# Remote Provisioning Changelog

This document provides an exact description of which changes have occurred in the
`IRemotelyProvisionedComponent` HAL interface in each Android release.

## Releases
* **Android S (12):** IRemotelyProvisionedComponent v1
* **Android T (13):** IRemotelyProvisionedComponent v2
* **Android U (14):** IRemotelyProvisionedComponent v3

## IRemotelyProvisionedComponent 1 -> 2
* DeviceInfo
  * Most entries are no longer optional.
  * `att_id_state` is now `fused`. `fused` is used to indicate if SecureBoot is enabled.
  * `version` is now `2`.
  * `board` has been removed.
  * `device` has been added.
* RpcHardwareInfo
  * `uniqueId` String added as a field in order to differentiate IRPC instances on device.

## IRemotelyProvisionedComponent 2 -> 3
* The RKP HAL now builds separately from KeyMint.
  * The HAL remains under the `android.hardware.security.keymint` package for
    compatibility with previous releases. ABI compatibility requires this.
  * Dependencies on the RKP HAL must add a dependency on
    `"android.hardware.security.rkp"` generated code (instead of
    `"android.hardward.security.keymint"`).
* ProtectedData has been removed.
* DeviceInfo
  * `version` has moved to a top-level field within the CSR generated by the HAL.
* IRemotelyProvisionedComponent
  * The need for an EEK has been removed. There is no longer an encrypted portion of the CSR.
  * Keys for new CSR format must be generated with test mode set to false, effectively removing test
    mode in the new CSR flow.
  * The schema for the CSR itself has been significantly simplified, please see
    IRemotelyProvisionedComponent.aidl for more details. Notably,
    * the chain of signing, MACing, and encryption operations has been replaced with a single
      COSE_Sign1 object.
    * CertificateType has been added to identify the type of certificate being requested.
    * The structure has been composed to enable a clear split between what is required to validate a
      payload and the implementation-defined payload itself. This is done by creating a typed
      `AuthenticatedRequest<T>` object representing the top level data required to authenticate
      the data provided in the payload, `T`.
  * The new CSR format supports P-384 signing keys and SHA-384 hashes in the DICE chain.
  * The component version can now be either an int or a string.
* RpcHardwareInfo
  * `supportedNumKeysInCsr` added to report the maximum number of keys supported in a CSR.
  * `supportedEekCurve` is no longer used, due to the removal of the EEK from the scheme.