diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2023-12-22 10:10:13 -0500 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2023-12-22 10:10:13 -0500 |
| commit | 4eb320eca953f14a266c2cd67e6175190a077353 (patch) | |
| tree | 998907a4658aa97b9492c7ba07357274ffba3a03 | |
| parent | b96df9c32fd3cb0351d80c53d2489e171db444ce (diff) | |
add link to key attestation library
| -rw-r--r-- | static/articles/attestation-compatibility-guide.html | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/static/articles/attestation-compatibility-guide.html b/static/articles/attestation-compatibility-guide.html index db62d330..fe5f89fa 100644 --- a/static/articles/attestation-compatibility-guide.html +++ b/static/articles/attestation-compatibility-guide.html @@ -57,14 +57,15 @@ with hardware attestation and fall back to the Play Integrity API or do both and accept either passing as success.</p> - <p>Our <a href="https://github.com/GrapheneOS/Auditor">MIT / Apache 2 licensed Auditor - app</a> can be used a reference implementation for verifying hardware-based - attestations. There are some subtleties in the verification process such as making - sure only the 2nd certificate in the chain (the one signing the certificate for the - key generated by your app) has an attestation extension to prevent making a fake - attestation by extending the chain. You can reuse our code and simply omit support for - an app generated attestation signing key (attest key) and the other pinning - support.</p> + <p>Google provides a <a href="https://github.com/google/android-key-attestation">key + attestation library</a> with examples. Our <a href="https://github.com/GrapheneOS/Auditor">MIT + / Apache 2 licensed Auditor app</a> can be used a reference implementation for + verifying hardware-based attestations. There are some subtleties in the verification + process such as making sure only the 2nd certificate in the chain (the one signing the + certificate for the key generated by your app) has an attestation extension to prevent + making a fake attestation by extending the chain. You can reuse our code and simply + omit support for an app generated attestation signing key (attest key) and the other + pinning support.</p> <p>After verifying the signature of the attestation certificate chain and extracting the attestation metadata, you can enforce that <code>verifiedBootState</code> is |