AttestationVerifier

Verifies attestation statements and issues certificates on success. Expects a preconfigured Makoto instance defining which apps and devices are considered trustworthy.

attestationProofOID identifies the TBS CSR attribute carrying the attestation statement. It defaults to WardenDefaults.OIDs.ATTESTATION_PROOF. dataAuth selects the default authentication mode for issued challenges: signed PKCS#10 with proof of possession, or hash-bound unsigned TBS CSR without proof of possession. toBeAttestedAttributes optionally requests ordered client-provided values which are encoded into the TBS CSR and authenticated by the selected mode. When defaultKeyConstraints is specified, all issued challenges will automatically convey this, unless overridden. Note that key constraints cannot be reliably enforced due to technical client limitations. Not all platforms can restrict key usage and properties! Still, Warden Supreme's client will respect the key constraints and create keys as specified.

genericDeviceNameOID indicates whether to include a generic make and model (such as "Google Pixel 8", or "iPhone 16") with the attestation proof. On its own, this is not the device's nickname and therefore cannot identify a person in its own. Defaults to WardenDefaults.OIDs.DEVICE_NAME as it is very useful technical, non-personally-identifying data. Can be set to null to not include device names.

The nonceGenerator's responsibility is to generate nonces to ensure freshness of issues challenges. Defaults to WardenDefaults.nonceGenerator, which generates secure, random 64-byte nonces

nonceValidity indicates how long issued nonces remain valid. This defaults to the maximum of the passed makoto's IosAttestationConfiguration.attestationStatementValiditySeconds and AndroidAttestationConfiguration.attestationStatementValiditySeconds.

maxAttestationPayloadBytes the upper bound of payloads exchanged between client and verifier