generator/at.asitplus.attestation.generator

Package-level declarations

Types

The runtime counterpart of IssuerSpec: a root, an attestation CA chain, and the keys to sign with.

@Serializable

data class AttestationSpec(val keyDescription: @Serializable(with = KeyDescriptionAsSchema::class) AttestationKeyDescription = DefaultKeyDescription, val createdAt: @Serializable(with = InstantAsIso8601::class) Instant = Clock.System.now(), val leafCanSignCertificates: Boolean = false)

One attestation to issue: the KeyMint statement itself, plus when the certificates start being valid.

AttestationSpecBuilder

class AttestationSpecBuilder

Builder for one KeyMint statement, i.e. one AttestationKeyDescription plus its issuance date.

CertifiedKey

class CertifiedKey(val certificate: X509Certificate, val signer: Signer)

A private key together with the certificate that binds it: the unit an issuer actually signs with.

GeneratorConfig

@Serializable

data class GeneratorConfig(val issuer: IssuerSpec = IssuerSpec(), val attestations: List<AttestationSpec> = listOf(AttestationSpec()), val outputDirectory: String = "generator-output")

Everything needed to reproduce a set of fake Android key attestations, and the only model in this module. It is serializable as-is, the DSL builds it directly, and AndroidAttestationIssuer consumes it — there is no second representation to keep in sync.

GeneratorDsl

@DslMarker

annotation class GeneratorDsl

The builders below produce nothing but GeneratorConfig parts and hand them straight to AndroidAttestationIssuer. They add defaults and ergonomics — never fields, meaning, or a model of their own. Authorization lists are not built here at all: the parser's own AuthorizationList constructor is already a complete, type-safe, named-argument builder for the whole schema, and AuthorizationList.mangle(…) covers the negative-test cases.

IssuedAttestation

data class IssuedAttestation(val certificateChain: List<X509Certificate>, val leafSigner: Signer)

One issued attestation: the chain a client would present, and the attested leaf key.

IssuerSpec

@Serializable

data class IssuerSpec(val provisioning: Provisioning = Provisioning.FACTORY, val securityLevel: @Serializable(with = SecurityLevelAsName::class) AttestationKeyDescription.SecurityLevel = SecurityLevel.TRUSTED_ENVIRONMENT, val root: RootSpec? = null, val issuedAt: @Serializable(with = InstantAsIso8601::class) Instant = Clock.System.now(), val validity: @Serializable(with = DurationAsIso8601::class) Duration = 365.days)

The issuing hierarchy: which chain shape to build, from which root, valid from when.

IssuerSpecBuilder

class IssuerSpecBuilder

Provisioning

@Serializable

enum Provisioning : Enum<Provisioning>

How the chain between root and attestation key is shaped, i.e. what KeyAttestationCertPath.provisioningMethod() will make of it.

Role

sealed interface Role

What a certificate is for, and therefore which RFC 5280 extensions it carries.

RootSpec

@Serializable

data class RootSpec(val certificatePem: String, val privateKeyPkcs8Pem: String)

Root CA material to reuse across runs. Both PEMs must belong together.

Validity

typealias Validity = Pair<Asn1Time, Asn1Time>

Certificate validity: not-before and not-after.

Properties

DefaultKeyDescription

val DefaultKeyDescription: AttestationKeyDescription

The statement you get when nothing is specified: an empty KeyMint 4.0 statement in a TEE.

KEYMINT_4_0

const val KEYMINT_4_0: Int = 400

Attestation/KeyMint version of KeyMint 4.0, i.e. the current schema revision.

Functions

androidAttestationIssuer

fun androidAttestationIssuer(block: IssuerSpecBuilder.() -> Unit = {}): AndroidAttestationIssuer

Builds an issuer, generating a fresh EC P-256 root and a factory-provisioned TEE CA by default.

attestationSpec

fun attestationSpec(block: AttestationSpecBuilder.() -> Unit = {}): AttestationSpec

issuerSpec

fun issuerSpec(block: IssuerSpecBuilder.() -> Unit = {}): IssuerSpec

main

fun main(args: Array<String>)

CLI: generator <config.json>.

mangle

fun AuthorizationList.mangle(property: AuthorizationList.Tagged, rawExplicitProperty: Asn1Element): AuthorizationList

Returns a copy in which every occurrence of property is replaced by rawExplicitProperty.

fun AuthorizationList.mangle(property: AuthorizationList.Tagged, rawExplicitPropertyDerHex: String): AuthorizationList

Convenience overload for hexadecimal DER containing the complete explicitly-tagged property.

fun AuthorizationList.mangle(propertyTag: ULong, rawExplicitProperty: Asn1Element): AuthorizationList

Raw-tag variant for data-driven test vector tooling.

fun AuthorizationList.mangle(propertyTag: ULong, rawExplicitPropertyDerHex: String): AuthorizationList

Hex-DER convenience overload for data-driven test vector tooling.