| commit | 336b5db80970f5539ced3cd2f0b73c8b7a6aa116 | [log] [tgz] |
|---|---|---|
| author | Paul Crowley <paulcrowley@google.com> | Thu Apr 08 17:33:31 2021 -0700 |
| committer | Paul Crowley <paulcrowley@google.com> | Tue Apr 27 10:34:33 2021 -0700 |
| tree | cbaadfe977f3a56cbec4ffd2933b72d8031592c8 | |
| parent | 4459123d4932a2f4091115a5141d2ca63747ca09 [diff] |
Tell keystore which SIDs can unlock this user If biometric unlock is enabled, we tell keystore at lock time so that a key can be set up in KM which unlocks UNLOCKED_DEVICE_REQUIRED keys based on auth tokens carrying those SIDs. This also has the effect that if there is no biometric unlock, UNLOCKED_DEVICE_REQUIRED keys have full cryptographic protection, per NIAP requirements. Test: aosp/1686345 Bug: 163866361 Change-Id: Ia4d01faa998c76b2b33ad3520730466ac59e6d8d