From 4305f30cfbba734c7fb149492f032a847c2e79dc Mon Sep 17 00:00:00 2001
From: Mohammed Riad <52679407+MhmRdd@users.noreply.github.com>
Date: Wed, 18 Mar 2026 17:35:02 +0100
Subject: [PATCH] Infer KEY_SIZE from EC_CURVE for implicit sizes

In KeyMint, the KEY_SIZE tag is often omitted by callers when an EC_CURVE is explicitly provided, as the curve implicitly defines the bit length.

Previously, the simulator defaulted keySize to 0 when the tag was absent. This resulted in "0" being reported in the teeEnforced authorization list and KeyMetadata, which is a trivial detection vector for simulators.

Changes:
- Implemented `deriveKeySizeFromCurve()` to map EcCurve constants to their respective bit-sizes.
- Used the derived size as a fallback when Tag.KEY_SIZE is missing.
- Added support for Curve 25519 (256-bit).
---
 .../attestation/KeyMintAttestation.kt             | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt b/app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt
index baa174d4..acdb66a6 100644
--- a/app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt
@@ -50,7 +50,8 @@ data class KeyMintAttestation(
         algorithm = params.findAlgorithm(Tag.ALGORITHM) ?: 0,
 
         // AOSP: [key_param(tag = KEY_SIZE, field = Integer)]
-        keySize = params.findInteger(Tag.KEY_SIZE) ?: 0,
+        // For EC keys, derive keySize from EC_CURVE when KEY_SIZE is absent.
+        keySize = params.findInteger(Tag.KEY_SIZE) ?: params.deriveKeySizeFromCurve(),
 
         // AOSP: [key_param(tag = EC_CURVE, field = EcCurve)]
         ecCurve = params.findEcCurve(Tag.EC_CURVE),
@@ -167,6 +168,18 @@ private fun Array<KeyParameter>.findAllKeyPurpose(tag: Int): List<Int> =
 private fun Array<KeyParameter>.findAllDigests(tag: Int): List<Int> =
     this.filter { it.tag == tag }.map { it.value.digest }
 
+/** Derives keySize from EC_CURVE tag when KEY_SIZE is not explicitly provided. */
+private fun Array<KeyParameter>.deriveKeySizeFromCurve(): Int {
+    val curveId = this.find { it.tag == Tag.EC_CURVE }?.value?.ecCurve ?: return 0
+    return when (curveId) {
+        EcCurve.P_224 -> 224
+        EcCurve.P_256, EcCurve.CURVE_25519 -> 256
+        EcCurve.P_384 -> 384
+        EcCurve.P_521 -> 521
+        else -> 0
+    }
+}
+
 /**
  * Derives the EC Curve name. Logic: Checks specific EC_CURVE tag first (field=EcCurve), falls back
  * to KEY_SIZE (field=Integer).