supreme-common/at.asitplus.attestation.supreme

Package-level declarations

Types

@Serializable

Represents a challenge for an attestation ceremony, including freshness, key-generation hints, the required DataAuthentication mode, and optional client-provided values that must be bound to the attestation.

AttestationHashInput

data class AttestationHashInput : Asn1Encodable<Asn1Sequence>

Canonical DER structure authenticated by DataAuthentication.Hash.

AttestationProof

sealed interface AttestationProof

An authenticated client-to-verifier transport carrying the platform-generated attestation statement.

AttestationResponse

@Serializable

sealed class AttestationResponse

AttestedAttributes

class AttestedAttributes(val otherAttributesEncoded: Asn1Sequence?)

Additional client-provided values decoded from the sequence stored in a dedicated TBS CSR attribute.

BitLengthSerializer

object BitLengthSerializer : KSerializer<BitLength>

Constrained

typealias Constrained = Any?

Constrained value type for AttestationChallenge.additionalPayload.

ConstrainedMapSerializer

object ConstrainedMapSerializer : KSerializer<Map<String, Constrained>>

Format-agnostic serializer for Map<String, Constrained>.

DataAuthentication

@Serializable(with = DataAuthentication.Serializer::class)

sealed interface DataAuthentication

Selects how the client authenticates the data surrounding an attestation proof.

DigestSerializer

object DigestSerializer : KSerializer<Digest>

DurationWholeSecondsSerializer

object DurationWholeSecondsSerializer : KSerializer<Duration>

ECCurveSerializer

object ECCurveSerializer : KSerializer<ECCurve>

InstantLongSerializer

class InstantLongSerializer : KSerializer<Instant>

KeyConstraints

@Serializable

data class KeyConstraints(val algorithmParameters: KeyConstraints.AlgorithmParameters, val keyProtection: KeyConstraints.KeyProtection? = null)

Constraints on the key to be created on the client. If properly set, allows for ridiculously hands-free key and attestation statement creation

Primitive

typealias Primitive = Any?

Primitive value type used for client-provided attested attributes.

PrimitiveType

@Serializable(with = PrimitiveType.ByteSerializer::class)

enum PrimitiveType : Enum<PrimitiveType>

Type discriminator and ASN.1 codec for Primitive values.

SortedSet

class SortedSet<E>(values: Collection<E>, comparator: Comparator<E>, hash: (E) -> Int = { it.hashCode() }) : Set<E>

A KMP-compatible immutable set backed by sorted values, never by attacker-controlled hashes.

WardenDefaults

object WardenDefaults

Properties

MAX_JSON_NESTING_DEPTH

const val MAX_JSON_NESTING_DEPTH: Int = 64

Max JSON container-nesting depth accepted before parsing.

nonce

val TbsCertificationRequest.nonce: KmmResult<ByteArray>

Tries to extract the nonce from a TBS CSR's subject name, given it is encoded into an RDN containing a KnownOIDs.serialNumber

tbsCsr

val AttestationProof.tbsCsr: TbsCertificationRequest

Returns the unsigned certification-request information carried by either transport shape.

Functions

attestationStatementForChallenge

fun TbsCertificationRequest.attestationStatementForChallenge(challenge: AttestationChallenge): KmmResult<Attestation>

Tries to extract an attestation statement from a TBS CSR based on the proofOID specified in challenge

attestationStatementForOid

fun TbsCertificationRequest.attestationStatementForOid(oid: ObjectIdentifier): KmmResult<Attestation>

Tries to extract an attestation statement from a TBS CSR, given it is present as an attribute with oid

closestToRoot

fun List<X509Certificate>.closestToRoot(predicate: (X509Certificate) -> Boolean): X509Certificate

Returns the certificate matching the predicate that is closest to the root. Can be the root itself.

closestToRootOrNull

fun List<X509Certificate>.closestToRootOrNull(predicate: (X509Certificate) -> Boolean): X509Certificate?

Returns the certificate matching the predicate that is closes to the root. Can be the root itself.

deviceNameForChallenge

fun Pkcs10CertificationRequest.deviceNameForChallenge(challenge: AttestationChallenge): String?

fun TbsCertificationRequest.deviceNameForChallenge(challenge: AttestationChallenge): String?

Tries to extract a device name from a TBS CSR if genericDeviceNameOID is specified in challenge

deviceNameForOid

fun Pkcs10CertificationRequest.deviceNameForOid(oid: ObjectIdentifier): String?

fun TbsCertificationRequest.deviceNameForOid(oid: ObjectIdentifier): String?

Tries to extract a device name from a TBS CSR, given it is present as an attribute with oid

parsedAttributesBy

fun AttestedAttributes.parsedAttributesBy(challenge: AttestationChallenge): List<Primitive>?

Decodes these values using the ordered attribute description carried by challenge.

requireBoundedArrayNesting

fun requireBoundedArrayNesting(json: String)

Scans json for excessive object or array nesting without parsing it. Brackets inside string literals (keys/values) are ignored. Throws SerializationException if depth exceeds MAX_JSON_NESTING_DEPTH. Cheap, single linear pass, no allocation.

toHashInput

fun TbsCertificationRequest.toHashInput(proofOid: ObjectIdentifier): AttestationHashInput

Removes the public key and exactly one attestation-proof attribute identified by proofOid, producing the canonical input used by DataAuthentication.Hash.

toSequence

fun List<Primitive>.toSequence(): Asn1Sequence

Encodes only the additional attribute values, tagged by position, for storage in the TBS CSR.

withAndroidAttestationExtensions

fun CertificateChain.withAndroidAttestationExtensions(): List<X509Certificate>

Returns a list of certificates that contain an attestation extension; in-order.