Start Differentiating Credential Types

Added structure for additional credential types by moving existing code
to a credential package and creating abstract classes for Credential
and SecureAreaBoundCredential, with MdocCredential as the first
implementation.

All tests pass + tested manually by provisioning and presenting in
wallet and appholder.

Signed-off-by: Suzanna Jiwani <suzannaj@google.com>

Author: suzannajiwani

appholder/src/main/java/com/android/identity/wallet/GetCredentialActivity.kt

@@ -12,7 +12,7 @@ import com.android.identity.android.mdoc.util.CredmanUtil
 import com.android.identity.android.mdoc.util.CredmanUtil.Companion.generateClientIdHash
 import com.android.identity.android.mdoc.util.CredmanUtil.Companion.generatePublicKeyHash
 import com.android.identity.android.securearea.AndroidKeystoreKeyUnlockData
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.document.DocumentRequest
 import com.android.identity.document.NameSpacedData
 import com.android.identity.crypto.Algorithm
@@ -41,7 +41,7 @@ import java.util.StringTokenizer
 class GetCredentialActivity : FragmentActivity() {
 
     fun addDeviceNamespaces(documentGenerator : DocumentGenerator,
-                            authKey : Credential,
+                            authKey : MdocCredential,
                             unlockData: KeyUnlockData?) {
         documentGenerator.setDeviceNamespacesSignature(
             NameSpacedData.Builder().build(),
@@ -51,7 +51,7 @@ class GetCredentialActivity : FragmentActivity() {
             Algorithm.ES256)
     }
 
-    fun doBiometricAuth(authKey : Credential,
+    fun doBiometricAuth(authKey : MdocCredential,
                         forceLskf : Boolean,
                         onBiometricAuthCompleted: (unlockData: KeyUnlockData?) -> Unit) {
         var title = "To share your credential we need to check that it's you."
@@ -130,7 +130,7 @@ class GetCredentialActivity : FragmentActivity() {
         val credential = document.findCredential(
             ProvisioningUtil.CREDENTIAL_DOMAIN,
             Timestamp.now()
-        ) ?: throw IllegalStateException("No credential")
+        ) as MdocCredential? ?: throw IllegalStateException("No credential")
         val staticAuthData = StaticAuthDataParser(credential.issuerProvidedData).parse()
         val mergedIssuerNamespaces = MdocUtil.mergeIssuerNamesSpaces(
             documentRequest, nameSpacedData, staticAuthData

appholder/src/main/java/com/android/identity/wallet/HolderApp.kt

@@ -5,6 +5,8 @@ import android.content.Context
 import com.android.identity.android.securearea.AndroidKeystoreSecureArea
 import com.android.identity.android.storage.AndroidStorageEngine
 import com.android.identity.android.util.AndroidLogPrinter
+import com.android.identity.credential.CredentialFactory
+import com.android.identity.credential.MdocCredential
 import com.android.identity.document.DocumentStore
 import com.android.identity.documenttype.DocumentTypeRepository
 import com.android.identity.documenttype.knowntypes.DrivingLicense
@@ -85,7 +87,10 @@ class HolderApp: Application() {
 
             secureAreaRepository.addImplementation(androidKeystoreSecureArea)
             secureAreaRepository.addImplementation(softwareSecureArea)
-            return DocumentStore(storageEngine, secureAreaRepository)
+
+            var credentialFactory = CredentialFactory()
+            credentialFactory.addCredentialImplementation(MdocCredential::class)
+            return DocumentStore(storageEngine, secureAreaRepository, credentialFactory)
         }
     }
 

appholder/src/main/java/com/android/identity/wallet/support/AndroidKeystoreSecureAreaSupport.kt

@@ -21,7 +21,7 @@ import com.android.identity.android.securearea.UserAuthenticationType
 import com.android.identity.android.securearea.userAuthenticationTypeSet
 import com.android.identity.cbor.Cbor
 import com.android.identity.cbor.CborMap
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.crypto.Algorithm
 import com.android.identity.securearea.CreateKeySettings
 import com.android.identity.crypto.EcCurve
@@ -51,7 +51,7 @@ class AndroidKeystoreSecureAreaSupport(
     )
 
     override fun Fragment.unlockKey(
-        authKey: Credential,
+        authKey: MdocCredential,
         onKeyUnlocked: (unlockData: KeyUnlockData?) -> Unit,
         onUnlockFailure: (wasCancelled: Boolean) -> Unit
     ) {

appholder/src/main/java/com/android/identity/wallet/support/SecureAreaSupport.kt

@@ -4,7 +4,7 @@ import android.content.Context
 import androidx.compose.runtime.Composable
 import androidx.fragment.app.Fragment
 import com.android.identity.android.securearea.AndroidKeystoreSecureArea
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.document.Document
 import com.android.identity.securearea.CreateKeySettings
 import com.android.identity.securearea.KeyUnlockData
@@ -35,7 +35,7 @@ interface SecureAreaSupport {
      * there is a provided way to navigate using the [findNavController] function.
      */
     fun Fragment.unlockKey(
-        authKey: Credential,
+        authKey: MdocCredential,
         onKeyUnlocked: (unlockData: KeyUnlockData?) -> Unit,
         onUnlockFailure: (wasCancelled: Boolean) -> Unit
     )

appholder/src/main/java/com/android/identity/wallet/support/SecureAreaSupportNull.kt

@@ -11,7 +11,7 @@ import androidx.compose.runtime.remember
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
 import androidx.fragment.app.Fragment
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.securearea.CreateKeySettings
 import com.android.identity.securearea.KeyUnlockData
 import com.android.identity.util.Timestamp
@@ -40,7 +40,7 @@ class SecureAreaSupportNull : SecureAreaSupport {
     }
 
     override fun Fragment.unlockKey(
-        authKey: Credential,
+        authKey: MdocCredential,
         onKeyUnlocked: (unlockData: KeyUnlockData?) -> Unit,
         onUnlockFailure: (wasCancelled: Boolean) -> Unit
     ) {

appholder/src/main/java/com/android/identity/wallet/support/SoftwareKeystoreSecureAreaSupport.kt

@@ -20,7 +20,7 @@ import androidx.lifecycle.repeatOnLifecycle
 import androidx.navigation.fragment.findNavController
 import co.nstant.`in`.cbor.CborBuilder
 import com.android.identity.cbor.Cbor
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.crypto.Algorithm
 import com.android.identity.crypto.CertificateChain
 import com.android.identity.crypto.Crypto
@@ -56,7 +56,7 @@ class SoftwareKeystoreSecureAreaSupport : SecureAreaSupport {
     private val screenState = SoftwareKeystoreSecureAreaSupportState()
 
     override fun Fragment.unlockKey(
-        authKey: Credential,
+        authKey: MdocCredential,
         onKeyUnlocked: (unlockData: KeyUnlockData?) -> Unit,
         onUnlockFailure: (wasCancelled: Boolean) -> Unit
     ) {

appholder/src/main/java/com/android/identity/wallet/transfer/AddDocumentToResponseResult.kt

@@ -1,6 +1,6 @@
 package com.android.identity.wallet.transfer
 
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 
 sealed class AddDocumentToResponseResult {
 
@@ -9,6 +9,6 @@ sealed class AddDocumentToResponseResult {
     ) : AddDocumentToResponseResult()
 
     data class DocumentLocked(
-        val authKey: Credential
+        val authKey: MdocCredential
     ) : AddDocumentToResponseResult()
 }

appholder/src/main/java/com/android/identity/wallet/transfer/TransferManager.kt

@@ -9,7 +9,7 @@ import android.view.View
 import android.widget.ImageView
 import androidx.lifecycle.LiveData
 import androidx.lifecycle.MutableLiveData
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.document.DocumentRequest
 import com.android.identity.document.NameSpacedData
 import com.android.identity.mdoc.mso.StaticAuthDataParser
@@ -163,7 +163,7 @@ class TransferManager private constructor(private val context: Context) {
         docType: String,
         issuerSignedEntriesToRequest: MutableMap<String, Collection<String>>,
         deviceResponseGenerator: DeviceResponseGenerator,
-        authKey: Credential?,
+        authKey: MdocCredential?,
         authKeyUnlockData: KeyUnlockData?,
     ) = suspendCancellableCoroutine { continuation ->
         var result: AddDocumentToResponseResult
@@ -181,11 +181,14 @@ class TransferManager private constructor(private val context: Context) {
 
         val request = DocumentRequest(dataElements)
 
-        val credentialToUse: Credential
+        val credentialToUse: MdocCredential
         if (authKey != null) {
             credentialToUse = authKey
         } else {
-            credentialToUse = document.findCredential(ProvisioningUtil.CREDENTIAL_DOMAIN, Timestamp.now())
+            credentialToUse = document.findCredential(
+                ProvisioningUtil.CREDENTIAL_DOMAIN,
+                Timestamp.now()
+            ) as MdocCredential?
                 ?: throw IllegalStateException("No credential available")
         }
 

appholder/src/main/java/com/android/identity/wallet/util/ProvisioningUtil.kt

@@ -14,6 +14,7 @@ import com.android.identity.cbor.Tagged
 import com.android.identity.cbor.toDataItem
 import com.android.identity.cose.Cose
 import com.android.identity.cose.CoseNumberLabel
+import com.android.identity.credential.MdocCredential
 import com.android.identity.document.Document
 import com.android.identity.document.DocumentUtil
 import com.android.identity.document.NameSpacedData
@@ -117,7 +118,7 @@ class ProvisioningUtil private constructor(
             validUntil
         )
 
-        val pendingCredsCount = DocumentUtil.managedCredentialHelper(
+        val pendingCredsCount = DocumentUtil.managedMdocCredentialHelper(
             document,
             secureArea,
             settings,
@@ -132,7 +133,8 @@ class ProvisioningUtil private constructor(
             return
         }
 
-        for (pendingCred in document.pendingCredentials) {
+        for (pendingCred in document.pendingCredentials.filter { it.domain == CREDENTIAL_DOMAIN }) {
+            pendingCred as MdocCredential
             val msoGenerator = MobileSecurityObjectGenerator(
                 "SHA-256",
                 docType,
@@ -288,6 +290,7 @@ class ProvisioningUtil private constructor(
                     ?: throw IllegalStateException("No Secure Area with id ${authKeySecureAreaIdentifier} for document ${it.name}")
 
                 val credentials = certifiedCredentials.map { key ->
+                    key as MdocCredential
                     val info = authKeySecureArea.getKeyInfo(key.alias)
                     DocumentInformation.KeyData(
                         counter = key.credentialCounter.toInt(),

appholder/src/main/java/com/android/identity/wallet/viewmodel/TransferDocumentViewModel.kt

@@ -8,7 +8,7 @@ import androidx.lifecycle.AndroidViewModel
 import androidx.lifecycle.LiveData
 import androidx.lifecycle.MutableLiveData
 import androidx.lifecycle.viewModelScope
-import com.android.identity.document.Credential
+import com.android.identity.credential.MdocCredential
 import com.android.identity.mdoc.request.DeviceRequestParser
 import com.android.identity.mdoc.response.DeviceResponseGenerator
 import com.android.identity.securearea.KeyUnlockData
@@ -102,7 +102,7 @@ class TransferDocumentViewModel(val app: Application) : AndroidViewModel(app) {
 
     fun sendResponseForSelection(
         onResultReady: (result: AddDocumentToResponseResult) -> Unit,
-        authKey: Credential? = null,
+        authKey: MdocCredential? = null,
         authKeyUnlockData: KeyUnlockData? = null
     ) {
         val elementsToSend = signedElements.collect()

gradle/libs.versions.toml

@@ -1,5 +1,6 @@
 [versions]
     compile-sdk = "34"
+    kotlin-reflect = "1.9.23"
     min-sdk = "26"
     kotlin = "1.8.20"
     gradle-plugin = "7.4.0"
@@ -67,6 +68,8 @@
     androidx-navigation-ktx = { module = "androidx.navigation:navigation-fragment-ktx", version.ref = "navigation" }
     androidx-navigation-ui-ktx = { module = "androidx.navigation:navigation-ui-ktx", version.ref = "navigation" }
 
+    kotlin-reflect = { module = "org.jetbrains.kotlin:kotlin-reflect", version.ref = "kotlin-reflect" }
+
     kotlinx-coroutines-core = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-core", version.ref="kotlinx-coroutines" }
     kotlinx-coroutines-android = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-android", version.ref="kotlinx-coroutines" }
     kotlinx-coroutines-guava = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-guava", version.ref="kotlinx-coroutines" }

identity-android/src/androidTest/java/com/android/identity/android/document/AndroidKeystoreSecureAreaDocumentStoreTest.kt

@@ -21,6 +21,8 @@ import com.android.identity.android.securearea.AndroidKeystoreCreateKeySettings
 import com.android.identity.android.securearea.AndroidKeystoreSecureArea
 import com.android.identity.android.securearea.UserAuthenticationType
 import com.android.identity.android.storage.AndroidStorageEngine
+import com.android.identity.credential.CredentialFactory
+import com.android.identity.credential.MdocCredential
 import com.android.identity.document.Document
 import com.android.identity.document.DocumentStore
 import com.android.identity.crypto.javaX509Certificate
@@ -43,6 +45,7 @@ class AndroidKeystoreSecureAreaDocumentStoreTest {
     private lateinit var storageEngine: StorageEngine
     private lateinit var secureArea: SecureArea
     private lateinit var secureAreaRepository: SecureAreaRepository
+    private lateinit var credentialFactory: CredentialFactory
 
     @Before
     fun setup() {
@@ -52,11 +55,13 @@ class AndroidKeystoreSecureAreaDocumentStoreTest {
         secureAreaRepository = SecureAreaRepository()
         secureArea = AndroidKeystoreSecureArea(context, storageEngine)
         secureAreaRepository.addImplementation(secureArea)
+        credentialFactory = CredentialFactory()
+        credentialFactory.addCredentialImplementation(MdocCredential::class)
     }
 
     @Test
     fun testBasic() {
-        val documentStore = DocumentStore(storageEngine, secureAreaRepository)
+        val documentStore = DocumentStore(storageEngine, secureAreaRepository, credentialFactory)
         var document: Document? = documentStore.createDocument(
             "testDocument"
         )
@@ -65,7 +70,7 @@ class AndroidKeystoreSecureAreaDocumentStoreTest {
 
         // Create pending credential and check its attestation
         val authKeyChallenge = byteArrayOf(20, 21, 22)
-        val pendingCredential = document.createCredential(
+        val pendingCredential = MdocCredential.create(
             CREDENTIAL_DOMAIN,
             secureArea,
             AndroidKeystoreCreateKeySettings.Builder(authKeyChallenge)
@@ -74,7 +79,8 @@ class AndroidKeystoreSecureAreaDocumentStoreTest {
                     setOf(UserAuthenticationType.LSKF, UserAuthenticationType.BIOMETRIC)
                 )
                 .build(),
-            null
+            null,
+            document
         )
         Assert.assertFalse(pendingCredential.isCertified)
         val parser =

identity-android/src/androidTest/java/com/android/identity/android/mdoc/deviceretrieval/DeviceRetrievalHelperTest.kt

@@ -32,7 +32,9 @@ import com.android.identity.cose.Cose
 import com.android.identity.cose.Cose.coseSign1Sign
 import com.android.identity.cose.CoseLabel
 import com.android.identity.cose.CoseNumberLabel
-import com.android.identity.document.Credential
+import com.android.identity.credential.CredentialFactory
+import com.android.identity.credential.MdocCredential
+import com.android.identity.credential.SecureAreaBoundCredential
 import com.android.identity.document.Document
 import com.android.identity.document.DocumentStore
 import com.android.identity.document.NameSpacedData
@@ -96,7 +98,7 @@ class DeviceRetrievalHelperTest {
     private lateinit var mSecureArea: SecureArea
     private lateinit var mSecureAreaRepository: SecureAreaRepository
     private lateinit var mDocument: Document
-    private lateinit var mCredential: Credential
+    private lateinit var mMdocCredential: SecureAreaBoundCredential
     private lateinit var mTimeSigned: Timestamp
     private lateinit var mTimeValidityBegin: Timestamp
     private lateinit var mTimeValidityEnd: Timestamp
@@ -114,9 +116,12 @@ class DeviceRetrievalHelperTest {
         mSecureAreaRepository = SecureAreaRepository()
         mSecureArea = SoftwareSecureArea(mStorageEngine)
         mSecureAreaRepository.addImplementation(mSecureArea)
+        var credentialFactory = CredentialFactory()
+        credentialFactory.addCredentialImplementation(MdocCredential::class)
         val documentStore = DocumentStore(
             mStorageEngine,
-            mSecureAreaRepository
+            mSecureAreaRepository,
+            credentialFactory
         )
 
         // Create the document...
@@ -135,21 +140,22 @@ class DeviceRetrievalHelperTest {
         mTimeSigned = ofEpochMilli(nowMillis)
         mTimeValidityBegin = ofEpochMilli(nowMillis + 3600 * 1000)
         mTimeValidityEnd = ofEpochMilli(nowMillis + 10 * 86400 * 1000)
-        mCredential = mDocument.createCredential(
+        mMdocCredential = MdocCredential.create(
             CREDENTIAL_DOMAIN,
             mSecureArea,
             SoftwareCreateKeySettings.Builder(ByteArray(0))
                 .setKeyPurposes(setOf(KeyPurpose.SIGN, KeyPurpose.AGREE_KEY))
                 .build(),
-            null
+            null,
+            mDocument
         )
-        Assert.assertFalse(mCredential.isCertified)
+        Assert.assertFalse(mMdocCredential.isCertified)
 
         // Generate an MSO and issuer-signed data for this credential.
         val msoGenerator = MobileSecurityObjectGenerator(
             "SHA-256",
             MDL_DOCTYPE,
-            mCredential.attestation.certificates[0].publicKey
+            mMdocCredential.attestation.certificates[0].publicKey
         )
         msoGenerator.setValidityInfo(mTimeSigned, mTimeValidityBegin, mTimeValidityEnd, null)
         val issuerNameSpaces = generateIssuerNameSpaces(
@@ -213,7 +219,7 @@ class DeviceRetrievalHelperTest {
         ).generate()
 
         // Now that we have issuer-provided authentication data we certify the credential.
-        mCredential.certify(
+        mMdocCredential.certify(
             issuerProvidedAuthenticationData,
             mTimeValidityBegin,
             mTimeValidityEnd
@@ -377,7 +383,7 @@ class DeviceRetrievalHelperTest {
                     val generator = DeviceResponseGenerator(
                         Constants.DEVICE_RESPONSE_STATUS_OK
                     )
-                    val staticAuthData = StaticAuthDataParser(mCredential.issuerProvidedData)
+                    val staticAuthData = StaticAuthDataParser(mMdocCredential.issuerProvidedData)
                         .parse()
                     val deviceSignedData = NameSpacedData.Builder().build()
                     val mergedIssuerNamespaces: Map<String, List<ByteArray>> =
@@ -395,8 +401,8 @@ class DeviceRetrievalHelperTest {
                             .setIssuerNamespaces(mergedIssuerNamespaces)
                             .setDeviceNamespacesSignature(
                                 deviceSignedData,
-                                mCredential.secureArea,
-                                mCredential.alias,
+                                mMdocCredential.secureArea,
+                                mMdocCredential.alias,
                                 null,
                                 Algorithm.ES256
                             )