fix: tighten protected key authorization handling

Author: szijpeter

waltid-libraries/crypto/waltid-crypto/src/androidDeviceTest/kotlin/id/walt/crypto/BiometricProtectedKeyInteractiveTest.kt

@@ -50,7 +50,7 @@ class BiometricProtectedKeyInteractiveTest {
                 kid = alias,
                 keyType = KeyType.secp256r1,
                 keyUseAuthorizationPolicy = KeyUseAuthorizationPolicy.BiometricCurrentSet,
-                interactionContext = activity,
+                interactionContextProvider = { activity },
             )
         )
         val plaintext = "authorize every key use".encodeToByteArray()
@@ -74,7 +74,7 @@ class BiometricProtectedKeyInteractiveTest {
                 kid = alias,
                 keyType = KeyType.secp256r1,
                 keyUseAuthorizationPolicy = KeyUseAuthorizationPolicy.BiometricCurrentSet,
-                interactionContext = activity,
+                interactionContextProvider = { activity },
             )
         )
 

waltid-libraries/crypto/waltid-crypto/src/androidMain/kotlin/id/walt/crypto/AndroidKey.kt

@@ -28,7 +28,6 @@ import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonObject
 import org.bouncycastle.jce.provider.BouncyCastleProvider
-import java.lang.ref.WeakReference
 import kotlin.io.encoding.Base64
 import kotlin.time.Duration
 import kotlin.uuid.Uuid
@@ -40,22 +39,8 @@ sealed class AndroidKey : Key() {
         val keyType: KeyType,
         val keyUseAuthorizationPolicy: KeyUseAuthorizationPolicy = KeyUseAuthorizationPolicy.None,
         val authorizationPrompt: KeyUseAuthorizationPrompt = KeyUseAuthorizationPrompt(),
-        interactionContext: Any? = null,
+        private val interactionContextProvider: () -> FragmentActivity? = { null },
     ) {
-        private val interactionContextProvider: () -> FragmentActivity? = when (interactionContext) {
-            is FragmentActivity -> {
-                val reference = WeakReference(interactionContext)
-                val provider: () -> FragmentActivity? = { reference.get() }
-                provider
-            }
-            is Function0<*> -> {
-                { interactionContext.invoke() as? FragmentActivity }
-            }
-            else -> {
-                { null }
-            }
-        }
-
         internal val interactionContext: FragmentActivity?
             get() = interactionContextProvider().takeIf { it.canHostBiometricPrompt() }
     }

waltid-libraries/crypto/waltid-crypto/src/iosMain/kotlin/id/walt/crypto/IosKey.kt

@@ -2,6 +2,7 @@ package id.walt.crypto
 
 import at.asitplus.signum.indispensable.josef.io.joseCompliantSerializer
 import at.asitplus.signum.indispensable.josef.toJsonWebKey
+import at.asitplus.signum.supreme.CFCryptoOperationFailed
 import at.asitplus.signum.supreme.SignatureResult
 import at.asitplus.signum.supreme.dsl.REQUIRED
 import at.asitplus.signum.supreme.os.IosSigner
@@ -21,6 +22,7 @@ import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.jsonObject
+import platform.Security.errSecItemNotFound
 import kotlin.io.encoding.Base64
 import kotlin.time.Duration
 import kotlin.uuid.Uuid
@@ -242,16 +244,27 @@ private fun IosKey.Options.requireSupportedProtectedCombination() {
     }
 }
 
-private fun IosKey.Options.mapPlatformFailure(throwable: Throwable): Throwable {
+@OptIn(kotlinx.cinterop.ExperimentalForeignApi::class)
+internal fun IosKey.Options.mapPlatformFailure(throwable: Throwable): Throwable {
     if (keyUseAuthorizationPolicy == KeyUseAuthorizationPolicy.None) return throwable
-    return if (generateSequence(throwable as Throwable?) { it.cause }.any { it is NoSuchElementException }) {
-        KeyUseAuthorizationException(
+    val causes = generateSequence(throwable as Throwable?) { it.cause }.toList()
+    return when {
+        causes.any { it is NoSuchElementException } -> KeyUseAuthorizationException(
             failure = KeyUseAuthorizationFailure.ProtectedKeyMissing,
             message = "The protected key is missing",
             cause = throwable,
         )
-    } else {
-        throwable
+
+        // BiometryCurrentSet invalidation can leave Signum's public-key metadata present while the
+        // OS makes the protected private key inaccessible as an absent Keychain item.
+        causes.filterIsInstance<CFCryptoOperationFailed>().any { it.osStatus == errSecItemNotFound } ->
+            KeyUseAuthorizationException(
+                failure = KeyUseAuthorizationFailure.ProtectedKeyInvalidated,
+                message = "The protected key is no longer usable under its biometric current-set policy",
+                cause = throwable,
+            )
+
+        else -> throwable
     }
 }
 

waltid-libraries/crypto/waltid-crypto/src/iosTest/kotlin/id/walt/crypto/MobilePlatformKeySupportTest.kt

@@ -1,16 +1,28 @@
 package id.walt.crypto
 
+import at.asitplus.signum.supreme.CFCryptoOperationFailed
 import at.asitplus.signum.supreme.SignatureResult
 import at.asitplus.signum.supreme.UnlockFailed
 import id.walt.crypto.keys.KeyUseAuthorizationException
 import id.walt.crypto.keys.KeyUseAuthorizationFailure
+import id.walt.crypto.keys.KeyUseAuthorizationPolicy
+import id.walt.crypto.keys.KeyType
+import kotlinx.cinterop.ExperimentalForeignApi
+import platform.Security.errSecItemNotFound
 import kotlin.test.Test
 import kotlin.test.assertEquals
 import kotlin.test.assertFailsWith
+import kotlin.test.assertIs
 import kotlin.test.assertSame
 
 class MobilePlatformKeySupportTest {
 
+    private val protectedOptions = IosKey.Options(
+        keyType = KeyType.secp256r1,
+        inSecureElement = true,
+        keyUseAuthorizationPolicy = KeyUseAuthorizationPolicy.BiometricCurrentSet,
+    )
+
     @Test
     fun signumUnlockFailureMapsToStableAuthorizationFailureWithoutParsingMessage() {
         val result = SignatureResult.Failure(
@@ -39,6 +51,29 @@ class MobilePlatformKeySupportTest {
         assertSame(expected, actual)
     }
 
+    @OptIn(ExperimentalForeignApi::class)
+    @Test
+    fun inaccessibleCurrentSetKeyMapsToStableInvalidatedFailure() {
+        val failure = assertIs<KeyUseAuthorizationException>(
+            protectedOptions.mapPlatformFailure(
+                CFCryptoOperationFailed("retrieve private key", errSecItemNotFound)
+            )
+        )
+
+        assertEquals(KeyUseAuthorizationFailure.ProtectedKeyInvalidated, failure.failure)
+    }
+
+    @Test
+    fun absentProtectedKeyRemainsStableMissingFailure() {
+        val failure = assertIs<KeyUseAuthorizationException>(
+            protectedOptions.mapPlatformFailure(
+                NoSuchElementException("No key for alias exists")
+            )
+        )
+
+        assertEquals(KeyUseAuthorizationFailure.ProtectedKeyMissing, failure.failure)
+    }
+
     @Test
     fun unprotectedSignumFailureKeepsLegacyCheckFailure() {
         val result = SignatureResult.Failure(UnlockFailed("legacy failure"))

waltid-libraries/protocols/waltid-openid4vc-wallet-persistence-mobile/src/androidMain/kotlin/id/walt/wallet2/persistence/keys/AndroidPlatformKeyProvider.kt

@@ -79,7 +79,7 @@ public class AndroidPlatformKeyProvider private constructor(
             keyType = request.keyType,
             keyUseAuthorizationPolicy = request.keyUseAuthorizationPolicy,
             authorizationPrompt = authorizationPrompt,
-            interactionContext = interactionContextProvider,
+            interactionContextProvider = interactionContextProvider,
         )
         return if (isPlatformBacked(request.keyType)) {
             AndroidKey.Platform.create(options)
@@ -104,7 +104,7 @@ public class AndroidPlatformKeyProvider private constructor(
             keyType = keyType,
             keyUseAuthorizationPolicy = keyUseAuthorizationPolicy,
             authorizationPrompt = authorizationPrompt,
-            interactionContext = interactionContextProvider,
+            interactionContextProvider = interactionContextProvider,
         )
         return if (keyUseAuthorizationPolicy == KeyUseAuthorizationPolicy.None) {
             runCatching { AndroidKey.Platform.load(options) }.getOrNull()