roboto/at.asitplus.attestation.android/AndroidAttestationConfiguration/AndroidAttestationConfiguration

AndroidAttestationConfiguration

constructor(applications: List<AndroidAttestationConfiguration.AppData>, androidVersion: Int? = null, patchLevel: PatchLevel? = null, requireStrongBox: Boolean = false, allowBootloaderUnlock: Boolean = false, requireRollbackResistance: Boolean = false, ignoreLeafValidity: Boolean = true, verificationSecondsOffset: Long = 0, attestationStatementValiditySeconds: Long? = null, hardwareTrustedRoots: Set<TrustedRoot> = GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS, softwareTrustedRoots: Set<TrustedRoot> = GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12, disableHardwareAttestation: Boolean = false, enableSoftwareAttestation: Boolean = false, requireRemoteKeyProvisioning: Boolean = false, revocation: List<AndroidRevocationList.Loader.Configuration<*>> = listOf(AndroidRevocationList.GoogleDefaultLoaderConfig))(source)

Parameters

applications

list of applications to be attested

androidVersion

optional parameter. If set, attestation enforces Android version to be greater or equal to this parameter. Caution: Major Android versions increment in steps of ten-thousands. I.e. Android 11 is specified as 110000 Can be overridden for individual apps

patchLevel

optional parameter. If set, attestation enforces Security patch level to be greater or equal to this parameter

requireStrongBox

optional parameter. Set to true if StrongBox security level should be required

allowBootloaderUnlock

optional parameter. Set to true if unlocked bootloaders should be allowed. Attention: Allowing unlocked bootloaders in production effectively defeats the purpose of app attestation. (but retains the ability to attest whether a key is securely stored in hardware) Useful for debugging/testing

requireRollbackResistance

optional parameter. Unsupported by most devices. See Official Documentation

ignoreLeafValidity

optional parameter. Whether to ignore the timely validity of the leaf certificate (looking at you, Samsung!)

hardwareTrustedRoots

Manually specify the trust anchor for HW-attested certificate chains. Defaults to google HW attestation key. Overriding this set is useful for automated end-to-end tests, for example. The default trust anchors are accessible through GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS

softwareTrustedRoots

Manually specify the trust anchor for SW-attested certificate chains. Defaults to google SW attestation keys. Overriding this set is useful for automated end-to-end tests, for example. The default trust anchors are accessible through GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12

disableHardwareAttestation

Entirely disable creation of a HardwareAttestationVerifier. Only change this flag, if you really know what you are doing!

enableSoftwareAttestation

Enables software attestation. A SoftwareAttestationVerifier can only be instantiated if this flag is set to true. Only change this flag, if you really know what you are doing! Enabling this flag, while keeping disableHardwareAttestation true makes is possible to instantiate both a HardwareAttestationVerifier and a SoftwareAttestationVerifier.

constructor(singleApp: AndroidAttestationConfiguration.AppData, androidVersion: Int? = null, patchLevel: PatchLevel? = null, requireStrongBox: Boolean = false, allowBootloaderUnlock: Boolean = false, requireRollbackResistance: Boolean = false, ignoreLeafValidity: Boolean = true, verificationSecondsOffset: Long = 0, attestationStatementValiditySeconds: Long? = null, hardwareTrustedRoots: Set<TrustedRoot> = GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS, softwareTrustedRoots: Set<TrustedRoot> = GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12, disableHardwareAttestation: Boolean = false, enableSoftwareAttestation: Boolean = false, revocation: List<AndroidRevocationList.Loader.Configuration<*>> = listOf(AndroidRevocationList.GoogleDefaultLoaderConfig), requireRemoteKeyProvisioning: Boolean = false)(source)

Convenience constructor to attest a single app

constructor(version: Int? = null, patchLevel: PatchLevel? = null, requireStrongBox: Boolean = false, allowBootloaderUnlock: Boolean = false, requireRollbackResistance: Boolean = false, ignoreLeafValidity: Boolean = true, verificationSecondsOffset: Long = 0, attestationStatementValiditySeconds: Long? = null, disableHardwareAttestation: Boolean = false, enableSoftwareAttestation: Boolean = false, hardwareTrustedRoots: Set<ByteArray> = GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS.map { it.derEncoded }.toSet(), softwareTrustedRoots: Set<ByteArray> = GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12.map { it.derEncoded }.toSet(), apps: List<AndroidAttestationConfiguration.AppData>, revocation: List<AndroidRevocationList.Loader.Configuration<*>> = listOf(AndroidRevocationList.GoogleDefaultLoaderConfig), requireRemoteKeyProvisioning: Boolean = false)(source)

Constructor used when loading this class from a config file through Hoplite