arc/keymint/conversion.cc

// Copyright 2023 The ChromiumOS Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "arc/keymint/conversion.h"

#include <algorithm>
#include <utility>

namespace arc::keymint {

namespace {

class KmParamSet {
 public:
  explicit KmParamSet(
      const std::vector<arc::mojom::keymint::KeyParameterPtr>& data) {
    param_set_.params = new keymaster_key_param_t[data.size()];
    param_set_.length = data.size();
    for (size_t i = 0; i < data.size(); ++i) {
      keymaster_tag_t tag = ConvertEnum(data[i]->tag);
      switch (keymaster_tag_get_type(tag)) {
        case KM_ENUM:
        case KM_ENUM_REP:
          param_set_.params[i] = ConvertEnum(data[i]);
          break;
        case KM_UINT:
        case KM_UINT_REP:
          if (data[i]->value->is_integer()) {
            param_set_.params[i] =
                keymaster_param_int(tag, data[i]->value->get_integer());
          } else {
            param_set_.params[i].tag = KM_TAG_INVALID;
          }
          break;
        case KM_ULONG:
        case KM_ULONG_REP:
          if (data[i]->value->is_long_integer()) {
            param_set_.params[i] =
                keymaster_param_long(tag, data[i]->value->get_long_integer());
          } else {
            param_set_.params[i].tag = KM_TAG_INVALID;
          }
          break;
        case KM_DATE:
          if (data[i]->value->is_date_time()) {
            param_set_.params[i] =
                keymaster_param_date(tag, data[i]->value->get_date_time());
          } else {
            param_set_.params[i].tag = KM_TAG_INVALID;
          }
          break;
        case KM_BOOL:
          if (data[i]->value->is_bool_value() &&
              data[i]->value->get_bool_value()) {
            // This function takes a single argument. Default value is TRUE.
            param_set_.params[i] = keymaster_param_bool(tag);
          } else {
            param_set_.params[i].tag = KM_TAG_INVALID;
          }
          break;
        case KM_BIGNUM:
        case KM_BYTES:
          if (data[i]->value->is_blob()) {
            param_set_.params[i] =
                keymaster_param_blob(tag, data[i]->value->get_blob().data(),
                                     data[i]->value->get_blob().size());
          } else {
            param_set_.params[i].tag = KM_TAG_INVALID;
          }
          break;
        case KM_INVALID:
        default:
          param_set_.params[i].tag = KM_TAG_INVALID;
          // just skip
          break;
      }
    }
  }

  KmParamSet(KmParamSet&& other)
      : param_set_{other.param_set_.params, other.param_set_.length} {
    other.param_set_.length = 0;
    other.param_set_.params = nullptr;
  }
  KmParamSet(const KmParamSet&) = delete;
  KmParamSet& operator=(const KmParamSet&) = delete;

  ~KmParamSet() { delete[] param_set_.params; }

  inline const keymaster_key_param_set_t& param_set() const {
    return param_set_;
  }

 private:
  keymaster_key_param_set_t param_set_;
};

}  // namespace

std::vector<uint8_t> authToken2AidlVec(
    const arc::mojom::keymint::HardwareAuthToken& token) {
  static_assert(
      1 /* version size */ + sizeof(token.challenge) + sizeof(token.user_id) +
              sizeof(token.authenticator_id) +
              sizeof(token.authenticator_type) + sizeof(*token.timestamp) +
              32 /* HMAC size */
          == sizeof(hw_auth_token_t),
      "HardwareAuthToken content size does not match hw_auth_token_t size");

  std::vector<uint8_t> result;

  if (token.mac.size() != 32) {
    return result;
  }

  result.resize(sizeof(hw_auth_token_t));
  auto pos = result.begin();
  *pos++ = 0;  // Version byte
  pos = copy_bytes_to_iterator(token.challenge, pos);
  pos = copy_bytes_to_iterator(token.user_id, pos);
  pos = copy_bytes_to_iterator(token.authenticator_id, pos);
  pos = copy_bytes_to_iterator(
      ::keymaster::hton(static_cast<uint32_t>(token.authenticator_type)), pos);
  pos = copy_bytes_to_iterator(
      ::keymaster::hton(token.timestamp->milli_seconds), pos);
  pos = std::copy(token.mac.data(), token.mac.data() + token.mac.size(), pos);

  return result;
}

// TODO(b/274723521) : Add more required ConvertEnum functions for KeyMint
// Server.
keymaster_tag_t ConvertEnum(arc::mojom::keymint::Tag tag) {
  return static_cast<keymaster_tag_t>(tag);
}

arc::mojom::keymint::Tag ConvertKeymasterTag(keymaster_tag_t tag) {
  return static_cast<arc::mojom::keymint::Tag>(tag);
}

keymaster_key_format_t ConvertEnum(arc::mojom::keymint::KeyFormat key_format) {
  return static_cast<keymaster_key_format_t>(key_format);
}

keymaster_purpose_t ConvertEnum(arc::mojom::keymint::KeyPurpose key_purpose) {
  return static_cast<keymaster_purpose_t>(key_purpose);
}

keymaster_key_param_t kInvalidKeyParam{.tag = KM_TAG_INVALID, .integer = 0};

keymaster_key_param_t ConvertEnum(
    const arc::mojom::keymint::KeyParameterPtr& param) {
  if (param.is_null() || param->value.is_null()) {
    return kInvalidKeyParam;
  }

  keymaster_tag_t tag = ConvertEnum(param->tag);
  switch (tag) {
    case KM_TAG_PURPOSE:
      if (param->value->is_key_purpose() &&
          param->value->get_key_purpose() !=
              arc::mojom::keymint::KeyPurpose::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_key_purpose()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_ALGORITHM:
      if (param->value->is_algorithm() &&
          param->value->get_algorithm() !=
              arc::mojom::keymint::Algorithm::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_algorithm()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_BLOCK_MODE:
      if (param->value->is_block_mode() &&
          param->value->get_block_mode() !=
              arc::mojom::keymint::BlockMode::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_block_mode()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_DIGEST:
    case KM_TAG_RSA_OAEP_MGF_DIGEST:
      if (param->value->is_digest() &&
          param->value->get_digest() != arc::mojom::keymint::Digest::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_digest()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_PADDING:
      if (param->value->is_padding_mode() &&
          param->value->get_padding_mode() !=
              arc::mojom::keymint::PaddingMode::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_padding_mode()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_EC_CURVE:
      if (param->value->is_ec_curve() &&
          param->value->get_ec_curve() !=
              arc::mojom::keymint::EcCurve::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_ec_curve()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_USER_AUTH_TYPE:
      if (param->value->is_hardware_authenticator_type() &&
          param->value->get_hardware_authenticator_type() !=
              arc::mojom::keymint::HardwareAuthenticatorType::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(
                     param->value->get_hardware_authenticator_type()));
      } else {
        return kInvalidKeyParam;
      }
      break;

    case KM_TAG_ORIGIN:
      if (param->value->is_origin() &&
          param->value->get_origin() !=
              arc::mojom::keymint::KeyOrigin::UNKNOWN) {
        return keymaster_param_enum(
            tag, static_cast<uint32_t>(param->value->get_origin()));
      } else {
        return kInvalidKeyParam;
      }
      break;
    // The 2 Cases below are unused.
    case KM_TAG_BLOB_USAGE_REQUIREMENTS:
    case KM_TAG_KDF:

    default:
      CHECK(false) << "Unknown or unused enum tag: Something is broken";
      LOG(ERROR) << "Unknown or unused enum tag: " << tag;
      return kInvalidKeyParam;
  }
}

std::vector<uint8_t> ConvertFromKeymasterMessage(const uint8_t* data,
                                                 const size_t size) {
  return std::vector<uint8_t>(data, data + size);
}

std::vector<arc::mojom::keymint::CertificatePtr> ConvertFromKeymasterMessage(
    const ::keymaster::CertificateChain& cert_chain) {
  std::vector<arc::mojom::keymint::CertificatePtr> out;
  if (cert_chain.entry_count == 0 || cert_chain.entries == nullptr) {
    return out;
  }

  out.reserve(cert_chain.entry_count);

  for (size_t i = 0; i < cert_chain.entry_count; ++i) {
    const auto& entry = cert_chain.entries[i];
    auto cert_vector =
        ConvertFromKeymasterMessage(entry.data, entry.data_length);
    auto mojo_cert =
        arc::mojom::keymint::Certificate::New(std::move(cert_vector));
    out.push_back(std::move(mojo_cert));
  }
  return out;
}

arc::mojom::keymint::KeyParameterValuePtr ConvertEnumParamFromKeymasterMessage(
    const keymaster_key_param_t& param) {
  keymaster_tag_t tag = param.tag;
  keymaster_tag_type_t tag_type = keymaster_tag_get_type(tag);

  arc::mojom::keymint::KeyParameterValuePtr out;
  if (tag_type != KM_ENUM && tag_type != KM_ENUM_REP) {
    LOG(ERROR) << "Mismatched Tag type received. Expected ENUM or ENUM_REP";
    return arc::mojom::keymint::KeyParameterValue::NewInvalid(
        static_cast<uint32_t>(param.enumerated));
  }

  switch (tag) {
    case KM_TAG_PURPOSE:
      out = arc::mojom::keymint::KeyParameterValue::NewKeyPurpose(
          static_cast<arc::mojom::keymint::KeyPurpose>(param.enumerated));
      break;
    case KM_TAG_ALGORITHM:
      out = arc::mojom::keymint::KeyParameterValue::NewAlgorithm(
          static_cast<arc::mojom::keymint::Algorithm>(param.enumerated));
      break;
    case KM_TAG_BLOCK_MODE:
      out = arc::mojom::keymint::KeyParameterValue::NewBlockMode(
          static_cast<arc::mojom::keymint::BlockMode>(param.enumerated));
      break;
    case KM_TAG_DIGEST:
    case KM_TAG_RSA_OAEP_MGF_DIGEST:
      out = arc::mojom::keymint::KeyParameterValue::NewDigest(
          static_cast<arc::mojom::keymint::Digest>(param.enumerated));
      break;
    case KM_TAG_PADDING:
      out = arc::mojom::keymint::KeyParameterValue::NewPaddingMode(
          static_cast<arc::mojom::keymint::PaddingMode>(param.enumerated));
      break;
    case KM_TAG_EC_CURVE:
      out = arc::mojom::keymint::KeyParameterValue::NewEcCurve(
          static_cast<arc::mojom::keymint::EcCurve>(param.enumerated));
      break;
    case KM_TAG_USER_AUTH_TYPE:
      out =
          arc::mojom::keymint::KeyParameterValue::NewHardwareAuthenticatorType(
              static_cast<arc::mojom::keymint::HardwareAuthenticatorType>(
                  param.enumerated));
      break;
    case KM_TAG_ORIGIN:
      out = arc::mojom::keymint::KeyParameterValue::NewOrigin(
          static_cast<arc::mojom::keymint::KeyOrigin>(param.enumerated));
      break;

    // The 2 Cases below are unused.
    case KM_TAG_BLOB_USAGE_REQUIREMENTS:
    case KM_TAG_KDF:

    default:
      CHECK(false) << "Unknown or unused enum tag: Something is broken";
      LOG(ERROR) << "Unknown or unused enum tag: " << tag;
      out = arc::mojom::keymint::KeyParameterValue::NewInvalid(
          static_cast<uint32_t>(param.enumerated));
  }
  return out;
}

std::vector<arc::mojom::keymint::KeyParameterPtr> ConvertFromKeymasterMessage(
    const keymaster_key_param_set_t& param_set) {
  if (param_set.length == 0 || !param_set.params) {
    return std::vector<arc::mojom::keymint::KeyParameterPtr>();
  }

  std::vector<arc::mojom::keymint::KeyParameterPtr> out(param_set.length);
  const keymaster_key_param_t* params = param_set.params;

  for (size_t i = 0; i < param_set.length; ++i) {
    keymaster_tag_t tag = params[i].tag;
    arc::mojom::keymint::KeyParameterValuePtr param;
    switch (keymaster_tag_get_type(tag)) {
      case KM_ENUM:
      case KM_ENUM_REP:
        param = ConvertEnumParamFromKeymasterMessage(params[i]);
        break;
      case KM_UINT:
      case KM_UINT_REP:
        param = arc::mojom::keymint::KeyParameterValue::NewInteger(
            params[i].integer);
        break;
      case KM_ULONG:
      case KM_ULONG_REP:
        param = arc::mojom::keymint::KeyParameterValue::NewLongInteger(
            params[i].long_integer);
        break;
      case KM_DATE:
        param = arc::mojom::keymint::KeyParameterValue::NewDateTime(
            params[i].date_time);
        break;
      case KM_BOOL:
        param = arc::mojom::keymint::KeyParameterValue::NewBoolValue(
            params[i].boolean);
        break;
      case KM_BIGNUM:
      case KM_BYTES:
        param = arc::mojom::keymint::KeyParameterValue::NewBlob(
            ConvertFromKeymasterMessage(params[i].blob.data,
                                        params[i].blob.data_length));
        break;
      case KM_INVALID:
        tag = KM_TAG_INVALID;
        // just skip
        break;
    }

    out[i] = arc::mojom::keymint::KeyParameter::New(
        static_cast<arc::mojom::keymint::Tag>(tag), std::move(param));
  }

  return out;
}

arc::mojom::keymint::KeyMintKeyBlobPtr ConvertFromKeyMintKeyBlob(
    const ::keymaster::KeymasterKeyBlob& key_blob) {
  arc::mojom::keymint::KeyMintKeyBlobPtr out;
  if (key_blob.key_material == nullptr || key_blob.key_material_size == 0) {
    return out;
  }

  out = arc::mojom::keymint::KeyMintKeyBlob::New(ConvertFromKeymasterMessage(
      key_blob.key_material, key_blob.key_material_size));
  return out;
}

arc::mojom::keymint::KeyMintBlobPtr ConvertFromKeyMintBlob(
    const ::keymaster::KeymasterBlob& blob) {
  arc::mojom::keymint::KeyMintBlobPtr out;
  if (blob.data == nullptr || blob.data_length == 0) {
    return out;
  }

  out = arc::mojom::keymint::KeyMintBlob::New(
      ConvertFromKeymasterMessage(blob.data, blob.data_length));
  return out;
}

void ConvertToKeymasterMessage(const std::vector<uint8_t>& data,
                               ::keymaster::Buffer* out) {
  out->Reinitialize(data.data(), data.size());
}

void ConvertToKeymasterMessage(const std::vector<uint8_t>& clientId,
                               const std::vector<uint8_t>& appData,
                               ::keymaster::AuthorizationSet* params) {
  params->Clear();
  if (!clientId.empty()) {
    params->push_back(::keymaster::TAG_APPLICATION_ID, clientId.data(),
                      clientId.size());
  }
  if (!appData.empty()) {
    params->push_back(::keymaster::TAG_APPLICATION_DATA, appData.data(),
                      appData.size());
  }
}

void ConvertToKeymasterMessage(
    const std::vector<arc::mojom::keymint::KeyParameterPtr>& data,
    ::keymaster::AuthorizationSet* out) {
  KmParamSet param_set(data);
  out->Reinitialize(param_set.param_set());
}

std::vector<arc::mojom::keymint::KeyCharacteristicsPtr>
ConvertKeyCharacteristics(const ::keymaster::AuthorizationSet& hw_enforced,
                          const ::keymaster::AuthorizationSet& sw_enforced,
                          bool include_keystore_enforced = true) {
  // TODO(b/299981713) : Add conversion for Software Security level.
  // The current function makes the assumption that we are not using Software
  // Security Level.
  std::vector<arc::mojom::keymint::KeyCharacteristicsPtr> key_chars_array;

  // KeyMint Enforced Key Characteristics.
  auto keyMintEnforcedChars = arc::mojom::keymint::KeyCharacteristics::New(
      arc::mojom::keymint::SecurityLevel::TRUSTED_ENVIRONMENT,
      ConvertFromKeymasterMessage(hw_enforced));

  if (!keyMintEnforcedChars.is_null() &&
      !keyMintEnforcedChars->authorizations.empty()) {
    key_chars_array.push_back(std::move(keyMintEnforcedChars));
  }

  // Keystore Enforced Key characteristics.
  auto keystoreEnforcedChars = arc::mojom::keymint::KeyCharacteristics::New(
      arc::mojom::keymint::SecurityLevel::KEYSTORE,
      ConvertFromKeymasterMessage(sw_enforced));

  if (include_keystore_enforced && !keystoreEnforcedChars.is_null() &&
      !keystoreEnforcedChars->authorizations.empty()) {
    key_chars_array.push_back(std::move(keystoreEnforcedChars));
  }

  return key_chars_array;
}

// Request Methods.
std::unique_ptr<::keymaster::GetKeyCharacteristicsRequest>
MakeGetKeyCharacteristicsRequest(
    const ::arc::mojom::keymint::GetKeyCharacteristicsRequestPtr& value,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::GetKeyCharacteristicsRequest>(
      keymint_message_version);
  out->SetKeyMaterial(value->key_blob.data(), value->key_blob.size());
  ConvertToKeymasterMessage(value->app_id, value->app_data,
                            &out->additional_params);
  return out;
}

std::unique_ptr<::keymaster::GenerateKeyRequest> MakeGenerateKeyRequest(
    const arc::mojom::keymint::GenerateKeyRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::GenerateKeyRequest>(
      keymint_message_version);
  ConvertToKeymasterMessage(request->key_params, &out->key_description);

  // If mojo request carries an attestation key, convert it to Keymaster
  // message type.
  if (!request->attestation_key.is_null()) {
    out->attestation_signing_key_blob = ::keymaster::KeymasterKeyBlob(
        request->attestation_key->key_blob.data(),
        request->attestation_key->key_blob.size());
    ConvertToKeymasterMessage(request->attestation_key->attest_key_params,
                              &out->attest_key_params);
    out->issuer_subject = ::keymaster::KeymasterBlob(
        request->attestation_key->issuer_subject_name.data(),
        request->attestation_key->issuer_subject_name.size());
  }

  return out;
}

std::unique_ptr<::keymaster::ImportKeyRequest> MakeImportKeyRequest(
    const arc::mojom::keymint::ImportKeyRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out =
      std::make_unique<::keymaster::ImportKeyRequest>(keymint_message_version);
  ConvertToKeymasterMessage(request->key_params, &out->key_description);

  out->key_format = ConvertEnum(request->key_format);
  out->key_data = ::keymaster::KeymasterKeyBlob(request->key_data.data(),
                                                request->key_data.size());

  // If mojo request carries an attestation key, convert it to Keymaster
  // message type.
  if (!request->attestation_key.is_null()) {
    out->attestation_signing_key_blob = ::keymaster::KeymasterKeyBlob(
        request->attestation_key->key_blob.data(),
        request->attestation_key->key_blob.size());
    ConvertToKeymasterMessage(request->attestation_key->attest_key_params,
                              &out->attest_key_params);
    out->issuer_subject = ::keymaster::KeymasterBlob(
        request->attestation_key->issuer_subject_name.data(),
        request->attestation_key->issuer_subject_name.size());
  }

  return out;
}

std::unique_ptr<::keymaster::ImportWrappedKeyRequest>
MakeImportWrappedKeyRequest(
    const arc::mojom::keymint::ImportWrappedKeyRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::ImportWrappedKeyRequest>(
      keymint_message_version);

  out->SetWrappedMaterial(request->wrapped_key_data.data(),
                          request->wrapped_key_data.size());
  out->SetWrappingMaterial(request->wrapping_key_blob.data(),
                           request->wrapping_key_blob.size());
  out->SetMaskingKeyMaterial(request->masking_key.data(),
                             request->masking_key.size());
  ConvertToKeymasterMessage(request->unwrapping_params,
                            &out->additional_params);
  out->password_sid = request->password_sid;
  out->biometric_sid = request->biometric_sid;
  return out;
}

std::unique_ptr<::keymaster::UpgradeKeyRequest> MakeUpgradeKeyRequest(
    const arc::mojom::keymint::UpgradeKeyRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out =
      std::make_unique<::keymaster::UpgradeKeyRequest>(keymint_message_version);
  ConvertToKeymasterMessage(request->upgrade_params, &out->upgrade_params);
  out->SetKeyMaterial(request->key_blob_to_upgrade.data(),
                      request->key_blob_to_upgrade.size());
  return out;
}

std::unique_ptr<::keymaster::UpdateOperationRequest> MakeUpdateOperationRequest(
    const arc::mojom::keymint::UpdateRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::UpdateOperationRequest>(
      keymint_message_version);

  out->op_handle = request->op_handle;
  ConvertToKeymasterMessage(request->input, &out->input);

  std::vector<arc::mojom::keymint::KeyParameterPtr> key_param_array;
  // UpdateOperationRequest also carries TimeStampTokenPtr, which is
  // unused yet and hence not converted. However, if it is used
  // in future by the reference implementation and the AIDL interface,
  // it will be added here.
  if (request->auth_token) {
    auto tokenAsVec(authToken2AidlVec(*request->auth_token));

    auto key_param_ptr = arc::mojom::keymint::KeyParameter::New(
        static_cast<arc::mojom::keymint::Tag>(KM_TAG_AUTH_TOKEN),
        arc::mojom::keymint::KeyParameterValue::NewBlob(std::move(tokenAsVec)));

    key_param_array.push_back(std::move(key_param_ptr));
  }
  ConvertToKeymasterMessage(std::move(key_param_array),
                            &out->additional_params);
  return out;
}

std::unique_ptr<::keymaster::UpdateOperationRequest>
MakeUpdateAadOperationRequest(
    const arc::mojom::keymint::UpdateRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::UpdateOperationRequest>(
      keymint_message_version);
  out->op_handle = request->op_handle;

  std::vector<arc::mojom::keymint::KeyParameterPtr> key_param_array;
  auto associated_data_param = arc::mojom::keymint::KeyParameter::New(
      static_cast<arc::mojom::keymint::Tag>(KM_TAG_ASSOCIATED_DATA),
      arc::mojom::keymint::KeyParameterValue::NewBlob(request->input));

  key_param_array.push_back(std::move(associated_data_param));

  // UpdateAadOperationRequest also carries TimeStampTokenPtr, which is
  // unused yet and hence not converted. However, if it is used
  // in future by the reference implementation and the AIDL interface,
  // it will be added here.
  if (request->auth_token) {
    auto tokenAsVec(authToken2AidlVec(*request->auth_token));

    auto key_param_ptr = arc::mojom::keymint::KeyParameter::New(
        static_cast<arc::mojom::keymint::Tag>(KM_TAG_AUTH_TOKEN),
        arc::mojom::keymint::KeyParameterValue::NewBlob(std::move(tokenAsVec)));

    key_param_array.push_back(std::move(key_param_ptr));
  }
  ConvertToKeymasterMessage(std::move(key_param_array),
                            &out->additional_params);
  return out;
}

std::unique_ptr<::keymaster::BeginOperationRequest> MakeBeginOperationRequest(
    const arc::mojom::keymint::BeginRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::BeginOperationRequest>(
      keymint_message_version);
  out->purpose = ConvertEnum(request->key_purpose);
  out->SetKeyMaterial(request->key_blob.data(), request->key_blob.size());

  if (request->auth_token) {
    auto tokenAsVec(authToken2AidlVec(*request->auth_token));
    auto key_param_ptr = arc::mojom::keymint::KeyParameter::New(
        static_cast<arc::mojom::keymint::Tag>(KM_TAG_AUTH_TOKEN),
        arc::mojom::keymint::KeyParameterValue::NewBlob(std::move(tokenAsVec)));
    request->params.push_back(std::move(key_param_ptr));
  }
  ConvertToKeymasterMessage(request->params, &out->additional_params);
  return out;
}

std::unique_ptr<::keymaster::DeviceLockedRequest> MakeDeviceLockedRequest(
    bool password_only,
    const arc::mojom::keymint::TimeStampTokenPtr& timestamp_token,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::DeviceLockedRequest>(
      keymint_message_version);

  out->passwordOnly = password_only;
  if (timestamp_token) {
    out->token.challenge = timestamp_token->challenge;
    out->token.mac = {timestamp_token->mac.data(), timestamp_token->mac.size()};

    if (!timestamp_token->timestamp) {
      LOG(ERROR) << "Timestamp token should have a valid timestamp.";
      return out;
    }
    out->token.timestamp = timestamp_token->timestamp->milli_seconds;
  }
  return out;
}

std::unique_ptr<::keymaster::FinishOperationRequest> MakeFinishOperationRequest(
    const arc::mojom::keymint::FinishRequestPtr& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::FinishOperationRequest>(
      keymint_message_version);

  if (request.is_null()) {
    LOG(ERROR) << "KeyMint Error: Finish Operation Request is null";
    return out;
  }

  out->op_handle = request->op_handle;
  if (request->input.has_value()) {
    ConvertToKeymasterMessage(request->input.value(), &out->input);
  }
  if (request->signature.has_value()) {
    ConvertToKeymasterMessage(request->signature.value(), &out->signature);
  }
  std::vector<arc::mojom::keymint::KeyParameterPtr> key_param_array;
  if (request->auth_token) {
    auto tokenAsVec(authToken2AidlVec(*request->auth_token));

    auto key_param_ptr = arc::mojom::keymint::KeyParameter::New(
        static_cast<arc::mojom::keymint::Tag>(KM_TAG_AUTH_TOKEN),
        arc::mojom::keymint::KeyParameterValue::NewBlob(std::move(tokenAsVec)));

    key_param_array.push_back(std::move(key_param_ptr));
  }
  // TimeStamp Token and Confirmation Token are not used
  // here since they are not passed from the AIDL.
  // If they are added in future, they will be converted here.
  ConvertToKeymasterMessage(std::move(key_param_array),
                            &out->additional_params);
  return out;
}

std::unique_ptr<::keymaster::ComputeSharedHmacRequest>
MakeComputeSharedSecretRequest(
    const std::vector<arc::mojom::keymint::SharedSecretParametersPtr>& request,
    const int32_t keymint_message_version) {
  auto out = std::make_unique<::keymaster::ComputeSharedHmacRequest>(
      keymint_message_version);

  // Allocate memory for HmacSharingParametersArray.
  out->params_array.params_array =
      new (std::nothrow)::keymaster::HmacSharingParameters[request.size()];
  if (out->params_array.params_array == nullptr) {
    LOG(ERROR)
        << "KeyMint Error: Null Pointer received for ComputeSharedHmacRequest";
    return out;
  }
  out->params_array.num_params = request.size();

  // Transform each shared secret's nonce and seed to Keymaster request.
  for (size_t i = 0; i < request.size(); ++i) {
    out->params_array.params_array[i].seed = {request[i]->seed.data(),
                                              request[i]->seed.size()};

    // Only copy memory if the nonce size is same for the Keymaster request
    // and Shared secret parameter.
    if (sizeof(out->params_array.params_array[i].nonce) !=
        request[i]->nonce.size()) {
      LOG(ERROR)
          << "KeyMint Error: Different Nonce Size for Shared Secret Parameter";
      return out;
    }
    std::copy(request[i]->nonce.data(),
              request[i]->nonce.data() + request[i]->nonce.size(),
              out->params_array.params_array[i].nonce);
  }

  return out;
}

// Mojo Result Methods.
arc::mojom::keymint::KeyCharacteristicsArrayOrErrorPtr
MakeGetKeyCharacteristicsResult(
    const ::keymaster::GetKeyCharacteristicsResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::KeyCharacteristicsArrayOrError::NewError(
        km_response.error);
  }

  auto output =
      ConvertKeyCharacteristics(km_response.enforced, km_response.unenforced,
                                /* include_keystore_enforced = */ false);

  return arc::mojom::keymint::KeyCharacteristicsArrayOrError::
      NewKeyCharacteristics(std::move(output));
}

arc::mojom::keymint::KeyCreationResultOrErrorPtr MakeGenerateKeyResult(
    const ::keymaster::GenerateKeyResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::KeyCreationResultOrError::NewError(
        km_response.error);
  }

  // Create the Key Blob.
  auto key_blob =
      ConvertFromKeymasterMessage(km_response.key_blob.key_material,
                                  km_response.key_blob.key_material_size);

  // Create the Key Characteristics Array.
  auto key_chars_array =
      ConvertKeyCharacteristics(km_response.enforced, km_response.unenforced);

  // Create the Certificate Array.
  std::vector<arc::mojom::keymint::CertificatePtr> cert_array =
      ConvertFromKeymasterMessage(km_response.certificate_chain);

  auto key_result = arc::mojom::keymint::KeyCreationResult::New(
      std::move(key_blob), std::move(key_chars_array), std::move(cert_array));

  return arc::mojom::keymint::KeyCreationResultOrError::NewKeyCreationResult(
      std::move(key_result));
}

arc::mojom::keymint::KeyCreationResultOrErrorPtr MakeImportKeyResult(
    const ::keymaster::ImportKeyResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::KeyCreationResultOrError::NewError(
        km_response.error);
  }

  // Create the Key Blob.
  auto key_blob =
      ConvertFromKeymasterMessage(km_response.key_blob.key_material,
                                  km_response.key_blob.key_material_size);

  // Create the Key Characteristics Array.
  auto key_chars_array =
      ConvertKeyCharacteristics(km_response.enforced, km_response.unenforced);

  // Create the Certificate Array.
  std::vector<arc::mojom::keymint::CertificatePtr> cert_array =
      ConvertFromKeymasterMessage(km_response.certificate_chain);

  auto key_creation_result = arc::mojom::keymint::KeyCreationResult::New(
      std::move(key_blob), std::move(key_chars_array), std::move(cert_array));

  return arc::mojom::keymint::KeyCreationResultOrError::NewKeyCreationResult(
      std::move(key_creation_result));
}

arc::mojom::keymint::KeyCreationResultOrErrorPtr MakeImportWrappedKeyResult(
    const ::keymaster::ImportWrappedKeyResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::KeyCreationResultOrError::NewError(
        km_response.error);
  }

  // Create the Key Blob.
  auto key_blob =
      ConvertFromKeymasterMessage(km_response.key_blob.key_material,
                                  km_response.key_blob.key_material_size);

  // Create the Key Characteristics Array.
  auto key_chars_array =
      ConvertKeyCharacteristics(km_response.enforced, km_response.unenforced);

  // Create the Certificate Array.
  std::vector<arc::mojom::keymint::CertificatePtr> cert_array =
      ConvertFromKeymasterMessage(km_response.certificate_chain);

  auto key_creation_result = arc::mojom::keymint::KeyCreationResult::New(
      std::move(key_blob), std::move(key_chars_array), std::move(cert_array));

  return arc::mojom::keymint::KeyCreationResultOrError::NewKeyCreationResult(
      std::move(key_creation_result));
}

arc::mojom::keymint::ByteArrayOrErrorPtr MakeUpgradeKeyResult(
    const ::keymaster::UpgradeKeyResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::ByteArrayOrError::NewError(km_response.error);
  }
  // Create the Key Blob.
  auto upgraded_key_blob =
      ConvertFromKeymasterMessage(km_response.upgraded_key.key_material,
                                  km_response.upgraded_key.key_material_size);

  return arc::mojom::keymint::ByteArrayOrError::NewOutput(
      std::move(upgraded_key_blob));
}

arc::mojom::keymint::ByteArrayOrErrorPtr MakeUpdateResult(
    const ::keymaster::UpdateOperationResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::ByteArrayOrError::NewError(km_response.error);
  }
  // UpdateOperationResponse also carries a field - |input_consumed|,
  // which is used in keymint_server.cc file.
  // It also carries another field - |output_params|, which is a
  // part of |output| returned from here.
  auto output = ConvertFromKeymasterMessage(
      km_response.output.begin(), km_response.output.available_read());

  return arc::mojom::keymint::ByteArrayOrError::NewOutput(std::move(output));
}

arc::mojom::keymint::BeginResultOrErrorPtr MakeBeginResult(
    const ::keymaster::BeginOperationResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::BeginResultOrError::NewError(km_response.error);
  }

  uint64_t challenge = km_response.op_handle;
  uint64_t op_handle = km_response.op_handle;

  auto begin_result = arc::mojom::keymint::BeginResult::New(
      std::move(challenge),
      ConvertFromKeymasterMessage(km_response.output_params),
      std::move(op_handle));

  return arc::mojom::keymint::BeginResultOrError::NewBeginResult(
      std::move(begin_result));
}

arc::mojom::keymint::ByteArrayOrErrorPtr MakeFinishResult(
    const ::keymaster::FinishOperationResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::ByteArrayOrError::NewError(km_response.error);
  }
  auto output = ConvertFromKeymasterMessage(
      km_response.output.begin(), km_response.output.available_read());

  return arc::mojom::keymint::ByteArrayOrError::NewOutput(std::move(output));
}

arc::mojom::keymint::SharedSecretParametersOrErrorPtr
MakeGetSharedSecretParametersResult(
    const ::keymaster::GetHmacSharingParametersResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::SharedSecretParametersOrError::NewError(
        km_response.error);
  }

  // Create seed and nonce.
  std::vector<uint8_t> seed = ConvertFromKeymasterMessage(
      km_response.params.seed.begin(), km_response.params.seed.size());
  std::vector<uint8_t> nonce(std::begin(km_response.params.nonce),
                             std::end(km_response.params.nonce));

  auto params = arc::mojom::keymint::SharedSecretParameters::New(
      std::move(seed), std::move(nonce));

  return arc::mojom::keymint::SharedSecretParametersOrError::
      NewSecretParameters(std::move(params));
}

arc::mojom::keymint::ByteArrayOrErrorPtr MakeComputeSharedSecretResult(
    const ::keymaster::ComputeSharedHmacResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::ByteArrayOrError::NewError(km_response.error);
  }

  std::vector<uint8_t> result(
      km_response.sharing_check.data,
      km_response.sharing_check.data + km_response.sharing_check.data_length);
  return arc::mojom::keymint::ByteArrayOrError::NewOutput(std::move(result));
}

arc::mojom::keymint::TimeStampTokenOrErrorPtr MakeGenerateTimeStampTokenResult(
    const ::keymaster::GenerateTimestampTokenResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::TimeStampTokenOrError::NewError(
        km_response.error);
  }

  uint64_t challenge = km_response.token.challenge;

  auto time_stamp = arc::mojom::keymint::Timestamp::New(
      base::strict_cast<uint64_t>(km_response.token.timestamp));

  std::vector<uint8_t> mac(
      km_response.token.mac.data,
      km_response.token.mac.data + km_response.token.mac.data_length);

  auto time_stamp_token = arc::mojom::keymint::TimeStampToken::New(
      std::move(challenge), std::move(time_stamp), std::move(mac));

  return arc::mojom::keymint::TimeStampTokenOrError::NewTimestampToken(
      std::move(time_stamp_token));
}

arc::mojom::keymint::GenerateEcdsaP256KeyPairResultOrErrorPtr
MakeGenerateEcdsaP256KeyPairResult(
    const ::keymaster::GenerateRkpKeyResponse& km_response) {
  if (km_response.error != KM_ERROR_OK) {
    return arc::mojom::keymint::GenerateEcdsaP256KeyPairResultOrError::NewError(
        km_response.error);
  }

  arc::mojom::keymint::KeyMintBlobPtr maced_public_key =
      ConvertFromKeyMintBlob(km_response.maced_public_key);
  arc::mojom::keymint::KeyMintKeyBlobPtr handle_to_private_key =
      ConvertFromKeyMintKeyBlob(km_response.key_blob);
  auto result = arc::mojom::keymint::GenerateEcdsaP256KeyPairResult::New(
      std::move(maced_public_key), std::move(handle_to_private_key));

  return arc::mojom::keymint::GenerateEcdsaP256KeyPairResultOrError::
      NewKeyPairResult(std::move(result));
}

}  // namespace arc::keymint