supreme-verifier/at.asitplus.attestation.supreme

Package-level declarations

Types

interface AttestationChallengeValidator : ChallengeValidator

Invoked from AttestationVerifier.verifyAttestation. Useful to match against in-transit attestation processes. Most probably, this will check against a nonce cache and evict any matched nonce from the cache. Implementing this function in a meaningful manner is absolutely crucial, since this is the actual challenge matching, ensuring freshness! Challenge nonces are sensitive replay-protection material: implementations and operators should avoid logging them, avoid exposing them across sessions or callers, and rely on protected transport plus caller-aware controls outside the nonce cache when needed.

AttestationVerifier

class AttestationVerifier(val makoto: Makoto, val attestationProofOID: ObjectIdentifier = WardenDefaults.OIDs.ATTESTATION_PROOF, val genericDeviceNameOID: ObjectIdentifier? = WardenDefaults.OIDs.DEVICE_NAME, val defaultKeyConstraints: KeyConstraints? = WardenDefaults.KeyConstraints.p256Signer, val nonceValidity: Duration = makoto.longestValidityDuration ?: IosAttestationConfiguration.DEFAULT_VALIDITY_SECONDS.seconds, val toBeAttestedAttributes: AttestationChallenge.CertificationRequestAttributeAttestationDescriptor? = null, val dataAuth: DataAuthentication = DataAuthentication.Signature, val maxAttestationPayloadBytes: Int = WardenDefaults.DEFAULT_MAX_ATTESTATION_PAYLOAD_BYTES, nonceGenerator: NonceGenerator = WardenDefaults.nonceGenerator, challengeValidator: ChallengeValidator = InMemoryChallengeCache( makoto.clock, -makoto.verificationTimeOffset ))

Verifies attestation statements and issues certificates on success. Expects a preconfigured Makoto instance defining which apps and devices are considered trustworthy.

CertificateIssuer

typealias ~~CertificateIssuer~~ = suspend AttestationResult.Verified.(Pkcs10CertificationRequest) -> CertificateChain

Compatibility issuer for the signature-only API. Receives the signed CSR after it was thoroughly checked and verified. At this point, the CSR's signature has been verified, the challenge checked, and the public key attested. Hence, a certificate can be issued and the whole certificate chain (from newly issued certificate up to the CA) shall be returned.

ChallengeValidationResult

sealed class ChallengeValidationResult

Result of matching and consuming the challenge referenced by received client data.

ChallengeValidator

interface ~~ChallengeValidator~~

Invoked from AttestationVerifier.verifyAttestation. Required to match against in-transit attestation processes.

InMemoryChallengeCache

class InMemoryChallengeCache(clock: Clock, offset: Duration, val maxChallenges: Int = DEFAULT_MAX_IN_MEMORY_CHALLENGES) : AttestationChallengeValidator

Caches issued challenges in memory in a coroutine-safe way. Requires a clock and an offset. The AttestationVerifier passes Makoto's clock and the inverse of Makoto.verificationTimeOffset, since these two values are also encoded into issues challenges.

NonceGenerator

typealias NonceGenerator = suspend () -> ByteArray

Generates a fresh challenge nonce.

PreAttestationError

sealed class PreAttestationError

High-level verifier errors exposed to AttestationVerifier.verifyAttestation's onPreAttestationError callback.

ProofToChain

typealias ProofToChain = suspend AttestationResult.Verified.(AttestationProof) -> CertificateChain

Receives the signed CSR or unsigned TBS CSR from the mobile client after it was thoroughly checked and verified. At this point, the selected authentication mode has been verified, the challenge checked, requested attributes validated, and the public key matched to the attestation statement. Hence, a certificate can be issued and the whole certificate chain (from newly issued certificate up to the CA) shall be returned.

SupremeConfiguration

@Serializable

data class SupremeConfiguration : AttestationConfiguration

Integrated attestation configuration for the Supreme attestation verifier

Functions

decodeAttestationProof

fun AttestationVerifier.decodeAttestationProof(payload: ByteArray): KmmResult<AttestationProof>

Decodes an HTTP attestation-proof payload after enforcing AttestationVerifier.maxAttestationPayloadBytes.

invoke

operator fun Makoto.Companion.invoke(configuration: SupremeConfiguration): Makoto

Convenience extension to create a Makoto instance from configuration