arc/keymint/conversion_test.cc

// Copyright 2023 The ChromiumOS Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "arc/keymint/conversion.h"

#include <array>
#include <memory>
#include <utility>
#include <vector>

#include <gtest/gtest.h>
#include <keymaster/android_keymaster_utils.h>

namespace arc::keymint {

namespace {

constexpr std::array<uint8_t, 3> kBlob1{{3, 23, 59}};
constexpr std::array<uint8_t, 4> kBlob2{{23, 46, 69, 92}};
constexpr std::array<uint8_t, 5> kBlob3{{1, 2, 3, 4, 5}};
constexpr int32_t kKeyMintMessageVersion = 4;
constexpr uint64_t fakeChallenge = 224498432732987237;
constexpr uint64_t fakeAuthenticatorId = 790712303;
constexpr uint64_t fakeUserId = 321;
constexpr uint64_t fakeTimeStamp = 4349843232312345627;

::testing::AssertionResult VerifyVectorUint8(const uint8_t* a,
                                             const size_t a_size,
                                             const std::vector<uint8_t>& b) {
  if (a_size != b.size()) {
    return ::testing::AssertionFailure()
           << "Sizes differ: a=" << a_size << " b=" << b.size();
  }
  for (size_t i = 0; i < a_size; ++i) {
    if (a[i] != b[i]) {
      return ::testing::AssertionFailure()
             << "Elements differ: a=" << static_cast<int>(a[i])
             << " b=" << static_cast<int>(b[i]);
    }
  }
  return ::testing::AssertionSuccess();
}

::testing::AssertionResult VerifyKeyParametersWithStrictInputs(
    const ::keymaster::AuthorizationSet& a,
    const std::vector<arc::mojom::keymint::KeyParameterPtr>& b) {
  if (a.size() != b.size()) {
    return ::testing::AssertionFailure()
           << "Sizes differ: a=" << a.size() << " b=" << b.size();
  }

  for (size_t i = 0; i < a.size(); ++i) {
    if (a[i].tag != static_cast<uint32_t>(b[i]->tag)) {
      return ::testing::AssertionFailure()
             << "Tags differ: i=" << i
             << " a=" << static_cast<uint32_t>(a[i].tag) << " b=" << b[i]->tag;
    }
  }
  if (!(b[0]->value->is_bool_value() && b[1]->value->is_integer() &&
        b[2]->value->is_long_integer() && b[3]->value->is_date_time() &&
        b[4]->value->is_blob() && b[5]->value->is_algorithm())) {
    return ::testing::AssertionFailure() << "Incorrect union value type";
  }
  if (!(a[0].boolean == b[0]->value->get_bool_value() &&
        a[1].integer == b[1]->value->get_integer() &&
        a[2].long_integer == b[2]->value->get_long_integer() &&
        a[3].date_time == b[3]->value->get_date_time()) &&
      a[5].enumerated == static_cast<uint32_t>(b[5]->value->get_algorithm())) {
    return ::testing::AssertionFailure() << "Values differ";
  }
  return VerifyVectorUint8(a[4].blob.data, a[4].blob.data_length,
                           b[4]->value->get_blob());
}

std::vector<arc::mojom::keymint::KeyParameterPtr> KeyParameterVector() {
  std::vector<arc::mojom::keymint::KeyParameterPtr> parameters(6);
  // bool
  auto paramBool = arc::mojom::keymint::KeyParameterValue::NewBoolValue(true);
  parameters[0] = arc::mojom::keymint::KeyParameter::New(
      static_cast<arc::mojom::keymint::Tag>(KM_TAG_CALLER_NONCE),
      std::move(paramBool));
  // int, int_rep
  auto paramInt = arc::mojom::keymint::KeyParameterValue::NewInteger(128);
  parameters[1] = arc::mojom::keymint::KeyParameter::New(
      arc::mojom::keymint::Tag::KEY_SIZE, std::move(paramInt));
  // long
  auto paramLong =
      arc::mojom::keymint::KeyParameterValue::NewLongInteger(65537);
  parameters[2] = arc::mojom::keymint::KeyParameter::New(
      static_cast<arc::mojom::keymint::Tag>(KM_TAG_RSA_PUBLIC_EXPONENT),
      std::move(paramLong));
  // date
  auto paramDate = arc::mojom::keymint::KeyParameterValue::NewDateTime(1337);
  parameters[3] = arc::mojom::keymint::KeyParameter::New(
      static_cast<arc::mojom::keymint::Tag>(KM_TAG_ACTIVE_DATETIME),
      std::move(paramDate));
  // bignum, bytes
  auto paramBlob = arc::mojom::keymint::KeyParameterValue::NewBlob(
      std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()));
  parameters[4] = arc::mojom::keymint::KeyParameter::New(
      static_cast<arc::mojom::keymint::Tag>(KM_TAG_APPLICATION_DATA),
      std::move(paramBlob));
  // enum, enum_rep
  auto paramAlgo = arc::mojom::keymint::KeyParameterValue::NewAlgorithm(
      arc::mojom::keymint::Algorithm::TRIPLE_DES);
  parameters[5] = arc::mojom::keymint::KeyParameter::New(
      arc::mojom::keymint::Tag::ALGORITHM, std::move(paramAlgo));
  return parameters;
}

arc::mojom::keymint::AttestationKeyPtr CreateAttestationKey() {
  std::vector<uint8_t> key_blob(kBlob1.begin(), kBlob1.end());
  std::vector<uint8_t> issuer_subject_name(kBlob2.begin(), kBlob2.end());
  return arc::mojom::keymint::AttestationKey::New(
      key_blob, KeyParameterVector(), issuer_subject_name);
}

::testing::AssertionResult VerifyAttestationKey(
    const ::keymaster::KeymasterKeyBlob& key_blob,
    const ::keymaster::AuthorizationSet& attest_key_params,
    const ::keymaster::KeymasterBlob& issuer_subject,
    const arc::mojom::keymint::AttestationKeyPtr& mojo) {
  if (auto result = VerifyVectorUint8(
          key_blob.key_material, key_blob.key_material_size, mojo->key_blob);
      result != ::testing::AssertionSuccess()) {
    return result;
  }

  if (auto result = VerifyKeyParametersWithStrictInputs(
          attest_key_params, mojo->attest_key_params);
      result != ::testing::AssertionSuccess()) {
    return result;
  }

  if (auto result =
          VerifyVectorUint8(issuer_subject.data, issuer_subject.data_length,
                            mojo->issuer_subject_name);
      result != ::testing::AssertionSuccess()) {
    return result;
  }

  return ::testing::AssertionSuccess();
}

::arc::mojom::keymint::HardwareAuthTokenPtr CreateHardwareAuthToken() {
  return ::arc::mojom::keymint::HardwareAuthToken::New(
      fakeChallenge, fakeUserId, fakeAuthenticatorId,
      arc::mojom::keymint::HardwareAuthenticatorType(HW_AUTH_ANY),
      ::arc::mojom::keymint::Timestamp::New(fakeTimeStamp),
      std::vector<uint8_t>{2, 3});
}

::arc::mojom::keymint::TimeStampTokenPtr CreateTimeStampToken() {
  return ::arc::mojom::keymint::TimeStampToken::New(
      fakeChallenge, ::arc::mojom::keymint::Timestamp::New(fakeTimeStamp),
      std::vector<uint8_t>{2, 3});
}

::testing::AssertionResult VerifyHardwareAuthToken(
    const ::keymaster::AuthorizationSet& a,
    const arc::mojom::keymint::HardwareAuthToken& b) {
  auto result = ::testing::AssertionResult(false);
  for (size_t i = 0; i < a.size(); ++i) {
    if (a[i].tag == static_cast<uint32_t>(KM_TAG_AUTH_TOKEN)) {
      keymaster_blob_t blob = a[i].blob;
      auto tokenAsVec(authToken2AidlVec(b));
      result = VerifyVectorUint8(blob.data, blob.data_length, tokenAsVec);
    }
  }
  return result;
}

::testing::AssertionResult VerifyVerificationToken(
    ::keymaster::VerificationToken& km,
    const arc::mojom::keymint::TimeStampTokenPtr& mojo) {
  if (mojo.is_null()) {
    return ::testing::AssertionFailure()
           << "Verification Token failed as mojo is null";
  }
  if (mojo->timestamp.is_null()) {
    return ::testing::AssertionFailure()
           << "Verification Token failed as mojo timestamp is null";
  }
  if (km.challenge != mojo->challenge) {
    return ::testing::AssertionFailure()
           << "Verification Token challenge mismatch: km=" << km.challenge
           << " mojo=" << mojo->challenge;
  }
  if (km.timestamp != mojo->timestamp->milli_seconds) {
    return ::testing::AssertionFailure()
           << "Verification Token timestamp mismatch: km=" << km.timestamp
           << " mojo=" << mojo->timestamp->milli_seconds;
  }
  if (auto vectorMatch =
          VerifyVectorUint8(km.mac.data, km.mac.size(), mojo->mac);
      !vectorMatch) {
    return vectorMatch;
  }
  return ::testing::AssertionSuccess();
}

}  // namespace

TEST(ConvertFromKeymasterMessage, Uint8Vector) {
  // Convert.
  std::vector<uint8_t> output =
      ConvertFromKeymasterMessage(kBlob1.data(), kBlob1.size());

  // Verify.
  EXPECT_TRUE(VerifyVectorUint8(kBlob1.data(), kBlob1.size(), output));
}

TEST(ConvertFromKeymasterMessage, EnumConversionKeyFormat) {
  // Verify.
  EXPECT_EQ(KM_KEY_FORMAT_PKCS8,
            ConvertEnum(arc::mojom::keymint::KeyFormat::PKCS8));
  EXPECT_EQ(KM_KEY_FORMAT_X509,
            ConvertEnum(arc::mojom::keymint::KeyFormat::X509));
  EXPECT_EQ(KM_KEY_FORMAT_RAW,
            ConvertEnum(arc::mojom::keymint::KeyFormat::RAW));
}

TEST(ConvertFromKeymasterMessage, EnumConversionTag) {
  // Verify.
  // TODO(b/274723521): Add KM_TAG_HARDWARE_TYPE
  EXPECT_EQ(KM_TAG_PURPOSE, ConvertEnum(arc::mojom::keymint::Tag::PURPOSE));
  EXPECT_EQ(KM_TAG_ALGORITHM, ConvertEnum(arc::mojom::keymint::Tag::ALGORITHM));
  EXPECT_EQ(KM_TAG_KEY_SIZE, ConvertEnum(arc::mojom::keymint::Tag::KEY_SIZE));
  EXPECT_EQ(KM_TAG_BLOCK_MODE,
            ConvertEnum(arc::mojom::keymint::Tag::BLOCK_MODE));
  EXPECT_EQ(KM_TAG_DIGEST, ConvertEnum(arc::mojom::keymint::Tag::DIGEST));
  EXPECT_EQ(KM_TAG_PADDING, ConvertEnum(arc::mojom::keymint::Tag::PADDING));
  EXPECT_EQ(KM_TAG_CALLER_NONCE,
            ConvertEnum(arc::mojom::keymint::Tag::CALLER_NONCE));
  EXPECT_EQ(KM_TAG_MIN_MAC_LENGTH,
            ConvertEnum(arc::mojom::keymint::Tag::MIN_MAC_LENGTH));
  EXPECT_EQ(KM_TAG_EC_CURVE, ConvertEnum(arc::mojom::keymint::Tag::EC_CURVE));
  EXPECT_EQ(KM_TAG_RSA_PUBLIC_EXPONENT,
            ConvertEnum(arc::mojom::keymint::Tag::RSA_PUBLIC_EXPONENT));
  EXPECT_EQ(KM_TAG_INCLUDE_UNIQUE_ID,
            ConvertEnum(arc::mojom::keymint::Tag::INCLUDE_UNIQUE_ID));
  EXPECT_EQ(KM_TAG_RSA_OAEP_MGF_DIGEST,
            ConvertEnum(arc::mojom::keymint::Tag::RSA_OAEP_MGF_DIGEST));
  EXPECT_EQ(KM_TAG_BOOTLOADER_ONLY,
            ConvertEnum(arc::mojom::keymint::Tag::BOOTLOADER_ONLY));
  EXPECT_EQ(KM_TAG_ROLLBACK_RESISTANCE,
            ConvertEnum(arc::mojom::keymint::Tag::ROLLBACK_RESISTANCE));
  EXPECT_EQ(KM_TAG_EARLY_BOOT_ONLY,
            ConvertEnum(arc::mojom::keymint::Tag::EARLY_BOOT_ONLY));
  EXPECT_EQ(KM_TAG_ACTIVE_DATETIME,
            ConvertEnum(arc::mojom::keymint::Tag::ACTIVE_DATETIME));
  EXPECT_EQ(KM_TAG_ORIGINATION_EXPIRE_DATETIME,
            ConvertEnum(arc::mojom::keymint::Tag::ORIGINATION_EXPIRE_DATETIME));
  EXPECT_EQ(KM_TAG_USAGE_EXPIRE_DATETIME,
            ConvertEnum(arc::mojom::keymint::Tag::USAGE_EXPIRE_DATETIME));
  EXPECT_EQ(KM_TAG_MIN_SECONDS_BETWEEN_OPS,
            ConvertEnum(arc::mojom::keymint::Tag::MIN_SECONDS_BETWEEN_OPS));
  EXPECT_EQ(KM_TAG_MAX_USES_PER_BOOT,
            ConvertEnum(arc::mojom::keymint::Tag::MAX_USES_PER_BOOT));
  EXPECT_EQ(KM_TAG_USAGE_COUNT_LIMIT,
            ConvertEnum(arc::mojom::keymint::Tag::USAGE_COUNT_LIMIT));
  EXPECT_EQ(KM_TAG_USER_ID, ConvertEnum(arc::mojom::keymint::Tag::USER_ID));
  EXPECT_EQ(KM_TAG_USER_SECURE_ID,
            ConvertEnum(arc::mojom::keymint::Tag::USER_SECURE_ID));
  EXPECT_EQ(KM_TAG_NO_AUTH_REQUIRED,
            ConvertEnum(arc::mojom::keymint::Tag::NO_AUTH_REQUIRED));
  EXPECT_EQ(KM_TAG_USER_AUTH_TYPE,
            ConvertEnum(arc::mojom::keymint::Tag::USER_AUTH_TYPE));
  EXPECT_EQ(KM_TAG_AUTH_TIMEOUT,
            ConvertEnum(arc::mojom::keymint::Tag::AUTH_TIMEOUT));
  EXPECT_EQ(KM_TAG_ALLOW_WHILE_ON_BODY,
            ConvertEnum(arc::mojom::keymint::Tag::ALLOW_WHILE_ON_BODY));
  EXPECT_EQ(
      KM_TAG_TRUSTED_USER_PRESENCE_REQUIRED,
      ConvertEnum(arc::mojom::keymint::Tag::TRUSTED_USER_PRESENCE_REQUIRED));
  EXPECT_EQ(
      KM_TAG_TRUSTED_CONFIRMATION_REQUIRED,
      ConvertEnum(arc::mojom::keymint::Tag::TRUSTED_CONFIRMATION_REQUIRED));
  EXPECT_EQ(KM_TAG_UNLOCKED_DEVICE_REQUIRED,
            ConvertEnum(arc::mojom::keymint::Tag::UNLOCKED_DEVICE_REQUIRED));
  EXPECT_EQ(KM_TAG_APPLICATION_ID,
            ConvertEnum(arc::mojom::keymint::Tag::APPLICATION_ID));
  EXPECT_EQ(KM_TAG_APPLICATION_DATA,
            ConvertEnum(arc::mojom::keymint::Tag::APPLICATION_DATA));
  EXPECT_EQ(KM_TAG_CREATION_DATETIME,
            ConvertEnum(arc::mojom::keymint::Tag::CREATION_DATETIME));
  EXPECT_EQ(KM_TAG_ORIGIN, ConvertEnum(arc::mojom::keymint::Tag::ORIGIN));
  EXPECT_EQ(KM_TAG_ROOT_OF_TRUST,
            ConvertEnum(arc::mojom::keymint::Tag::ROOT_OF_TRUST));
  EXPECT_EQ(KM_TAG_OS_VERSION,
            ConvertEnum(arc::mojom::keymint::Tag::OS_VERSION));
  EXPECT_EQ(KM_TAG_OS_PATCHLEVEL,
            ConvertEnum(arc::mojom::keymint::Tag::OS_PATCHLEVEL));
  EXPECT_EQ(KM_TAG_UNIQUE_ID, ConvertEnum(arc::mojom::keymint::Tag::UNIQUE_ID));
  EXPECT_EQ(KM_TAG_ATTESTATION_CHALLENGE,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_CHALLENGE));
  EXPECT_EQ(KM_TAG_ATTESTATION_APPLICATION_ID,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_APPLICATION_ID));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_BRAND,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_BRAND));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_DEVICE,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_DEVICE));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_PRODUCT,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_PRODUCT));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_SERIAL,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_SERIAL));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_IMEI,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_IMEI));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_MEID,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_MEID));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_MANUFACTURER,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_MANUFACTURER));
  EXPECT_EQ(KM_TAG_ATTESTATION_ID_MODEL,
            ConvertEnum(arc::mojom::keymint::Tag::ATTESTATION_ID_MODEL));
  EXPECT_EQ(KM_TAG_VENDOR_PATCHLEVEL,
            ConvertEnum(arc::mojom::keymint::Tag::VENDOR_PATCHLEVEL));
  EXPECT_EQ(KM_TAG_BOOT_PATCHLEVEL,
            ConvertEnum(arc::mojom::keymint::Tag::BOOT_PATCHLEVEL));
  EXPECT_EQ(KM_TAG_DEVICE_UNIQUE_ATTESTATION,
            ConvertEnum(arc::mojom::keymint::Tag::DEVICE_UNIQUE_ATTESTATION));
  EXPECT_EQ(KM_TAG_IDENTITY_CREDENTIAL_KEY,
            ConvertEnum(arc::mojom::keymint::Tag::IDENTITY_CREDENTIAL_KEY));
  EXPECT_EQ(KM_TAG_STORAGE_KEY,
            ConvertEnum(arc::mojom::keymint::Tag::STORAGE_KEY));
  EXPECT_EQ(KM_TAG_ASSOCIATED_DATA,
            ConvertEnum(arc::mojom::keymint::Tag::ASSOCIATED_DATA));
  EXPECT_EQ(KM_TAG_NONCE, ConvertEnum(arc::mojom::keymint::Tag::NONCE));
  EXPECT_EQ(KM_TAG_MAC_LENGTH,
            ConvertEnum(arc::mojom::keymint::Tag::MAC_LENGTH));
  EXPECT_EQ(KM_TAG_RESET_SINCE_ID_ROTATION,
            ConvertEnum(arc::mojom::keymint::Tag::RESET_SINCE_ID_ROTATION));
  EXPECT_EQ(KM_TAG_CONFIRMATION_TOKEN,
            ConvertEnum(arc::mojom::keymint::Tag::CONFIRMATION_TOKEN));
  EXPECT_EQ(KM_TAG_CERTIFICATE_SERIAL,
            ConvertEnum(arc::mojom::keymint::Tag::CERTIFICATE_SERIAL));
  EXPECT_EQ(KM_TAG_CERTIFICATE_SUBJECT,
            ConvertEnum(arc::mojom::keymint::Tag::CERTIFICATE_SUBJECT));
  EXPECT_EQ(KM_TAG_CERTIFICATE_NOT_BEFORE,
            ConvertEnum(arc::mojom::keymint::Tag::CERTIFICATE_NOT_BEFORE));
  EXPECT_EQ(KM_TAG_CERTIFICATE_NOT_AFTER,
            ConvertEnum(arc::mojom::keymint::Tag::CERTIFICATE_NOT_AFTER));
  EXPECT_EQ(KM_TAG_MAX_BOOT_LEVEL,
            ConvertEnum(arc::mojom::keymint::Tag::MAX_BOOT_LEVEL));
}

TEST(ConvertFromKeymasterMessage, EnumConversionKeyPurpose) {
  // Verify.
  EXPECT_EQ(KM_PURPOSE_ENCRYPT,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::ENCRYPT));
  EXPECT_EQ(KM_PURPOSE_DECRYPT,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::DECRYPT));
  EXPECT_EQ(KM_PURPOSE_SIGN,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::SIGN));
  EXPECT_EQ(KM_PURPOSE_VERIFY,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::VERIFY));
  // TODO(b/274723521): Find why KM_PURPOSE_DERIVE_KEY doesn't exist in AIDL.
  EXPECT_EQ(KM_PURPOSE_WRAP,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::WRAP_KEY));
  EXPECT_EQ(KM_PURPOSE_AGREE_KEY,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::AGREE_KEY));
  EXPECT_EQ(KM_PURPOSE_ATTEST_KEY,
            ConvertEnum(arc::mojom::keymint::KeyPurpose::ATTEST_KEY));
}

TEST(ConvertFromKeymasterMessage, KeyParameterVector) {
  // Prepare.
  ::keymaster::AuthorizationSet input;
  input.push_back(keymaster_param_bool(KM_TAG_EARLY_BOOT_ONLY));  // bool
  input.push_back(keymaster_param_int(KM_TAG_KEY_SIZE,
                                      128));  // int, int_rep
  input.push_back(keymaster_param_long(KM_TAG_USER_SECURE_ID, 65537));  // long
  input.push_back(
      keymaster_param_date(KM_TAG_USAGE_EXPIRE_DATETIME, 1507));  // date
  input.push_back(keymaster_param_blob(KM_TAG_APPLICATION_DATA, kBlob1.data(),
                                       kBlob1.size()));  // bignum, bytes
  input.push_back(
      keymaster_param_enum(KM_TAG_ALGORITHM,
                           KM_ALGORITHM_TRIPLE_DES));  // enum, enum_rep

  // Convert.
  std::vector<arc::mojom::keymint::KeyParameterPtr> output =
      ConvertFromKeymasterMessage(input);

  // Verify.
  EXPECT_TRUE(VerifyKeyParametersWithStrictInputs(input, output));
}

TEST(ConvertFromKeyMintKeyBlob, KeyMintKeyBlob) {
  // Prepare.
  ::keymaster::KeymasterKeyBlob blob(kBlob1.data(), kBlob1.size());

  // Convert.
  auto mojo = ConvertFromKeyMintKeyBlob(blob);

  // Verify.
  EXPECT_TRUE(
      VerifyVectorUint8(kBlob1.data(), kBlob1.size(), mojo->key_material));
}

TEST(ConvertFromKeyMintBlob, KeyMintBlob) {
  // Prepare.
  ::keymaster::KeymasterBlob blob(kBlob2.data(), kBlob2.size());

  // Convert.
  auto mojo = ConvertFromKeyMintBlob(blob);

  // Verify.
  EXPECT_TRUE(VerifyVectorUint8(blob.data, blob.data_length, mojo->data));
}

TEST(ConvertToKeymasterMessage, Buffer) {
  // Prepare.
  std::vector<uint8_t> input(kBlob1.begin(), kBlob1.end());

  // Convert.
  ::keymaster::Buffer buffer;
  ConvertToKeymasterMessage(input, &buffer);
  uint8_t output[kBlob1.size()];

  // Verify.
  EXPECT_TRUE(buffer.read(output, input.size()));
  EXPECT_TRUE(VerifyVectorUint8(output, input.size(), input));
}

TEST(ConvertToKeymasterMessage, ReusedBuffer) {
  // Prepare.
  std::vector<uint8_t> input1(kBlob1.begin(), kBlob1.end());
  std::vector<uint8_t> input2(kBlob2.begin(), kBlob2.end());

  // Convert.
  ::keymaster::Buffer buffer;
  ConvertToKeymasterMessage(input1, &buffer);
  ConvertToKeymasterMessage(input2, &buffer);
  uint8_t output[kBlob2.size()];

  // Verify.
  EXPECT_TRUE(buffer.read(output, kBlob2.size()));
  EXPECT_TRUE(VerifyVectorUint8(output, kBlob2.size(), input2));
}

TEST(ConvertToKeymasterMessage, ClientIdAndAppData) {
  // Prepare.
  std::vector<uint8_t> clientId(kBlob1.begin(), kBlob1.end());
  std::vector<uint8_t> appData(kBlob2.begin(), kBlob2.end());

  // Convert.
  ::keymaster::AuthorizationSet output;
  ConvertToKeymasterMessage(clientId, appData, &output);

  // Verify.
  ASSERT_EQ(2, output.size());
  EXPECT_EQ(KM_TAG_APPLICATION_ID, output[0].tag);
  EXPECT_EQ(KM_TAG_APPLICATION_DATA, output[1].tag);
  EXPECT_TRUE(VerifyVectorUint8(output[0].blob.data, output[0].blob.data_length,
                                clientId));
  EXPECT_TRUE(VerifyVectorUint8(output[1].blob.data, output[1].blob.data_length,
                                appData));
}

TEST(ConvertToKeymasterMessage, GetKeyCharacteristicsRequest) {
  // Prepare.
  auto input = ::arc::mojom::keymint::GetKeyCharacteristicsRequest::New(
      std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()),
      std::vector<uint8_t>(kBlob2.begin(), kBlob2.end()),
      std::vector<uint8_t>(kBlob3.begin(), kBlob3.end()));

  // Convert.
  auto output = MakeGetKeyCharacteristicsRequest(input, kKeyMintMessageVersion);

  // Verify.
  EXPECT_TRUE(VerifyVectorUint8(output->key_blob.key_material,
                                output->key_blob.key_material_size,
                                input->key_blob));
  ASSERT_EQ(output->additional_params.size(), 2);
  EXPECT_TRUE(VerifyVectorUint8(output->additional_params[0].blob.data,
                                output->additional_params[0].blob.data_length,
                                input->app_id));
  EXPECT_TRUE(VerifyVectorUint8(output->additional_params[1].blob.data,
                                output->additional_params[1].blob.data_length,
                                input->app_data));
}

TEST(ConvertToKeymasterMessage, GenerateKeyRequest) {
  // Prepare.
  auto input = arc::mojom::keymint::GenerateKeyRequest::New(
      KeyParameterVector(), CreateAttestationKey());

  // Convert.
  auto output = MakeGenerateKeyRequest(input, kKeyMintMessageVersion);

  // Verify.
  ASSERT_TRUE(output);
  EXPECT_TRUE(VerifyKeyParametersWithStrictInputs(output->key_description,
                                                  input->key_params));
  ASSERT_TRUE(input->attestation_key);
  EXPECT_TRUE(VerifyAttestationKey(
      output->attestation_signing_key_blob, output->attest_key_params,
      output->issuer_subject, input->attestation_key));
}

TEST(ConvertToMessage, ImportKeyRequest) {
  // Prepare.
  auto input = arc::mojom::keymint::ImportKeyRequest::New(
      KeyParameterVector(), arc::mojom::keymint::KeyFormat::PKCS8,
      std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()),
      CreateAttestationKey());

  // Convert.
  auto output = MakeImportKeyRequest(std::move(input), kKeyMintMessageVersion);

  // Verify.
  ASSERT_TRUE(output);
  EXPECT_EQ(static_cast<keymaster_key_format_t>(input->key_format),
            output->key_format);
  EXPECT_TRUE(VerifyKeyParametersWithStrictInputs(output->key_description,
                                                  input->key_params));

  EXPECT_TRUE(VerifyVectorUint8(output->key_data.key_material,
                                output->key_data.key_material_size,
                                input->key_data));

  ASSERT_TRUE(input->attestation_key);
  EXPECT_TRUE(VerifyAttestationKey(
      output->attestation_signing_key_blob, output->attest_key_params,
      output->issuer_subject, input->attestation_key));
}

TEST(ConvertToMessage, ImportWrappedKeyRequest) {
  // Prepare.
  uint64_t password_sid = 703710923123;
  uint64_t biometric_sid = 2702433194597;
  auto input = arc::mojom::keymint::ImportWrappedKeyRequest::New(
      std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()),
      std::vector<uint8_t>(kBlob2.begin(), kBlob2.end()),
      std::vector<uint8_t>(kBlob3.begin(), kBlob3.end()), KeyParameterVector(),
      password_sid, biometric_sid);

  // Convert.
  auto output = MakeImportWrappedKeyRequest(input, kKeyMintMessageVersion);

  // Verify.
  ASSERT_TRUE(output);
  EXPECT_TRUE(VerifyVectorUint8(output->wrapped_key.key_material,
                                output->wrapped_key.key_material_size,
                                input->wrapped_key_data));
  EXPECT_TRUE(VerifyVectorUint8(output->wrapping_key.key_material,
                                output->wrapping_key.key_material_size,
                                input->wrapping_key_blob));
  EXPECT_TRUE(VerifyVectorUint8(output->masking_key.key_material,
                                output->masking_key.key_material_size,
                                input->masking_key));
  EXPECT_TRUE(VerifyKeyParametersWithStrictInputs(output->additional_params,
                                                  input->unwrapping_params));
  EXPECT_EQ(output->password_sid, input->password_sid);
  EXPECT_EQ(output->biometric_sid, input->biometric_sid);
}

TEST(ConvertToMessage, UpgradeKeyRequest) {
  // Prepare.
  auto input = arc::mojom::keymint::UpgradeKeyRequest::New(
      std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()), KeyParameterVector());

  // Convert.
  auto output = MakeUpgradeKeyRequest(std::move(input), kKeyMintMessageVersion);

  // Verify.
  EXPECT_TRUE(VerifyVectorUint8(output->key_blob.key_material,
                                output->key_blob.key_material_size,
                                input->key_blob_to_upgrade));
  EXPECT_TRUE(VerifyKeyParametersWithStrictInputs(output->upgrade_params,
                                                  input->upgrade_params));
}

TEST(ConvertToKeymasterMessage, BeginOperationRequest) {
  // Prepare.
  ::arc::mojom::keymint::HardwareAuthTokenPtr auth_token_ptr =
      CreateHardwareAuthToken();
  auto input = arc::mojom::keymint::BeginRequest::New(
      arc::mojom::keymint::KeyPurpose::AGREE_KEY,
      std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()), KeyParameterVector(),
      std::move(auth_token_ptr));

  // Convert.
  auto output =
      MakeBeginOperationRequest(std::move(input), kKeyMintMessageVersion);

  // Verify.
  EXPECT_EQ(output->purpose,
            static_cast<keymaster_purpose_t>(input->key_purpose));
  EXPECT_TRUE(VerifyVectorUint8(output->key_blob.key_material,
                                output->key_blob.key_material_size,
                                input->key_blob));
  EXPECT_TRUE(VerifyKeyParametersWithStrictInputs(output->additional_params,
                                                  input->params));
  EXPECT_TRUE(
      VerifyHardwareAuthToken(output->additional_params, *input->auth_token));
}

TEST(ConvertToMessage, UpdateOperationRequest) {
  // Prepare.
  ::arc::mojom::keymint::HardwareAuthTokenPtr auth_token_ptr =
      CreateHardwareAuthToken();

  ::arc::mojom::keymint::TimeStampTokenPtr time_token_ptr =
      CreateTimeStampToken();

  auto input = arc::mojom::keymint::UpdateRequest::New(
      65537, std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()),
      std::move(auth_token_ptr), std::move(time_token_ptr));

  // Convert.
  auto output = MakeUpdateOperationRequest(input, kKeyMintMessageVersion);

  // Verify.
  // We are not verifying the TimeStampTokenPtr now as it is not
  // used in the KeyMint Reference implementation.
  EXPECT_EQ(output->op_handle, input->op_handle);
  EXPECT_TRUE(VerifyVectorUint8(output->input.begin(),
                                output->input.available_read(), input->input));
  EXPECT_TRUE(
      VerifyHardwareAuthToken(output->additional_params, *input->auth_token));
}

TEST(ConvertToMessage, DeviceLockedRequest) {
  // Prepare.
  bool password_only = true;
  ::arc::mojom::keymint::TimeStampTokenPtr time_token_ptr =
      CreateTimeStampToken();

  // Convert.
  auto output = MakeDeviceLockedRequest(password_only, time_token_ptr,
                                        kKeyMintMessageVersion);

  // Verify.
  ASSERT_TRUE(output);
  EXPECT_EQ(output->passwordOnly, password_only);
  EXPECT_TRUE(VerifyVerificationToken(output->token, time_token_ptr));
}

TEST(ConvertToMessage, FinishOperationRequest) {
  // Prepare.
  ::arc::mojom::keymint::HardwareAuthTokenPtr auth_token_ptr =
      CreateHardwareAuthToken();

  ::arc::mojom::keymint::TimeStampTokenPtr time_token_ptr =
      CreateTimeStampToken();

  auto input = arc::mojom::keymint::FinishRequest::New(
      65537, std::vector<uint8_t>(kBlob1.begin(), kBlob1.end()),
      std::vector<uint8_t>(kBlob2.begin(), kBlob2.end()),
      std::move(auth_token_ptr), std::move(time_token_ptr),
      std::vector<uint8_t>(kBlob3.begin(), kBlob3.end()));

  // Convert.
  auto output = MakeFinishOperationRequest(input, kKeyMintMessageVersion);

  // Verify.
  ASSERT_TRUE(input);
  ASSERT_TRUE(output);
  EXPECT_EQ(output->op_handle, input->op_handle);
  EXPECT_TRUE(VerifyVectorUint8(output->input.begin(),
                                output->input.available_read(),
                                input->input.value()));
  EXPECT_TRUE(VerifyVectorUint8(output->signature.begin(),
                                output->signature.available_read(),
                                input->signature.value()));
  EXPECT_TRUE(
      VerifyHardwareAuthToken(output->additional_params, *input->auth_token));
}

TEST(PrepareResult, GenerateEcdsaP256KeyPairResultOrErrorPtr) {
  // Prepare.
  ::keymaster::GenerateRkpKeyResponse input(kKeyMintMessageVersion);
  input.error = KM_ERROR_OK;
  ::keymaster::KeymasterBlob maced_public_key(kBlob1.data(), kBlob1.size());
  input.maced_public_key = maced_public_key;
  ::keymaster::KeymasterKeyBlob key_blob(kBlob2.data(), kBlob2.size());
  input.key_blob = key_blob;

  // Convert.
  auto mojo = MakeGenerateEcdsaP256KeyPairResult(input);

  // Verify.
  EXPECT_TRUE(mojo->is_key_pair_result());
  EXPECT_TRUE(
      VerifyVectorUint8(maced_public_key.data, maced_public_key.data_length,
                        mojo->get_key_pair_result()->maced_public_key->data));
  // Verify.
  EXPECT_TRUE(VerifyVectorUint8(
      key_blob.key_material, key_blob.key_material_size,
      mojo->get_key_pair_result()->handle_to_private_key->key_material));
}

}  // namespace arc::keymint