performAttestationFlow

Certificate extensions to be requested. May be ignored by the issuer.

Additional CSR attributes to pack into this CSR.

Supplies values requested by AttestationChallenge.toBeAttestedAttributes, in exactly the same order. It is invoked once when values are requested and not invoked otherwise. Optional values may be null; required values may not.

Various errors can occur irrespective of attestation: IO, accessing the platform crypto, not authenticating, etc…

This is literally a shorthand for:

val challenge = getChallenge(fetchChallengeEndpoint).getOrThrow()
val proof = challenge.createAttestationProof(alias) { requested -> provideValues(requested) }.getOrThrow()
return attest(proof, challenge.attestationEndpointUrl)

The challenge selects signed or hash-based authentication. authPromptMessage and authPromptCancelText apply when private-key use requires authentication; hash-based authentication does not sign the TBS CSR.

Requires the verifier to pack KeyConstraints into the conveyed challenge.

Usually, you'll want to use pass AlternativeNames into additionalCsrExtensions, not a subject name! By default, the RDN used for the TBS CSR contains KnownOIDs.serialNumber with the challenge nonce. Hence, the values passed to this parameter containing a KnownOIDs.serialNumber will be overwritten.