diff options
Diffstat (limited to 'static')
| -rw-r--r-- | static/articles/attestation-compatibility-guide.html | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/static/articles/attestation-compatibility-guide.html b/static/articles/attestation-compatibility-guide.html index db62d330..fe5f89fa 100644 --- a/static/articles/attestation-compatibility-guide.html +++ b/static/articles/attestation-compatibility-guide.html @@ -57,14 +57,15 @@ with hardware attestation and fall back to the Play Integrity API or do both and accept either passing as success.</p> - <p>Our <a href="https://github.com/GrapheneOS/Auditor">MIT / Apache 2 licensed Auditor - app</a> can be used a reference implementation for verifying hardware-based - attestations. There are some subtleties in the verification process such as making - sure only the 2nd certificate in the chain (the one signing the certificate for the - key generated by your app) has an attestation extension to prevent making a fake - attestation by extending the chain. You can reuse our code and simply omit support for - an app generated attestation signing key (attest key) and the other pinning - support.</p> + <p>Google provides a <a href="https://github.com/google/android-key-attestation">key + attestation library</a> with examples. Our <a href="https://github.com/GrapheneOS/Auditor">MIT + / Apache 2 licensed Auditor app</a> can be used a reference implementation for + verifying hardware-based attestations. There are some subtleties in the verification + process such as making sure only the 2nd certificate in the chain (the one signing the + certificate for the key generated by your app) has an attestation extension to prevent + making a fake attestation by extending the chain. You can reuse our code and simply + omit support for an app generated attestation signing key (attest key) and the other + pinning support.</p> <p>After verifying the signature of the attestation certificate chain and extracting the attestation metadata, you can enforce that <code>verifiedBootState</code> is |