roboto/at.asitplus.attestation.android

Package-level declarations

Types

@Serializable

data class AndroidAttestationConfiguration @JvmOverloads constructor(val applications: List<AndroidAttestationConfiguration.AppData>, val androidVersion: Int? = null, val patchLevel: PatchLevel? = null, val requireStrongBox: Boolean = false, val allowBootloaderUnlock: Boolean = false, val requireRollbackResistance: Boolean = false, val ignoreLeafValidity: Boolean = true, val verificationSecondsOffset: Long = 0, val attestationStatementValiditySeconds: Long? = null, val hardwareTrustedRoots: Set<TrustedRoot> = GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS, val softwareTrustedRoots: Set<TrustedRoot> = GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12, val disableHardwareAttestation: Boolean = false, val enableSoftwareAttestation: Boolean = false, val requireRemoteKeyProvisioning: Boolean = false, val revocation: List<AndroidRevocationList.Loader.Configuration<*>> = listOf(AndroidRevocationList.GoogleDefaultLoaderConfig)) : AttestationConfiguration

Main Android attestation configuration class serving as ground truth for all key and app attestation verifications.

AndroidDebugAttestationStatement

@Serializable

class AndroidDebugAttestationStatement(val version: String, val kind: AndroidDebugAttestationStatement.Type, val configuration: AndroidAttestationConfiguration, val verificationTime: Date, val challenge: ByteArray, val attestationStatement: List<@Serializable(with = CertPemSerializer::class) X509Certificate>, val revocationLists: List<ConfigWithList>) : DebugStatement<ParsedAttestationRecord>

AndroidRevocationList

@Serializable

data class AndroidRevocationList(val entries: Map<String, AndroidRevocationList.Entry>, val date: Instant? = null, val expires: Instant? = null, val lastModified: Instant? = null)

Represents a revocation list specific to Android attestation as per [the official specification}(https://developer.android.com/privacy-and-security/security-key-attestation#certificate_status), containing information about revoked or suspended certificates, metadata on expiration, and modification timestamps.

CertPemSerializer

object CertPemSerializer : TransformingSerializerTemplate<X509Certificate, String>

ConfigWithList

@Serializable

data class ConfigWithList(val config: AndroidRevocationList.Loader.Configuration<*>, val list: AndroidRevocationList)

DateTimeSerializer

object DateTimeSerializer : KSerializer<Date>

EternalX509Certificate

class EternalX509Certificate(delegate: X509Certificate) : X509Certificate

HardwareAttestationVerifier

class HardwareAttestationVerifier @JvmOverloads constructor(attestationConfiguration: AndroidAttestationConfiguration, verifyChallenge: (expected: ByteArray, actual: ByteArray) -> Boolean = { expected, actual -> expected contentEquals actual }) : Roboto

PatchLevel

@Serializable

data class PatchLevel @JvmOverloads constructor(val year: Int, val month: Int, val maxFuturePatchLevelMonths: Int? = 1)

Represents a Patch level configuration property. Patch levels are defined as year and month.

PubKeyBasePemSerializer

object PubKeyBasePemSerializer : TransformingSerializerTemplate<PublicKey, String>

Roboto

abstract class Roboto(attestationConfiguration: AndroidAttestationConfiguration, verifyChallenge: (expected: ByteArray, actual: ByteArray) -> Boolean)

SoftwareAttestationVerifier

class SoftwareAttestationVerifier @JvmOverloads constructor(attestationConfiguration: AndroidAttestationConfiguration, verifyChallenge: (expected: ByteArray, actual: ByteArray) -> Boolean = { expected, actual -> expected contentEquals actual }) : Roboto

TrustedRoot

@Serializable(with = TrustedRootSerializer::class)

sealed interface TrustedRoot

Represents a trusted root entity, which can either be a public key or an X.509 certificate.

TrustedRootSerializer

object TrustedRootSerializer : KSerializer<TrustedRoot>

Properties

DEFAULT_HARDWARE_TRUST_ANCHORS

val ~~DEFAULT_HARDWARE_TRUST_ANCHORS~~: Array<PublicKey?>

Default public keys used as trust anchors used to verify hardware attestation

GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS

val GOOGLE_DEFAULT_HARDWARE_TRUST_ANCHORS: Set<TrustedRoot>

Default trust anchors used to verify hardware attestation

GOOGLE_RKP_EC_ROOT

val GOOGLE_RKP_EC_ROOT: TrustedRoot.Certificate

GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12

val GOOGLE_SOFTWARE_TRUST_ANCHORS_UNTIL_A12: Set<TrustedRoot>

Default trust anchors used to verify software attestation working up to Android 12. Useful for testing. If possible, use older Android images on emulators for testing, EVEN IF THEIR ATTTESTATION ROOT IS EXPIRED, because it has a stable, fixed root cert. Newer Android emulator image keys' are a moving target due to utterly undocumented key rotation

OID_RKP

const val OID_RKP: String

The object identifier containing the remote key provisioning extension.

Functions

contentEqualsIfArray

infix fun Any?.contentEqualsIfArray(other: Any?): Boolean

contentHashCodeIfArray

inline fun Any.contentHashCodeIfArray(): Int

getNumberOfRemotelyProvisionedCertificates

fun List<X509Certificate>.getNumberOfRemotelyProvisionedCertificates(): Int?

TRIES to parse the number of remotely provisioned attestation certificates. Note that this method returning null does not necessarily mean that a remotely provisioned certificate is not present. It could very well be that the extension is present but botched. (Looking at you, Samsung!).

getRkpData

fun List<X509Certificate>.getRkpData(): Map?

Returns the parsed, but generic contents of the Remote Key Provisioning extension, if present in an Android attestation certificate chain. One would assume that we could define a type-safe data structure for that, but Samsung being Samsung has kindly reminded us of the fact that phrases like "conforms schema" are thrown around far too often in specifications.

isRemoteKeyProvisioned

fun List<X509Certificate>.isRemoteKeyProvisioned(): Boolean

Indicates whether the attestation certificate in this certificate chain is remotely provisioned.

parseHex

fun String.parseHex(): ByteArray

Leniently (ignore case, and whitespace) parse hex to bytes