security/hakurei.app
security/hakurei.app
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 4 Wiki Activity

add link to key attestation library

Browse Source
This commit is contained in:
Daniel Micay 2023-12-22 10:10:13 -05:00
parent b96df9c32f
commit 4eb320eca9
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
static/articles/attestation-compatibility-guide.html
View File

@ -57,14 +57,15 @@
with hardware attestation and fall back to the Play Integrity API or do both and
accept either passing as success.</p>
<p>Our <a href="https://github.com/GrapheneOS/Auditor">MIT / Apache 2 licensed Auditor
app</a> can be used a reference implementation for verifying hardware-based
attestations. There are some subtleties in the verification process such as making
sure only the 2nd certificate in the chain (the one signing the certificate for the
key generated by your app) has an attestation extension to prevent making a fake
attestation by extending the chain. You can reuse our code and simply omit support for
an app generated attestation signing key (attest key) and the other pinning
support.</p>
<p>Google provides a <a href="https://github.com/google/android-key-attestation">key
attestation library</a> with examples. Our <a href="https://github.com/GrapheneOS/Auditor">MIT
/ Apache 2 licensed Auditor app</a> can be used a reference implementation for
verifying hardware-based attestations. There are some subtleties in the verification
process such as making sure only the 2nd certificate in the chain (the one signing the
certificate for the key generated by your app) has an attestation extension to prevent
making a fake attestation by extending the chain. You can reuse our code and simply
omit support for an app generated attestation signing key (attest key) and the other
pinning support.</p>
<p>After verifying the signature of the attestation certificate chain and extracting
the attestation metadata, you can enforce that <code>verifiedBootState</code> is