supreme-verifier/at.asitplus.attestation.supreme/SupremeConfiguration

SupremeConfiguration

@Serializable

data class SupremeConfiguration : AttestationConfiguration(source)

Integrated attestation configuration for the Supreme attestation verifier

This configuration deals with two aspects of integrated attestation:

Configuring attestation policies for Android and iOS.
Defining object identifiers, key constraints, proof authentication, and requested client attributes for fully integrated attestation.

To add custom Android revocation checkers, see AndroidRevocationList.loaderRegistry. To add custom time sources / clocks, see SupremeConfiguration.Clock.registry

Constructors

SupremeConfiguration

constructor(android: AndroidAttestationConfiguration, ios: IosAttestationConfiguration, clock: SupremeConfiguration.Clock = SupremeConfiguration.Clock.System, verificationTimeOffset: Duration = Makoto.DEFAULT_TIME_OFFSET, attestationProofOID: ObjectIdentifier = WardenDefaults.OIDs.ATTESTATION_PROOF, genericDeviceNameOID: ObjectIdentifier? = WardenDefaults.OIDs.DEVICE_NAME, defaultKeyConstraints: KeyConstraints? = WardenDefaults.KeyConstraints.p256Signer, dataAuth: DataAuthentication = DataAuthentication.Signature, toBeAttestedAttributes: AttestationChallenge.CertificationRequestAttributeAttestationDescriptor? = null, maxAttestationPayloadBytes: Int = WardenDefaults.DEFAULT_MAX_ATTESTATION_PAYLOAD_BYTES)

constructor(ios: IosAttestationConfiguration, clock: SupremeConfiguration.Clock = SupremeConfiguration.Clock.System, verificationTimeOffset: Duration = Makoto.DEFAULT_TIME_OFFSET, attestationProofOID: ObjectIdentifier = WardenDefaults.OIDs.ATTESTATION_PROOF, genericDeviceNameOID: ObjectIdentifier? = WardenDefaults.OIDs.DEVICE_NAME, defaultKeyConstraints: KeyConstraints? = WardenDefaults.KeyConstraints.p256Signer, dataAuth: DataAuthentication = DataAuthentication.Signature, toBeAttestedAttributes: AttestationChallenge.CertificationRequestAttributeAttestationDescriptor? = null, maxAttestationPayloadBytes: Int = WardenDefaults.DEFAULT_MAX_ATTESTATION_PAYLOAD_BYTES)

iOS-Only configuration

constructor(android: AndroidAttestationConfiguration, clock: SupremeConfiguration.Clock = SupremeConfiguration.Clock.System, verificationTimeOffset: Duration = Makoto.DEFAULT_TIME_OFFSET, attestationProofOID: ObjectIdentifier = WardenDefaults.OIDs.ATTESTATION_PROOF, genericDeviceNameOID: ObjectIdentifier? = WardenDefaults.OIDs.DEVICE_NAME, defaultKeyConstraints: KeyConstraints? = WardenDefaults.KeyConstraints.p256Signer, dataAuth: DataAuthentication = DataAuthentication.Signature, toBeAttestedAttributes: AttestationChallenge.CertificationRequestAttributeAttestationDescriptor? = null, maxAttestationPayloadBytes: Int = WardenDefaults.DEFAULT_MAX_ATTESTATION_PAYLOAD_BYTES)

Android-Only configuration

Types

Clock

@Serializable(with = SupremeConfiguration.Clock.Serializer::class)

interface Clock

Configures the time source of a SupremeConfiguration

Companion

object Companion : AttestationConfiguration.Reader<SupremeConfiguration>

Properties

android

val android: AndroidAttestationConfiguration?

Android-specific attestation configuration. For full details, see AndroidAttestationConfiguration

attestationProofOID

@Serializable(with = ObjectIdentifierStringSerializer::class)

val attestationProofOID: ObjectIdentifier

Object identifier for the attestation proof.

clock

val clock: SupremeConfiguration.Clock

dataAuthentication

val dataAuthentication: DataAuthentication

Default authentication mode placed in issued challenges. Signature mode proves private-key possession; hash mode binds the TBS CSR contents through the platform attestation nonce without signing it.

defaultKeyConstraints

val defaultKeyConstraints: KeyConstraints?

Configuration for default key constraints, such as supported cryptographic operations.

genericDeviceNameOID

@Serializable(with = ObjectIdentifierStringSerializer::class)

val genericDeviceNameOID: ObjectIdentifier?

Optional object identifier for the generic device name.

ios

val ios: IosAttestationConfiguration?

iOS-specific attestation configuration. For full details, see IosAttestationConfiguration

maxAttestationPayloadBytes

val maxAttestationPayloadBytes: Int

Maximum HTTP payload size, in bytes, accepted for an attestation proof. Warden Supreme uses the same limit at the HTTP boundary for issued challenges and attestation responses. The default accommodates normal CSRs and certificate chains.

toBeAttestedAttributes

@Serializable(with = ConfigurationAttestableAttributesSerializer::class)

val toBeAttestedAttributes: AttestationChallenge.CertificationRequestAttributeAttestationDescriptor?

Optional ordered client-provided values to request and bind into every issued challenge.

verificationTimeOffset

val verificationTimeOffset: Duration

The time offset used during attestation verification.