AttestationVerifier

Verifies attestation statements and issues certificates on success. Expects a preconfigured Makoto instance defining which apps and devices are considered trustworthy.

The attestationProofOID to be used in a CSR to convey an attestation statement. Can be overridden. It defaults to WardenDefaults.OIDs.ATTESTATION_PROOF When defaultKeyConstraints is specified, all issued challenges will automatically convey this, unless overridden. Note that key constraints cannot be reliably enforced due to technical client limitations. Not all platforms can restrict key usage and properties! Still, Warden Supreme's client will respect the key constraints and create keys as specified.

genericDeviceNameOID indicates whether to include a generic make and model (such as "Google Pixel 8", or "iPhone 16") with the attestation proof. On its own, this is not the device's nickname and therefore cannot identify a person in its own. Defaults to WardenDefaults.OIDs.DEVICE_NAME as it is very useful technical, non-personally-identifying data. Can be set to null to not include device names.

The nonceGenerator's responsibility is to generate nonces to ensure freshness of issues challenges. Defaults to WardenDefaults.nonceGenerator, which generates secure, random 64-byte nonces

nonceValidity indicates how long issued nonces remain valid. This defaults to the maximum of the passed makoto's IosAttestationConfiguration.attestationStatementValiditySeconds and AndroidAttestationConfiguration.attestationStatementValiditySeconds.