java/remoteprovisioning/CborUtil.java
/**
   * Interprets {@code cborProtectedData} as a COSE_Encrypt message with a single recipient. The
   * method uses the provided {@code eek} to decrypt the content field of the message after
   * retrieving the ephemeral public key that KeyMint on the device in question generated in
   * order to encrypt the bundle. The content included should be a ProtectedDataPayload array
   * containing a signed mac key, a boot certificate chain, and any additional device public key
   * signatures from the OEM.
   *
   * @param cborProtectedData the COSE_Encrypt message representing ProtectedData
   *
   * @param eek The server's endpoint encryption key to be used in ECDH to derive the decryption
   *            key
   *
   * @return CBORObject the content field in the cborProtectedData object as a CBOR array
   */
Interprets  cborProtectedData as a COSE_Encrypt message with a single recipient. The
method uses the provided  eek to decrypt the content field of the message after
retrieving the ephemeral public key that KeyMint on the device in question generated in
order to encrypt the bundle. The content included should be a ProtectedDataPayload array
containing a signed mac key, a boot certificate chain, and any additional device public key
signatures from the OEM.



@param eek The server's endpoint encryption key to be used in ECDH to derive the decryption
key

@return CBORObject the content field in the cborProtectedData object as a CBOR array
Interprets cborProtectedData as a COSE_Encrypt message with a single recipient . The method uses the provided eek to decrypt the content field of the message after retrieving the ephemeral public key that KeyMint on the device in question generated in order to encrypt the bundle . The content included should be a ProtectedDataPayload array containing a signed mac key a boot certificate chain and any additional device public key signatures from the OEM . @param eek The server ' s endpoint encryption key to be used in ECDH to derive the decryption key @return CBORObject the content field in the cborProtectedData object as a CBOR array
public static CBORObject decodeEncryptMessage(
      byte[] cborProtectedData, AsymmetricCipherKeyPair eek) throws CborException, CryptoException {
    CBORObject encMsg = CBORObject.DecodeFromBytes(cborProtectedData);
    checkArray(encMsg, COSE_ENCRYPT_LENGTH, "ProtectedData");
    byte[] serializedProtectedHeaders =
        encMsg.get(COSE_ENCRYPT_PROTECTED_HEADERS_INDEX).GetByteString();
    byte[] aad = buildEncStructure(serializedProtectedHeaders, null /* externalAad */);
    CBORObject protectedHeaders = CBORObject.DecodeFromBytes(serializedProtectedHeaders);
    CBORObject unprotectedHeaders = encMsg.get(COSE_ENCRYPT_UNPROTECTED_HEADERS_INDEX);
    byte[] content = encMsg.get(COSE_ENCRYPT_CIPHERTEXT_INDEX).GetByteString();
    CBORObject recipient = getRecipient(encMsg.get(COSE_ENCRYPT_RECIPIENTS_INDEX));
    CBORObject unprotectedHeadersRecip = recipient.get(COSE_RECIPIENT_UNPROTECTED_HEADERS_INDEX);
    CBORObject ephemeralPublicKeyCbor = unprotectedHeadersRecip.get(HeaderKeys.ECDH_EPK.AsCBOR());
    byte[] ephemeralPublicKey = ephemeralPublicKeyCbor.get(KeyKeys.OKP_X.AsCBOR()).GetByteString();
    byte[] derivedKey =
        CryptoUtil.deriveSharedKeyReceive(
            eek, CryptoUtil.byteArrayToX25519PublicKey(ephemeralPublicKey));
    byte[] iv = unprotectedHeaders.get(HeaderKeys.IV.AsCBOR()).GetByteString();
    return CBORObject.DecodeFromBytes(CryptoUtil.decrypt(content, aad, derivedKey, iv));
  }
public static CBORObject decodeEncryptMessage ( byte [ ] cborProtectedData , AsymmetricCipherKeyPair eek ) throws CborException , CryptoException { CBORObject encMsg = CBORObject . DecodeFromBytes ( cborProtectedData ) ; checkArray ( encMsg , COSE_ENCRYPT_LENGTH , "ProtectedData" ) ; byte [ ] serializedProtectedHeaders = encMsg . get ( COSE_ENCRYPT_PROTECTED_HEADERS_INDEX ) . GetByteString ( ) ; byte [ ] aad = buildEncStructure ( serializedProtectedHeaders , null /* externalAad */ ) ; CBORObject protectedHeaders = CBORObject . DecodeFromBytes ( serializedProtectedHeaders ) ; CBORObject unprotectedHeaders = encMsg . get ( COSE_ENCRYPT_UNPROTECTED_HEADERS_INDEX ) ; byte [ ] content = encMsg . get ( COSE_ENCRYPT_CIPHERTEXT_INDEX ) . GetByteString ( ) ; CBORObject recipient = getRecipient ( encMsg . get ( COSE_ENCRYPT_RECIPIENTS_INDEX ) ) ; CBORObject unprotectedHeadersRecip = recipient . get ( COSE_RECIPIENT_UNPROTECTED_HEADERS_INDEX ) ; CBORObject ephemeralPublicKeyCbor = unprotectedHeadersRecip . get ( HeaderKeys . ECDH_EPK . AsCBOR ( ) ) ; byte [ ] ephemeralPublicKey = ephemeralPublicKeyCbor . get ( KeyKeys . OKP_X . AsCBOR ( ) ) . GetByteString ( ) ; byte [ ] derivedKey = CryptoUtil . deriveSharedKeyReceive ( eek , CryptoUtil . byteArrayToX25519PublicKey ( ephemeralPublicKey ) ) ; byte [ ] iv = unprotectedHeaders . get ( HeaderKeys . IV . AsCBOR ( ) ) . GetByteString ( ) ; return CBORObject . DecodeFromBytes ( CryptoUtil . decrypt ( content , aad , derivedKey , iv ) ) ; }
Interprets {@code cborProtectedData} as a COSE_Encrypt message with a single recipient.
Interprets { @code cborProtectedData } as a COSE_Encrypt message with a single recipient .