used. - * Bitmap composition is given by BlockModeBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 block_mode_bitmap = 8; - - /** - * Track which purpose is being used. - * Bitmap composition is given by KeyPurposeBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 purpose_bitmap = 9; - - enum EcCurve { - // Unspecified takes 0. Other values are incremented by 1 compared to keymint spec. - EC_CURVE_UNSPECIFIED = 0; - P_224 = 1; - P_256 = 2; - P_384 = 3; - P_521 = 4; - }; - // Which ec curve was selected if elliptic curve cryptography is in use - optional EcCurve ec_curve = 10; - - /** - * Response code (system/hardware/interfaces/keystore2/aidl/../ResponseCode.aidl) - * or - * error code (hardware/interfaces/security/keymint/aidl/../ErrorCode.aidl) - */ - optional int32 error_code = 11; - - // Indicates whether key attestation requested in creation - optional bool attestation_requested = 12; - - // Security level of the Keymint instance which creates the key. - optional android.system.security.keystore2.SecurityLevelEnum security_level = 13; -} - -/** - * Logs operations using cryptographic keys in keystore2. - * Logged from: system/security/keystore2/metrics.rs - */ -message Keystore2KeyOperationEventReported { - - enum KeyPurpose { - // Unspecified takes 0. Other values are incremented by 1 compared to keymint spec. - KEY_PURPOSE_UNSPECIFIED = 0; - - // Usable with RSA, EC and AES keys. - ENCRYPT = 1; - - // Usable with RSA, EC and AES keys. - DECRYPT = 2; - - // Usable with RSA, EC and HMAC keys. - SIGN = 3; - - // Usable with RSA, EC and HMAC keys. - VERIFY = 4; - - // 5 is reserved - // Usable with wrapping keys. - WRAP_KEY = 6; - - // Key Agreement, usable with EC keys. - AGREE_KEY = 7; - - // Usable as an attestation signing key. - ATTEST_KEY = 8; - } - // Purpose of the key operation - optional KeyPurpose purpose = 1; - - /** - * Padding mode, digest, block_mode and purpose should ideally be repeated - * fields. However, since statsd does not support repeated fields in - * pushed atoms, they are represented using bitmaps. - */ - - /** - * Track which padding mode is being used. - * Bitmap composition is given by PaddingModeBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 padding_mode_bitmap = 2; - - /** - * Track which digest is being used. - * Bitmap composition is given by DigestBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 digest_bitmap = 3; - - /** - * Track which block mode is being used. - * Bitmap composition is given by BlockModeBitPosition enum - * defined in system/security/keystore2/metrics.rs. - */ - optional int32 block_mode_bitmap = 4; - - enum Outcome { - OUTCOME_UNSPECIFIED = 0; - DROPPED = 1; - SUCCESS = 2; - ABORT = 3; - PRUNED = 4; - ERROR = 5; - } - // Outcome of the operation - optional Outcome outcome = 5; - - // Response code or error code in case of error outcome - optional int32 error_code = 6; - - // Indicates whether the key was upgraded during the operation - optional bool key_upgraded = 7; - - // Security level of the Keymint instance which performs the operation. - optional android.system.security.keystore2.SecurityLevelEnum security_level = 8; -} - -/** - * Logs: Keystore 2 crash events. - * Logged from: system/security/keystore2 - */ -message Keystore2CrashEventReported {} - -/** * Logs: key creation events with Algorithm, Origin, Error and Attestation info. * Logged from: system/security/keystore2/metrics.rs */ @@ -12579,23 +12366,6 @@ * Logs Remote Key Provisioning (RKP) related error events. * Logged from: system/security/keystore2 */ -message RkpErrorReported { - - enum RkpErrorEvent { - RKP_ERROR_UNSPECIFIED = 0; - // The key pool is out of keys. - OUT_OF_KEYS = 1; - // Falling back to factory provisioned keys during hybrid mode. - FALL_BACK_DURING_HYBRID = 2; - } - // Type of the error event - optional RkpErrorEvent rkp_error_event = 1; -} - -/** - * Logs Remote Key Provisioning (RKP) related error events. - * Logged from: system/security/keystore2 - */ message RkpErrorStats { enum RkpError { @@ -12613,22 +12383,39 @@ } /** - * Logs: Count of keys in the key pool related to + * Logs: Status of the attestation key pool related to * Remote Key Provisioning (RKP). * Logged from: system/security/keystore2 */ message RkpPoolStats { - enum PoolStatus { - EXPIRING = 1; - UNASSIGNED = 2; - ATTESTED = 3; - TOTAL = 4; - } - // State of the attestation key pool, for which the count of keys is reported. - optional PoolStatus pool_status = 1; + /** + * Security level of the Keymint instance associated with the + * attestation pool status. + */ + optional android.system.security.keystore2.SecurityLevelEnum security_level = 1; - // Count of keys in the particular status - optional int32 count_of_keys = 2; + /** + * The number of signed attestation certificate chains which are + * expired. + */ + optional int32 expiring = 2; + + /** + * The number of signed attestation certificate chains which have + * not yet been assigned to an app. + */ + optional int32 unassigned = 3; + + /** + * The number of signed attestation keys. + */ + optional int32 attested = 4; + + /** + * The total number of attestation keys. + */ + optional int32 total = 5; + } /**