supreme-client/at.asitplus.attestation.supreme

Package-level declarations

Types

class AttestationClient(client: HttpClient, clock: Clock = Clock.System, maxAttestationPayloadBytes: Int = WardenDefaults.DEFAULT_MAX_ATTESTATION_PAYLOAD_BYTES)

Mobile client, fetching attestation challenges and posting signed CSRs or unsigned TBS CSRs containing attestation statements to an attestation verification endpoint.

Properties

attestationEndpointUrl

val AttestationChallenge.attestationEndpointUrl: Url

convenience shorthand to parse the attestation POST endpoint as a URL

Functions

createAttestationProof

suspend fun AttestationChallenge.~~createAttestationProof~~(alias: String, authPromptMessage: String? = null, authPromptCancelText: String? = null, additionalCsrExtensions: List<X509CertificateExtension> = listOf(), additionalCsrAttributes: List<Pkcs10CertificationRequestAttribute> = listOf()): KmmResult<Pkcs10CertificationRequest>

suspend fun AttestationChallenge.createAttestationProof(alias: String, authPromptMessage: String? = null, authPromptCancelText: String? = null, additionalCsrExtensions: List<X509CertificateExtension> = listOf(), additionalCsrAttributes: List<Pkcs10CertificationRequestAttribute> = listOf(), attestAttributes: (List<AttestationChallenge.AttributeAttestationDescriptor>) -> List<Primitive>): KmmResult<AttestationProof>

Creates a signed CSR or unsigned TBS CSR from this challenge, according to AttestationChallenge.dataAuth. Key creation follows AttestationChallenge.keyConstraints. Hence, if no constraints are set, this method will always fail!

createCsr

suspend fun Signer.Attestable<*>.createCsr(challenge: AttestationChallenge, subjectName: List<RelativeDistinguishedName> = listOf(), additionalExtensions: List<X509CertificateExtension> = listOf(), additionalAttributes: List<Pkcs10CertificationRequestAttribute> = listOf()): KmmResult<Pkcs10CertificationRequest>

Creates a signed CSR from an attestable signer. This is the low-level signature-authentication path and always proves possession of the private key; use createAttestationProof to follow a challenge-selected authentication mode. Encodes the challenge's nonce into a KnownOIDs.serialNumber subjectName and the attestation statement into a Pkcs10CertificationRequestAttribute with AttestationChallenge.proofOID. Since this operation prepares and directly signs the CSR, it may require user authentication.

createTbsCsr

fun Signer.Attestable<*>.createTbsCsr(challenge: AttestationChallenge, hashInput: AttestationHashInput): KmmResult<TbsCertificationRequest>

Completes hashInput with this signer's public key and attestation statement. The same conversion is used for signed and hash-authenticated proofs; callers decide separately whether to sign the result.

fun Signer.Attestable<*>.createTbsCsr(challenge: AttestationChallenge, subjectName: List<RelativeDistinguishedName> = listOf(), additionalExtensions: List<X509CertificateExtension> = listOf(), additionalAttributes: List<Pkcs10CertificationRequestAttribute> = listOf()): KmmResult<TbsCertificationRequest>

Creates a TBS CSR containing this signer's public key and attestation statement. This overload derives the subject, extensions, and attributes directly from challenge and the supplied additions.

getDeviceName

actual fun getDeviceName(): String

performAttestationFlow

suspend fun AttestationClient.~~performAttestationFlow~~(alias: String, fetchChallengeEndpoint: Url, authPromptMessage: String? = null, authPromptCancelText: String? = null, additionalCsrExtensions: List<X509CertificateExtension> = listOf(), additionalCsrAttributes: List<Pkcs10CertificationRequestAttribute> = listOf()): AttestationResponse

suspend fun AttestationClient.performAttestationFlow(alias: String, fetchChallengeEndpoint: Url, authPromptMessage: String? = null, authPromptCancelText: String? = null, additionalCsrExtensions: List<X509CertificateExtension> = listOf(), additionalCsrAttributes: List<Pkcs10CertificationRequestAttribute> = listOf(), toBeAttestedAttributes: (List<AttestationChallenge.AttributeAttestationDescriptor>) -> List<Primitive>): AttestationResponse

Truly integrated attestation in a single call.