AndroidSecureArea keys creation improvements

[mitrejcevski]

Partly Fixes #360

It's a good idea to open an issue first for discussion.

• Tests pass
• Appropriate changes to README are included in PR

[davidz25]

Did a quick test of this PR and it looks like quite a lot of work remains. Observations

• User auth timeout can not go below 1. It should be possible to set to 0 (which means "auth for every use of the key")

• after presenting an mDL, the holder returns to the main screen even when Auto close connection preference is not checked in Settings

• when allowLskf is unchecked, BiometricPrompt still has a Use PIN secondary button. Should not be shown.

• Authentication Key Curve drop-down always show ["P-256", "Ed25519", "X25519"]

  • when mdoc ECDSA authentication is selected it should show ["P-256", "Ed25519"]
  • when mdoc MAC authentication is selected it should show ["P-256", "X25519"]

• For BC keys, there's no way to choose mdoc authentication mode, this is only possible for Android Keystore keys.

  • This needs to be possible

• Auth keys are still mismanaged as pointed out on chat last week (Aug 29). See the thread/topic starting with me saying Have you noticed how "Refresh Auth Keys" tend to just create a lot of new keys when it shouldn't?

• It doesn't seem like there is a getAndroidHardwareCapabilities() class yet as we discussed earlier this week. It should have the following booleans to reflect the capabilities of the Android device the app is running on:

  • `attest_key``
  • secure_lock_screen
  • ecdh- curve_25519
  • strongbox
  • strongbox_ecdh
  • strongbox_25519
  • strongbox_attest_key
  • configure_user_authentication_type

[davidz25]

Should be called Android Keystore, not just Android.

[davidz25]

Only pick one of them, never both. If mdoc ECDSA authentication is used, pick KEY_PURPOSE_SIGN. If mdoc MAC authentication is used, pick KEY_PURPOSE_AGREE_KEY.

[davidz25]

Delete createAndroidKey() and createBouncyCastleKey() and just call createKey() directly on the SecureArea object. In general, please try to reduce the number of places where there's SecureArea-specific codepaths - this is so it'll be easier to add support for a new SecureArea in the future.

[mitrejcevski]

We did review the PR internally, and now we making it open. We have addressed the requested changed.
What's still missing:

• the implementation of the class that loads the device capabilities (called KeystoreUtil, currently returning all flags hardcoded to true) - we'll need @davidz25 help to do the implementation.
• the BoucyCastle related implementation

[davidz25]

I checked out the branch and did a quick testdrive, some observations

• When changing "mdoc ECDSA authentication" to "mdoc MAC authentication" (and not changing anything else), the credential is created but we crash at presentation time. The problem is that addDocumentToResponse() doesn't check if it should use sign() or keyAgreement() depending on the purpose of the chosen authentication key (it just always uses sign()). Should be simple to fix?
• "User authentication on" sounds a bit off, I think "Require User Authentication" is better
• We have "Hardware Backed" in details for each Authentication Key. Seems like a leftover, I think that should probably be "Secure Area" instead?
• The auto-close connection problem mentioned above is still there (appholder goes to main screen after first consent dialog)

[davidz25]

LGTM, let's merge this