自 2025 年 3 月 27 日起，我们建议您使用 android-latest-release 而非 aosp-main 构建 AOSP 并为其做出贡献。如需了解详情，请参阅 AOSP 的变更。
授权标记
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
标记是 KeyMint（以前称为 Keymaster）API 上的名称值对，可用作对 API 执行的操作的参数，或永久绑定到特定密钥的特性，或两者兼而有之。
每个标记都包含一个枚举值和一个指明是否允许多个值的相关类型。例如，名称为 BLOCK_MODE 的标记具有枚举值 4 和类型 ENUM_REP，表示关联的值是可重复枚举。
您可以在以下位置找到标记：
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-03-25。
[null,null,["最后更新时间 (UTC)：2025-03-25。"],[],[],null,["# Authorization tags\n\nThe KeyMint (previously Keymaster) API makes extensive use of *authorization tags*, which are name-value pairs. Each possible tag has:\n\n- An enum name with associated value\n- An associated type (for example, integer, bytes, date, enum), which includes an indication of whether multiple values are allowed\n\n\u003cbr /\u003e\n\nFor example, the tag with name\n[`Tag::BLOCK_MODE`](https://cs.android.com/android/platform/superproject/+/android-latest-release:hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl?q=BLOCK_MODE)\nhas a base enum value of `4` and a `TagType::ENUM_REP` type\nmarker that indicates that the associated value is a repeatable enum (in this\ncase, `BlockMode`).\n\nTags perform a dual function on the API:\n\n- As parameters for an operation performed on the API, for example, the `Tag::MAC_LENGTH` on an HMAC signing operation indicates the requested HMAC length.\n- As *key characteristics* , values that are permanently bound to a particular key (that is, included in the key blob), for example, the `Tag::EC_CURVE` indicates which elliptic curve a key is for. Each key characteristic is associated with a security level that indicates which part of the system polices the attribute:\n - A key characteristic with security level `TRUSTED_ENVIRONMENT` or `STRONGBOX` is enforced in the secure hardware.\n - A key characteristic with security level `SOFTWARE` or `KEYSTORE` is enforced only by the `keystore2` system service (and so such a characteristic isn't resilient to OS compromise).\n\n\u003cbr /\u003e\n\nMany tags act as both key characteristics *and* parameters:\n\n- The key characteristics indicate the set of allowed parameters for a key, for example:\n - The `Tag::PURPOSE` of an ECDSA key might include both `SIGN` and `AGREE_KEY`.\n - The `Tag::BLOCK_MODE` for an AES key might include ECB, CBC, and CTR modes.\n- A `begin()` request then includes a specific parameter value for the operation, for example:\n - `begin()` has an explicit purpose parameter that must match one of the key characteristics' `Tag::PURPOSE` values.\n - `begin()` for an AES operation needs to include a single value for `Tag::BLOCK_MODE` in the `params` field, which must match one of the values in the key characteristics.\n\n\u003cbr /\u003e\n\nThis dual function is particularly relevant for the collection of tags passed\nas `keyParams` on a key generation or import operation.\n\n- Some of the tags act as parameters for the key generation operation itself. For example, the `Tag::CERTIFICATE_SUBJECT` tag affects only the (asymmetric) key generation process, by controlling a field in the returned X.509 certificate.\n- Other tags are bound to the newly generated key as key characteristics, and are encapsulated in the returned keyblob so that they're permanently associated with the key.\n\nDetailed information about tag values can be found in the following\nHAL interface specifications:\n\n- KeyMint --- All tags are defined in [`Tag.aidl`](https://cs.android.com/android/platform/superproject/+/android-latest-release:hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/Tag.aidl) on the relevant Android release branch.\n- Keymaster --- Tags are defined in `platform/hardware/interfaces/keymaster/`\u003cvar translate=\"no\"\u003ekeymaster-version\u003c/var\u003e`/types.hal` for each respective `keymaster-version`, such as [`3.0/types.hal`](https://cs.android.com/android/platform/superproject/+/android-latest-release:hardware/interfaces/keymaster/3.0/types.hal) for Keymaster 3 and [`4.0/types.hal`](https://cs.android.com/android/platform/superproject/+/android-latest-release:hardware/interfaces/keymaster/4.0/types.hal) for Keymaster 4. For Keymaster 2 and below, tags are defined in [`platform/hardware/libhardware/include/hardware/keymaster_defs.h`](https://cs.android.com/android/platform/superproject/+/android-latest-release:hardware/libhardware/include_all/hardware/keymaster_defs.h)."]]
