Подтверждение ключа и удостоверения личности

Keystore предоставляет более безопасное место для создания, хранения и использования криптографических ключей контролируемым образом. При наличии и использовании аппаратного хранилища ключей, ключевой материал более защищен от извлечения из устройства, а KeyMint (ранее Keymaster) обеспечивает соблюдение ограничений, которые трудно обойти.

Однако это верно только в том случае, если известно, что ключи хранилища ключей хранятся в аппаратном хранилище. В Keymaster 1 у приложений или удаленных серверов не было возможности надежно проверить это. Демон хранилища ключей загружал доступный уровень аппаратной абстракции Keymaster (HAL) и верил всему, что говорил HAL относительно аппаратной поддержки ключей.

Для решения этой проблемы в Android 7.0 (Keymaster 2) была введена аттестация ключей , а в Android 8.0 (Keymaster 3) — аттестация идентификаторов.

Цель аттестации ключей — предоставить надежный способ определить, поддерживается ли асимметричная пара ключей аппаратно, каковы свойства ключа и какие ограничения применяются к его использованию.

Аттестация идентификатора позволяет устройству подтвердить свои аппаратные идентификаторы, такие как серийный номер или IMEI.

Ключевое подтверждение

Для поддержки аттестации ключей в Android 7.0 был введен набор тегов, типов и методов для HAL.

Теги

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

Тип

Keymaster 2 и ниже

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

Метод AttestKey

Ключница 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 и ниже

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev — это структура устройства Keymaster.
  • keyToAttest — это ключевой объект, возвращаемый функцией generateKey , для которого создается аттестация.
  • attestParams — это список всех параметров, необходимых для аттестации. Сюда входят Tag::ATTESTATION_CHALLENGE и, возможно, Tag::RESET_SINCE_ID_ROTATION , а также Tag::APPLICATION_ID и Tag::APPLICATION_DATA . Последние два необходимы для расшифровки ключа, если они были указаны при генерации ключа.
  • Параметром вывода является certChain , возвращающий массив сертификатов. Запись 0 — это сертификат аттестации, то есть он подтверждает ключ из keyToAttest и содержит расширение аттестации.

Метод attestKey считается операцией с открытым ключом над аттестуемым ключом, поскольку его можно вызвать в любое время, и он не требует соблюдения ограничений авторизации. Например, если для использования аттестуемого ключа требуется аутентификация пользователя, аттестация может быть сгенерирована без аутентификации пользователя.

Свидетельство о подтверждении

Сертификат аттестации представляет собой стандартный сертификат X.509 с необязательным расширением аттестации, содержащим описание аттестуемого ключа. Сертификат подписывается сертифицированным ключом аттестации . Ключ аттестации может использовать другой алгоритм, чем аттестуемый ключ.

Сертификат аттестации содержит поля, указанные в таблице ниже, и не может содержать никаких дополнительных полей. Некоторые поля имеют фиксированное значение. Тесты CTS проверяют, что содержимое сертификата точно соответствует заданным параметрам.

Последовательность сертификатов

Название поля (см. RFC 5280 ) Ценить
tbsCertificate ПОСЛЕДОВАТЕЛЬНОСТЬ СЕРТИФИКАТОВ TBSC
signatureAlgorithm AlgorithmIdentifier — идентификатор алгоритма, используемого для подписи ключа:
ECDSA для ключей EC, RSA для ключей RSA.
signatureValue BIT STRING, подпись, вычисленная на основе tbsCertificate, закодированного в формате ASN.1 DER.

ПОСЛЕДОВАТЕЛЬНОСТЬ СЕРТИФИКАТОВ TBSC

Название поля (см. RFC 5280 ) Ценить
version Целое число 2 (означает сертификат версии 3)
serialNumber Целое число 1 (фиксированное значение: одинаковое для всех сертификатов)
signature AlgorithmIdentifier — идентификатор алгоритма, используемого для подписи ключа: ECDSA для ключей EC, RSA для ключей RSA.
issuer Аналогично полю темы ключа пакетной аттестации.
validity Последовательность из двух дат, содержащая значения Tag::ACTIVE_DATETIME и Tag::USAGE_EXPIRE_DATETIME . Эти значения указаны в миллисекундах с 1 января 1970 года. См. RFC 5280 для корректного представления дат в сертификатах.
Если Tag::ACTIVE_DATETIME отсутствует, используйте значение параметра Tag::CREATION_DATETIME . Если Tag::USAGE_EXPIRE_DATETIME отсутствует, используйте дату истечения срока действия сертификата ключа пакетной аттестации.
subject CN = "Ключ хранилища ключей Android" (фиксированное значение: одинаковое для всех сертификатов)
subjectPublicKeyInfo SubjectPublicKeyInfo содержит подтвержденный открытый ключ.
extensions/Key Usage digitalSignature: устанавливается, если ключ имеет назначение KeyPurpose::SIGN или KeyPurpose::VERIFY . Все остальные биты не устанавливаются.
extensions/CRL Distribution Points Стоимость будет определена позже.
extensions/"attestation" Идентификатор OID — 1.3.6.1.4.1.11129.2.1.17; содержимое определено в разделе «Расширение аттестации» ниже. Как и во всех расширениях сертификатов X.509, содержимое представлено в виде OCTET_STRING, содержащего DER-кодировку последовательности аттестации.

Продление срока действия аттестации

Расширение attestation имеет OID 1.3.6.1.4.1.11129.2.1.17 . Оно содержит информацию о аттестуемой паре ключей и состоянии устройства на момент генерации ключа.

Типы тегов Keymaster/KeyMint, определенные в спецификации интерфейса AIDL, преобразуются в типы ASN.1 следующим образом:

Тип KeyMint или Keymaster Тип ASN.1 Примечания
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Миллисекунды с 1 января 1970 г., 00:00:00 GMT.
BOOL NULL Наличие тега означает истинность, отсутствие — ложность.
BIGNUM У тегов нет такого типа, поэтому сопоставление не определено.
BYTES OCTET_STRING

Схема

Содержимое расширения аттестации описывается следующей схемой ASN.1. Схема ASN.1 для AuthorizationList также используется для импорта зашифрованных ключей . Любые поля, которые не будут отображаться в расширении аттестации, отмечены соответствующим образом.

Версия 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 300 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 100 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 4 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 2 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

Версия 1 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Поля KeyDescription

attestationVersion
Версия схемы ASN.1.
Ценить Версия KeyMint или Keymaster
1 Keymaster версия 2.0
2 Keymaster версия 3.0
3 Keymaster версия 4.0
4 Keymaster версия 4.1
100 KeyMint версия 1.0
200 KeyMint версия 2.0
300 KeyMint версия 3.0
400 KeyMint версия 4.0
500 KeyMint версия 5.0
attestationSecurityLevel

Уровень безопасности места хранения заверенного ключа.

keymasterVersion / keyMintVersion
Версия реализации HAL от KeyMint или Keymaster.
Ценить Версия KeyMint или Keymaster
2 Keymaster версия 2.0
3 Keymaster версия 3.0
4 Keymaster версия 4.0
41 Keymaster версия 4.1
100 KeyMint версия 1.0
200 KeyMint версия 2.0
300 KeyMint версия 3.0
400 KeyMint версия 4.0
500 KeyMint версия 5.0
keymasterSecurityLevel / keyMintSecurityLevel
Уровень безопасности реализации KeyMint или Keymaster.
attestationChallenge
Задача, поставленная в ключевой момент формирования поколений.
uniqueId
Конфиденциальный идентификатор устройства, который системные приложения могут запрашивать во время генерации ключа. Если уникальный идентификатор не запрашивается, это поле пустое. Подробнее см. раздел «Уникальный идентификатор» .
softwareEnforced
Список авторизации KeyMint или Keymaster, используемый системой Android. Эта информация собирается или генерируется кодом платформы. Ей можно доверять, если на устройстве установлена ​​операционная система, соответствующая модели безопасности платформы Android (то есть загрузчик устройства заблокирован, а verifiedBootState имеет Verified ).
hardwareEnforced
Список авторизации KeyMint или Keymaster, который обеспечивается средой доверенного выполнения (TEE) устройства или StrongBox . Эта информация собирается или генерируется кодом в защищенном оборудовании и не контролируется платформой. Например, информация может поступать из загрузчика или по защищенному каналу связи, не предполагающему доверия к платформе.

Значения SecurityLevel

Значение SecurityLevel указывает на степень устойчивости элемента, связанного с хранилищем ключей (например, пары ключей и аттестации), к атакам.

Ценить Значение
Software Безопасность обеспечивается до тех пор, пока система Android на устройстве соответствует модели безопасности платформы Android (то есть загрузчик устройства заблокирован, а значение verifiedBootState равно Verified ).
TrustedEnvironment Безопасность обеспечивается до тех пор, пока TEE не скомпрометирован. Требования к изоляции TEE определены в разделах 9.11 [C-1-1] – [C-1-4] документа «Определение совместимости Android». TEE обладают высокой устойчивостью к удаленной компрометации и умеренной устойчивостью к компрометации путем прямой аппаратной атаки.
StrongBox Безопасность обеспечивается до тех пор, пока StrongBox не скомпрометирован. StrongBox реализован в защищенном элементе, аналогичном аппаратному модулю безопасности. Требования к реализации StrongBox определены в разделе 9.11.2 документа «Определение совместимости Android». StrongBox обладает высокой устойчивостью к удаленной компрометации и компрометации путем прямой аппаратной атаки (например, физического вмешательства и атак по побочным каналам).

Поля списка авторизации

Каждое поле соответствует тегу авторизации Keymaster/KeyMint из спецификации интерфейса AIDL . Спецификация является источником достоверной информации о тегах авторизации: их значении, формате содержимого, о том, должны ли они отображаться в полях softwareEnforced или hardwareEnforced в объекте KeyDescription , являются ли они взаимоисключающими с другими тегами и т. д. Все поля AuthorizationList являются необязательными.

Каждое поле имеет контекстно-зависимый тег EXPLICIT , равный номеру тега KeyMint или Keymaster, что позволяет более компактно представить данные в AuthorizationList . Поэтому парсер ASN.1 должен знать ожидаемый тип данных для каждого контекстно-зависимого тега. Например, Tag::USER_AUTH_TYPE определяется как ENUM | 504 В схеме расширения аттестации поле purpose в AuthorizationList указывается как userAuthType [504] EXPLICIT INTEGER OPTIONAL . Таким образом, его кодировка ASN.1 будет содержать контекстно-зависимый тег 504 вместо UNIVERSAL тега класса для типа ASN.1 INTEGER , который равен 10 .

В аттестациях, созданных KeyMint 5, присутствуют следующие поля:
purpose
Соответствует тегу авторизации Tag::PURPOSE , который использует значение идентификатора тега, равное 1.
algorithm

Соответствует тегу авторизации Tag::ALGORITHM , который использует значение идентификатора тега, равное 2.

В объекте AuthorizationList содержащем аттестацию, значение алгоритма всегда равно RSA , EC или ML_DSA .

keySize
Соответствует тегу авторизации Tag::KEY_SIZE , который использует значение идентификатора тега, равное 3.
blockMode
Соответствует тегу авторизации Tag::BLOCK_MODE , который использует значение идентификатора тега, равное 4.
digest
Соответствует тегу авторизации Tag::DIGEST , который использует значение идентификатора тега, равное 5.
padding
Соответствует тегу авторизации Tag::PADDING , который использует значение идентификатора тега 6.
callerNonce
Соответствует тегу авторизации Tag::CALLER_NONCE , который использует значение идентификатора тега 7. Этот тег никогда не присутствует в аттестациях.
minMacLength
Соответствует тегу авторизации Tag::MIN_MAC_LENGTH , который использует значение идентификатора тега, равное 8. Этот тег никогда не присутствует в аттестациях.
ecCurve

Соответствует тегу авторизации Tag::EC_CURVE , который использует значение идентификатора тега 10.

Набор параметров, используемых для генерации пары ключей на основе эллиптических кривых (EC), использующих ECDSA для подписи и проверки, в хранилище ключей системы Android.

mlDsaVariant

Присутствует только в ключевой версии аттестации >= 500.

Соответствует тегу авторизации Tag::ML_DSA_VARIANT , который использует значение идентификатора тега 11.

rsaPublicExponent
Соответствует тегу авторизации Tag::RSA_PUBLIC_EXPONENT , который использует значение идентификатора тега 200.
mgfDigest

Присутствует только в ключевой версии аттестации >= 100.

Соответствует тегу авторизации KeyMint Tag::RSA_OAEP_MGF_DIGEST , который использует значение идентификатора тега 203.
rollbackResistance

Присутствует только в ключевой версии аттестации >= 3.

Соответствует тегу авторизации Tag::ROLLBACK_RESISTANCE , который использует значение идентификатора тега 303.

earlyBootOnly

Присутствует только в ключевой версии аттестации >= 4.

Соответствует тегу авторизации Tag::EARLY_BOOT_ONLY , который использует значение идентификатора тега 305.

activeDateTime
Соответствует тегу авторизации Tag::ACTIVE_DATETIME , который использует значение идентификатора тега 400.
originationExpireDateTime
Соответствует тегу авторизации Tag::ORIGINATION_EXPIRE_DATETIME , который использует значение идентификатора тега 401.
usageExpireDateTime
Соответствует тегу авторизации Tag::USAGE_EXPIRE_DATETIME , который использует значение идентификатора тега 402.
usageCountLimit
Соответствует тегу авторизации Tag::USAGE_COUNT_LIMIT , который использует значение идентификатора тега 405.
userSecureId
Соответствует тегу авторизации Tag::USER_SECURE_ID , который использует значение идентификатора тега 502. Этот тег никогда не присутствует в аттестациях.
noAuthRequired

Соответствует тегу авторизации Tag::NO_AUTH_REQUIRED , который использует значение идентификатора тега 503.

userAuthType
Соответствует тегу авторизации Tag::USER_AUTH_TYPE , который использует значение идентификатора тега 504.
authTimeout
Соответствует тегу авторизации Tag::AUTH_TIMEOUT , который использует значение идентификатора тега 505.
allowWhileOnBody

Соответствует тегу авторизации Tag::ALLOW_WHILE_ON_BODY , который использует значение идентификатора тега 506.

Позволяет использовать ключ после истечения срока действия аутентификации, если пользователь все еще носит устройство на теле. Обратите внимание, что защищенный датчик, надеваемый на тело, определяет, носится ли устройство на теле пользователя.

trustedUserPresenceReq

Присутствует только в ключевой версии аттестации >= 3.

Соответствует тегу авторизации Tag::TRUSTED_USER_PRESENCE_REQUIRED , который использует значение идентификатора тега 507.

Указывается, что этот ключ можно использовать только в том случае, если пользователь предоставил подтверждение своего физического присутствия. В качестве примеров можно привести следующие:

  • В случае ключа от сейфа StrongBox, это аппаратная кнопка, жестко привязанная к контакту на устройстве StrongBox.
  • Для ключа TEE аутентификация по отпечатку пальца обеспечивает подтверждение присутствия при условии, что TEE имеет исключительный контроль над сканером и выполняет процесс сопоставления отпечатков пальцев.
trustedConfirmationReq

Присутствует только в ключевой версии аттестации >= 3.

Соответствует тегу авторизации Tag::TRUSTED_CONFIRMATION_REQUIRED , который использует значение идентификатора тега 508.

Указывает, что ключ можно использовать только в том случае, если пользователь подтвердит данные, подлежащие подписанию, с помощью токена подтверждения. Дополнительную информацию о том, как получить подтверждение пользователя, см. в разделе «Подтверждение защиты Android» .

Примечание: Этот тег применим только к ключам, использующим функцию SIGN .

unlockedDeviceReq

Присутствует только в ключевой версии аттестации >= 3.

Соответствует тегу авторизации Tag::UNLOCKED_DEVICE_REQUIRED , который использует значение идентификатора тега 509.

creationDateTime
Соответствует тегу авторизации Tag::CREATION_DATETIME , который использует значение идентификатора тега 701.
origin

Соответствует тегу авторизации Tag::ORIGIN , который использует значение идентификатора тега 702.

rootOfTrust

Соответствует тегу авторизации Tag::ROOT_OF_TRUST , который использует значение идентификатора тега 704.

Более подробную информацию см. в разделе, описывающем структуру данных RootOfTrust .

osVersion

Соответствует тегу авторизации Tag::OS_VERSION , который использует значение идентификатора тега 705.

Версия операционной системы Android, связанная с устройством Keymaster, указывается в виде шестизначного целого числа. Например, версия 8.1.0 обозначается как 080100.

Только в версиях Keymaster 1.0 и выше это значение присутствует в списке авторизации.

osPatchLevel

Соответствует тегу авторизации Tag::OS_PATCHLEVEL , который использует значение идентификатора тега 706.

Месяц и год, связанные с используемым в KeyMint (ранее Keymaster) патчем безопасности, указываются в виде шестизначного целого числа. Например, патч за август 2018 года обозначается как 201808.

Для проверки того, было ли устройство недавно обновлено, предпочтительнее использовать это поле вместо vendorPatchLevel или bootPatchLevel .

Только в версиях Keymaster 1.0 и выше это значение присутствует в списке авторизации.

attestationApplicationId

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_APPLICATION_ID , который использует значение идентификатора тега 709.

Для получения более подробной информации см. раздел, описывающий структуру данных AttestationApplicationId .

attestationIdBrand

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_BRAND , который использует значение идентификатора тега 710.

attestationIdDevice

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_DEVICE , который использует значение идентификатора тега 711.

attestationIdProduct

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_PRODUCT , который использует значение идентификатора тега 712.

attestationIdSerial

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_SERIAL , который использует значение идентификатора тега 713.

attestationIdImei

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_IMEI , который использует значение идентификатора тега 714.

attestationIdMeid

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_MEID , который использует значение идентификатора тега 715.

attestationIdManufacturer

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_MANUFACTURER , который использует значение идентификатора тега 716.

attestationIdModel

Присутствует только в ключевых версиях аттестации >= 2.

Соответствует тегу авторизации Tag::ATTESTATION_ID_MODEL , который использует значение идентификатора тега 717.

vendorPatchLevel

Присутствует только в ключевых версиях аттестации >= 3.

Соответствует тегу авторизации Tag::VENDOR_PATCHLEVEL , который использует значение идентификатора тега 718.

Указывает уровень исправлений безопасности образа поставщика , который должен быть установлен на устройстве для использования этого ключа. Значение представляет собой целое число, полученное путем удаления дефисов из уровня исправлений безопасности. Например, если ключ был сгенерирован на устройстве Android с установленным исправлением безопасности поставщика от 05.08.2018, это значение будет 20180805.

bootPatchLevel

Присутствует только в ключевых версиях аттестации >= 3.

Соответствует тегу авторизации Tag::BOOT_PATCHLEVEL , который использует значение идентификатора тега 719.

Указывает уровень исправлений безопасности образа ядра , который должен быть установлен на устройстве для использования этого ключа. Значение представляет собой целое число, полученное путем удаления дефисов из уровня исправлений безопасности. Например, если ключ был сгенерирован на устройстве Android с установленным исправлением безопасности ядра от 05.08.2018, это значение будет 20180805.

deviceUniqueAttestation

Присутствует только в ключевых версиях аттестации >= 4.

Соответствует тегу авторизации Tag::DEVICE_UNIQUE_ATTESTATION , который использует значение идентификатора тега 720.

attestationIdSecondImei

Присутствует только в ключевых версиях аттестации >= 300.

Соответствует тегу авторизации Tag::ATTESTATION_ID_SECOND_IMEI , который использует значение идентификатора тега 723.

moduleHash

Присутствует только в ключевых версиях аттестации >= 400.

Соответствует тегу авторизации Tag::MODULE_HASH , который использует значение идентификатора тега 724.

Поля RootOfTrust

verifiedBootKey
Надежный хеш открытого ключа, используемый для проверки целостности и подлинности всего кода, выполняемого во время загрузки устройства в рамках функции Verified Boot . Рекомендуется использовать SHA-256.
deviceLocked
Указывает, заблокирован ли загрузчик устройства. true означает, что устройство загрузило подписанный образ, успешно проверенный функцией Verified Boot .
verifiedBootState
Устройство находится в состоянии «Проверено при загрузке» .
verifiedBootHash
Сводная таблица всех данных, защищенных функцией Verified Boot . Для устройств, использующих эталонную реализацию Android Verified Boot , это поле содержит сводную таблицу VBMeta .

Значения VerifiedBootState

Ценить Соответствующее состояние загрузки Значение
Verified GREEN Полная цепочка доверия простирается от аппаратно защищенного корня доверия до загрузчика и всех разделов, проверенных с помощью Verified Boot . В этом состоянии поле verifiedBootKey содержит хеш встроенного корня доверия , которым является сертификат, встроенный в ПЗУ устройства производителем устройства на заводе.
SelfSigned YELLOW Аналогично состоянию Verified , за исключением того, что проверка проводилась с использованием корня доверия, настроенного пользователем, а не корня доверия, встроенного производителем на заводе. В этом состоянии поле verifiedBootKey содержит хеш открытого ключа, настроенного пользователем.
Unverified ORANGE Загрузчик устройства разблокирован, поэтому цепочка доверия не может быть установлена. Устройство может свободно модифицироваться, поэтому целостность устройства должна быть проверена пользователем внеполосным способом. В этом состоянии поле verifiedBootKey содержит 32 байта нулей.
Failed RED Проверка устройства не пройдена. В этом состоянии нет никаких гарантий относительно содержимого остальных полей RootOfTrust .

Идентификатор заявки на аттестацию

Это поле отражает мнение платформы Android о том, каким приложениям разрешено использовать секретный ключ, подлежащий аттестации. Оно может содержать несколько пакетов только в том случае, если несколько пакетов имеют один и тот же UID. Поле AttestationApplicationId в AuthorizationList имеет тип OCTET_STRING и отформатировано в соответствии со следующей схемой ASN.1: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
Набор объектов AttestationPackageInfo , каждый из которых содержит имя пакета и номер версии.
signature_digests

Набор хеш-сумм SHA-256 сертификатов подписи приложения. Приложение может иметь несколько цепочек сертификатов ключей подписи. Для каждой из них "конечный" сертификат обрабатывается и помещается в поле signature_digests . Название поля вводит в заблуждение, поскольку обработанные данные представляют собой сертификаты подписи приложения, а не подписи приложения, так как оно названо в честь класса Signature , возвращаемого вызовом getPackageInfo() . Следующий фрагмент кода показывает пример набора: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Расширение информации о предоставлении ресурсов

Расширение, предоставляющее информацию о предоставлении доступа, имеет OID 1.3.6.1.4.1.11129.2.1.30 . Это расширение предоставляет информацию об устройстве, известную серверу предоставления доступа.

Схема

Расширенное значение представляет собой данные в формате краткого двоичного представления объекта (CBOR) , соответствующие схеме краткого языка определения данных (CDDL) : 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

Карта не имеет версионной версии, и в неё могут быть добавлены новые необязательные поля.

certs_issued

Примерное количество сертификатов, выданных устройству за последние 30 дней. Это значение может служить сигналом о потенциальном злоупотреблении, если оно на несколько порядков превышает среднее значение.

validated_attested_entity

Строка, указывающая на сертифицированное происхождение заверенного ключа, подтвержденное непосредственно производителем чипсета. Например, STRONG_BOX или TEE .

is_lost_device

Логическое значение, указывающее, было ли устройство заявлено как утерянное. Если значение присутствует и равно true, сертификат был выдан для устройства, которое в настоящее время помечено как утерянное.

Ключи аттестации

В устройство надежно заложены два ключа, один RSA и один ECDSA, а также соответствующие цепочки сертификатов.

В Android 12 появилась функция удаленной настройки ключей (Remote Key Provisioning ). Эта функция предоставляет устройствам в полевых условиях сертификаты аттестации ECDSA P-256 для каждого приложения, срок действия которых короче, чем у заводских сертификатов.

Уникальный идентификатор

Уникальный идентификатор (Unique ID) — это 128-битное значение, которое идентифицирует устройство, но только в течение ограниченного периода времени. Значение вычисляется следующим образом: 

HMAC_SHA256(T || C || R, HBK)

Где:

  • T — это «значение временного счетчика», вычисляемое путем деления значения Tag::CREATION_DATETIME на 2592000000 без остатка. Значение T изменяется каждые 30 дней (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C — это значение Tag::APPLICATION_ID
  • Значение R равно 1, если Tag::RESET_SINCE_ID_ROTATION присутствует в параметре attest_params вызова attest_key, или 0, если тег отсутствует.
  • HBK — это уникальный аппаратный секрет, известный доверенной среде выполнения и никогда не раскрываемый ею. Секрет содержит не менее 128 бит энтропии и уникален для каждого отдельного устройства (вероятностная уникальность допустима, учитывая 128 бит энтропии). HBK должен быть получен из объединенного ключевого материала с помощью HMAC или AES_CMAC.

Усеките выходные данные HMAC_SHA256 до 128 бит.

Несколько IMEI

В Android 14 добавлена ​​поддержка нескольких IMEI в записи аттестации ключа Android. Производители оборудования могут реализовать эту функцию, добавив тег KeyMint для второго IMEI. Устройства с несколькими сотовыми модулями становятся все более распространенными, и теперь производители могут поддерживать устройства с двумя IMEI.

Производители оригинального оборудования (OEM) обязаны иметь дополнительный IMEI, если он присутствует на их устройствах, который должен быть предоставлен реализации(ям) KeyMint, чтобы эти реализации могли подтвердить его наличие так же, как и первый IMEI.

Подтверждение личности

Android 8.0 включает опциональную поддержку аттестации идентификаторов для устройств с Keymaster 3. Аттестация идентификаторов позволяет устройству подтверждать свои аппаратные идентификаторы, такие как серийный номер или IMEI. Хотя это необязательная функция, настоятельно рекомендуется, чтобы все реализации Keymaster 3 поддерживали ее, поскольку возможность подтверждения личности устройства делает более безопасными такие сценарии использования, как настоящая удаленная настройка без участия пользователя (поскольку удаленная сторона может быть уверена, что общается с правильным устройством, а не с устройством, подделывающим свою личность).

Аттестация идентификатора устройства работает путем создания копий аппаратных идентификаторов устройства, к которым имеет доступ только TEE (Telephone Time Entity) до того, как устройство покинет завод. Пользователь может разблокировать загрузчик устройства и изменить системное программное обеспечение и идентификаторы, сообщаемые фреймворками Android. Копии идентификаторов, хранящиеся в TEE, не могут быть изменены таким образом, что гарантирует, что аттестация идентификатора устройства подтверждает только исходные аппаратные идентификаторы устройства, тем самым предотвращая попытки подмены.

Основной API-интерфейс для аттестации идентификаторов основан на существующем механизме аттестации ключей, представленном в Keymaster 2. При запросе сертификата аттестации для ключа, хранящегося в Keymaster, вызывающая сторона может запросить включение аппаратных идентификаторов устройства в метаданные сертификата аттестации. Если ключ хранится в TEE, сертификат ведет к известному корню доверия. Получатель такого сертификата может убедиться, что сертификат и его содержимое, включая аппаратные идентификаторы, были записаны TEE. При запросе включения аппаратных идентификаторов в сертификат аттестации TEE подтверждает только идентификаторы, хранящиеся в его хранилище, как они были заполнены на заводе.

Свойства хранения

Хранилище, содержащее идентификаторы устройства, должно обладать следующими свойствами:

  • Значения, полученные из исходных идентификаторов устройства, копируются в память устройства перед его отправкой с завода.
  • Метод destroyAttestationIds() может безвозвратно уничтожить эту копию данных, полученных из идентификаторов. Безвозвратное уничтожение означает полное удаление данных, поэтому ни сброс к заводским настройкам, ни какие-либо другие процедуры, выполненные на устройстве, не смогут их восстановить. Это особенно важно для устройств, где пользователь разблокировал загрузчик, изменил системное программное обеспечение и модифицировал идентификаторы, возвращаемые фреймворками Android.
  • Центры по возврату оборудования (RMA) должны иметь возможность создавать новые копии данных, полученных на основе идентификаторов оборудования. Таким образом, устройство, прошедшее через RMA, сможет повторно пройти аттестацию идентификатора. Механизм, используемый центрами RMA, должен быть защищен, чтобы пользователи не могли использовать его самостоятельно, поскольку это позволило бы им получить аттестацию поддельных идентификаторов.
  • Никакой код, кроме доверенного приложения Keymaster в TEE, не может считывать данные, полученные на основе идентификатора и хранящиеся в хранилище.
  • Хранилище защищено от несанкционированного доступа: если содержимое хранилища было изменено, TEE обрабатывает его так же, как если бы копии содержимого были уничтожены, и отклоняет все попытки подтверждения личности. Это реализуется путем подписания или MAC-кодирования хранилища , как описано ниже .
  • В хранилище не хранятся исходные идентификаторы. Поскольку аттестация идентификаторов включает в себя проверку подлинности, вызывающая сторона всегда предоставляет идентификаторы для аттестации. TEE нужно лишь убедиться, что они соответствуют исходным значениям. Хранение защищенных хешей исходных значений, а не самих значений, позволяет выполнить эту проверку.

Строительство

Для создания реализации, обладающей перечисленными выше свойствами, сохраните значения, полученные из идентификаторов, в следующей конструкции S. Не храните другие копии значений идентификаторов, за исключением обычных мест в системе, которые владелец устройства может изменить, получив root-права: 

S = D || HMAC(HBK, D)

где:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC — это конструкция HMAC с соответствующим надежным хешем (рекомендуется SHA-256).
  • HBK — это аппаратная клавиша, не используемая ни для каких других целей.
  • ID 1 ...ID n — это исходные значения идентификаторов; сопоставление конкретного значения с конкретным индексом зависит от реализации, поскольку разные устройства имеют разное количество идентификаторов.
  • || обозначает конкатенацию

Поскольку выходные данные HMAC имеют фиксированный размер, для поиска хешей отдельных идентификаторов или HMAC элемента D не требуется никаких заголовков или другой структуры. Помимо проверки предоставленных значений для аттестации, реализациям необходимо проверить S, извлекая D из S, вычисляя HMAC(HBK, D) и сравнивая его со значением в S, чтобы убедиться, что отдельные идентификаторы не были изменены/повреждены. Кроме того, реализации должны использовать сравнения за постоянное время для всех отдельных элементов идентификаторов и проверки S. Время сравнения должно быть постоянным независимо от количества предоставленных идентификаторов и правильности совпадения любой части теста.

Идентификаторы оборудования

Подтверждение личности поддерживает следующие аппаратные идентификаторы:

  1. Название бренда, возвращаемое функцией Build.BRAND в Android.
  2. Название устройства, возвращаемое функцией Build.DEVICE в Android.
  3. Название продукта, возвращаемое функцией Build.PRODUCT в Android.
  4. Название производителя, возвращаемое функцией Build.MANUFACTURER в Android.
  5. Название модели, возвращаемое функцией Build.MODEL в Android.
  6. Серийный номер
  7. IMEI всех радиоприемников
  8. Идентификаторы MEID всех радиостанций

Для поддержки аттестации идентификаторов устройств, устройство должно подтвердить наличие этих идентификаторов. Все устройства под управлением Android имеют первые шесть идентификаторов, и они необходимы для работы этой функции. Если устройство имеет встроенные модули сотовой связи, оно также должно поддерживать аттестацию IMEI и/или MEID этих модулей.

Подтверждение личности запрашивается путем выполнения аттестации ключа и включения в запрос идентификаторов устройства, подлежащих аттестации. Идентификаторы помечаются следующим образом:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

Идентификатор для подтверждения представляет собой байтовую строку, закодированную в UTF-8. Этот формат также применим к числовым идентификаторам. Каждый идентификатор для подтверждения выражается в виде строки, закодированной в UTF-8.

Если устройство не поддерживает аттестацию идентификаторов (или destroyAttestationIds() была вызвана ранее, и устройство больше не может аттестовать свои идентификаторы), любой запрос на аттестацию ключа, включающий один или несколько из этих тегов, завершится ошибкой ErrorCode::CANNOT_ATTEST_IDS .

Если устройство поддерживает аттестацию идентификаторов и один или несколько из указанных выше тегов были включены в запрос на аттестацию ключа, TEE проверяет, соответствует ли идентификатор, предоставленный с каждым из тегов, его копии аппаратных идентификаторов. Если один или несколько идентификаторов не совпадают, вся аттестация завершается ErrorCode::CANNOT_ATTEST_IDS . Допустимо указывать один и тот же тег несколько раз. Это может быть полезно, например, при аттестации IMEI: устройство может иметь несколько радиомодулей с несколькими IMEI. Запрос на аттестацию считается действительным, если значение, предоставленное с каждым ATTESTATION_ID_IMEI соответствует одному из радиомодулей устройства. То же самое относится ко всем остальным тегам.

Если аттестация прошла успешно, аттестованные идентификаторы добавляются к расширению аттестации (OID 1.3.6.1.4.1.11129.2.1.17) выданного сертификата аттестации с использованием схемы, указанной выше . Изменения по сравнению со схемой аттестации Keymaster 2 выделены жирным шрифтом и сопровождаются комментариями.

Java API

Этот раздел носит исключительно информационный характер. Разработчики Keymaster не используют и не внедряют Java API. Данная информация предоставлена ​​для того, чтобы помочь разработчикам понять, как эта функция используется приложениями. Компоненты системы могут использовать её по-разному, поэтому крайне важно, чтобы этот раздел не рассматривался как нормативный.

,

Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and KeyMint (previously Keymaster) enforces restrictions that are difficult to subvert.

However, this is true only if the Keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available Keymaster hardware abstraction layer (HAL) and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, key attestation was introduced in Android 7.0 (Keymaster 2) and ID attestation was introduced in Android 8.0 (Keymaster 3).

Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Key attestation

To support key attestation, Android 7.0 introduced a set of tags, type, and method to the HAL.

Теги

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

Тип

Keymaster 2 and below

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

AttestKey method

Keymaster 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 and below

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev is the Keymaster device structure.
  • keyToAttest is the key blob returned from generateKey for which the attestation is created.
  • attestParams is a list of any parameters necessary for attestation. This includes Tag::ATTESTATION_CHALLENGE and possibly Tag::RESET_SINCE_ID_ROTATION , as well as Tag::APPLICATION_ID and Tag::APPLICATION_DATA . The latter two are necessary to decrypt the key blob if they were specified during key generation.
  • certChain is the output parameter, which returns an array of certificates. Entry 0 is the attestation certificate, meaning it certifies the key from keyToAttest and contains the attestation extension.

The attestKey method is considered a public key operation on the attested key, because it can be called at any time and doesn't need to meet authorization constraints. For example, if the attested key needs user authentication for use, an attestation can be generated without user authentication.

Attestation certificate

The attestation certificate is a standard X.509 certificate, with an optional attestation extension that contains a description of the attested key. The certificate is signed with a certified attestation key . The attestation key might use a different algorithm than the key being attested.

The attestation certificate contains the fields in the table below and can't contain any additional fields. Some fields specify a fixed field value. CTS tests validate that the certificate content is exactly as defined.

Certificate SEQUENCE

Field name (see RFC 5280 ) Ценить
tbsCertificate TBSCertificate SEQUENCE
signatureAlgorithm AlgorithmIdentifier of algorithm used to sign key:
ECDSA for EC keys, RSA for RSA keys.
signatureValue BIT STRING, signature computed on ASN.1 DER-encoded tbsCertificate.

TBSCertificate SEQUENCE

Field name (see RFC 5280 ) Ценить
version INTEGER 2 (means v3 certificate)
serialNumber INTEGER 1 (fixed value: same on all certs)
signature AlgorithmIdentifier of algorithm used to sign key: ECDSA for EC keys, RSA for RSA keys.
issuer Same as the subject field of the batch attestation key.
validity SEQUENCE of two dates, containing the values of Tag::ACTIVE_DATETIME and Tag::USAGE_EXPIRE_DATETIME . Those values are in milliseconds since Jan 1, 1970. See RFC 5280 for correct date representations in certificates.
If Tag::ACTIVE_DATETIME is not present, use the value of Tag::CREATION_DATETIME . If Tag::USAGE_EXPIRE_DATETIME is not present, use the expiration date of the batch attestation key certificate.
subject CN = "Android Keystore Key" (fixed value: same on all certs)
subjectPublicKeyInfo SubjectPublicKeyInfo containing attested public key.
extensions/Key Usage digitalSignature: set if key has purpose KeyPurpose::SIGN or KeyPurpose::VERIFY . All other bits unset.
extensions/CRL Distribution Points Value TBD
extensions/"attestation" The OID is 1.3.6.1.4.1.11129.2.1.17; the content is defined in the Attestation extension section below. As with all X.509 certificate extensions, the content is represented as an OCTET_STRING containing a DER encoding of the attestation SEQUENCE.

Attestation extension

The attestation extension has OID 1.3.6.1.4.1.11129.2.1.17 . It contains information about the key pair being attested and the state of the device at key generation time.

The Keymaster/KeyMint tag types defined in the AIDL interface specification are translated to ASN.1 types as follows:

KeyMint or Keymaster type ASN.1 type Примечания
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Milliseconds since Jan 1, 1970 00:00:00 GMT.
BOOL NULL Tag presence means true, absence means false.
BIGNUM No tags have this type, so no mapping is defined.
BYTES OCTET_STRING

Схема

The attestation extension content is described by the following ASN.1 schema. The ASN.1 schema for the AuthorizationList is also used to import encrypted keys . Any fields which will not appear in the attestation extension are noted as such.

Версия 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 300 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 100 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 4 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 2 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

Версия 1 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

KeyDescription fields

attestationVersion
The ASN.1 schema version.
Ценить KeyMint or Keymaster version
1 Keymaster version 2.0
2 Keymaster version 3.0
3 Keymaster version 4.0
4 Keymaster version 4.1
100 KeyMint version 1.0
200 KeyMint version 2.0
300 KeyMint version 3.0
400 KeyMint version 4.0
500 KeyMint version 5.0
attestationSecurityLevel

The security level of the location where the attested key is stored.

keymasterVersion / keyMintVersion
The version of the KeyMint or Keymaster HAL implementation.
Ценить KeyMint or Keymaster version
2 Keymaster version 2.0
3 Keymaster version 3.0
4 Keymaster version 4.0
41 Keymaster version 4.1
100 KeyMint version 1.0
200 KeyMint version 2.0
300 KeyMint version 3.0
400 KeyMint version 4.0
500 KeyMint version 5.0
keymasterSecurityLevel / keyMintSecurityLevel
The security level of the KeyMint or Keymaster implementation.
attestationChallenge
The challenge provided at key generation time.
uniqueId
A privacy-sensitive device identifier that system apps can request at key generation time. If the unique ID is not requested, this field is empty. For details, see the Unique ID section.
softwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the Android system. This information is collected or generated by code in the platform. It can be trusted as long as the device is running an operating system that complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
hardwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the device's Trusted Execution Environment (TEE) or StrongBox . This information is collected or generated by code in the secure hardware and is not controlled by the platform. For example, information can come from the bootloader or through a secure communication channel that does not involve trusting the platform.

SecurityLevel values

The SecurityLevel value indicates the extent to which a Keystore-related element (for example, key pair and attestation) is resilient to attack.

Ценить Значение
Software Secure as long as the device's Android system complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
TrustedEnvironment Secure as long as the TEE is not compromised. The isolation requirements for TEEs are defined in sections 9.11 [C-1-1] through [C-1-4] of the Android Compatibility Definition Document. TEEs are highly resistant to remote compromise and moderately resistant to compromise by direct hardware attack.
StrongBox Secure as long as StrongBox is not compromised. StrongBox is implemented in a secure element similar to a hardware security module. The implementation requirements for StrongBox are defined in section 9.11.2 of the Android Compatibility Definition Document. StrongBox is highly resistant to remote compromise and compromise by direct hardware attack (for example, physical tampering and side-channel attacks).

AuthorizationList fields

Each field corresponds to a Keymaster/KeyMint authorization tag from the AIDL interface specification . The specification is the source of truth about authorization tags: their meaning, the format of their contents, whether they are expected to appear in the softwareEnforced or hardwareEnforced fields in the KeyDescription object, whether they are mutually exclusive with other tags, etc. All AuthorizationList fields are optional.

Each field has an EXPLICIT context-specific tag equal to the KeyMint or Keymaster tag number, which enables a more compact representation of the data in the AuthorizationList . The ASN.1 parser must therefore know the expected data type for each context-specific tag. For example, Tag::USER_AUTH_TYPE is defined as ENUM | 504 . In the attestation extension schema, the purpose field in the AuthorizationList is specified as userAuthType [504] EXPLICIT INTEGER OPTIONAL . Its ASN.1 encoding will therefore contain the context-specific tag 504 instead of the UNIVERSAL class tag for the ASN.1 type INTEGER , which is 10 .

The following fields are present in attestations generated by KeyMint 5:
purpose
Corresponds to the Tag::PURPOSE authorization tag, which uses a tag ID value of 1.
algorithm

Corresponds to the Tag::ALGORITHM authorization tag, which uses a tag ID value of 2.

In an attestation AuthorizationList object, the algorithm value is always RSA , EC , or ML_DSA .

keySize
Corresponds to the Tag::KEY_SIZE authorization tag, which uses a tag ID value of 3.
blockMode
Corresponds to the Tag::BLOCK_MODE authorization tag, which uses a tag ID value of 4.
digest
Corresponds to the Tag::DIGEST authorization tag, which uses a tag ID value of 5.
padding
Corresponds to the Tag::PADDING authorization tag, which uses a tag ID value of 6.
callerNonce
Corresponds to the Tag::CALLER_NONCE authorization tag, which uses a tag ID value of 7. This tag is never present in attestations.
minMacLength
Corresponds to the Tag::MIN_MAC_LENGTH authorization tag, which uses a tag ID value of 8. This tag is never present in attestations.
ecCurve

Corresponds to the Tag::EC_CURVE authorization tag, which uses a tag ID value of 10.

The set of parameters used to generate an elliptic curve (EC) key pair, which uses ECDSA for signing and verification, within the Android system keystore.

mlDsaVariant

Present only in key attestation version >= 500.

Corresponds to the Tag::ML_DSA_VARIANT authorization tag, which uses a tag ID value of 11.

rsaPublicExponent
Corresponds to the Tag::RSA_PUBLIC_EXPONENT authorization tag, which uses a tag ID value of 200.
mgfDigest

Present only in key attestation version >= 100.

Corresponds to the Tag::RSA_OAEP_MGF_DIGEST KeyMint authorization tag, which uses a tag ID value of 203.
rollbackResistance

Present only in key attestation version >= 3.

Corresponds to the Tag::ROLLBACK_RESISTANCE authorization tag, which uses a tag ID value of 303.

earlyBootOnly

Present only in key attestation version >= 4.

Corresponds to the Tag::EARLY_BOOT_ONLY authorization tag, which uses a tag ID value of 305.

activeDateTime
Corresponds to the Tag::ACTIVE_DATETIME authorization tag, which uses a tag ID value of 400.
originationExpireDateTime
Corresponds to the Tag::ORIGINATION_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 401.
usageExpireDateTime
Corresponds to the Tag::USAGE_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 402.
usageCountLimit
Corresponds to the Tag::USAGE_COUNT_LIMIT authorization tag, which uses a tag ID value of 405.
userSecureId
Corresponds to the Tag::USER_SECURE_ID authorization tag, which uses a tag ID value of 502. This tag is never present in attestations.
noAuthRequired

Corresponds to the Tag::NO_AUTH_REQUIRED authorization tag, which uses a tag ID value of 503.

userAuthType
Corresponds to the Tag::USER_AUTH_TYPE authorization tag, which uses a tag ID value of 504.
authTimeout
Corresponds to the Tag::AUTH_TIMEOUT authorization tag, which uses a tag ID value of 505.
allowWhileOnBody

Corresponds to the Tag::ALLOW_WHILE_ON_BODY authorization tag, which uses a tag ID value of 506.

Allows the key to be used after its authentication timeout period if the user is still wearing the device on their body. Note that a secure on-body sensor determines whether the device is being worn on the user's body.

trustedUserPresenceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_USER_PRESENCE_REQUIRED authorization tag, which uses a tag ID value of 507.

Specifies that this key is usable only if the user has provided proof of physical presence. Several examples include the following:

  • For a StrongBox key, a hardware button hardwired to a pin on the StrongBox device.
  • For a TEE key, fingerprint authentication provides proof of presence as long as the TEE has exclusive control of the scanner and performs the fingerprint matching process.
trustedConfirmationReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_CONFIRMATION_REQUIRED authorization tag, which uses a tag ID value of 508.

Specifies that the key is usable only if the user provides confirmation of the data to be signed using an approval token. For more information about how to obtain user confirmation, see Android Protected Confirmation .

Note: This tag is only applicable to keys that use the SIGN purpose.

unlockedDeviceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::UNLOCKED_DEVICE_REQUIRED authorization tag, which uses a tag ID value of 509.

creationDateTime
Corresponds to the Tag::CREATION_DATETIME authorization tag, which uses a tag ID value of 701.
origin

Corresponds to the Tag::ORIGIN authorization tag, which uses a tag ID value of 702.

rootOfTrust

Corresponds to the Tag::ROOT_OF_TRUST authorization tag, which uses a tag ID value of 704.

For more details, see the section describing the RootOfTrust data structure.

osVersion

Corresponds to the Tag::OS_VERSION authorization tag, which uses a tag ID value of 705.

The version of the Android operating system associated with the Keymaster, specified as a six-digit integer. For example, version 8.1.0 is represented as 080100.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

osPatchLevel

Corresponds to the Tag::OS_PATCHLEVEL authorization tag, which uses a tag ID value of 706.

The month and year associated with the security patch that is being used within KeyMint (previously Keymaster), specified as a six-digit integer. For example, the August 2018 patch is represented as 201808.

Prefer using this field over vendorPatchLevel or bootPatchLevel for checking whether a device has been recently patched.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

attestationApplicationId

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_APPLICATION_ID authorization tag, which uses a tag ID value of 709.

For more details, see the section describing the AttestationApplicationId data structure.

attestationIdBrand

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_BRAND authorization tag, which uses a tag ID value of 710.

attestationIdDevice

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_DEVICE authorization tag, which uses a tag ID value of 711.

attestationIdProduct

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_PRODUCT authorization tag, which uses a tag ID value of 712.

attestationIdSerial

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_SERIAL authorization tag, which uses a tag ID value of 713.

attestationIdImei

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_IMEI authorization tag, which uses a tag ID value of 714.

attestationIdMeid

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MEID authorization tag, which uses a tag ID value of 715.

attestationIdManufacturer

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MANUFACTURER authorization tag, which uses a tag ID value of 716.

attestationIdModel

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MODEL authorization tag, which uses a tag ID value of 717.

vendorPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::VENDOR_PATCHLEVEL authorization tag, which uses a tag ID value of 718.

Specifies the vendor image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the vendor's 2018-08-05 security patch installed, this value would be 20180805.

bootPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::BOOT_PATCHLEVEL authorization tag, which uses a tag ID value of 719.

Specifies the kernel image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the kernel's 2018-08-05 security patch installed, this value would be 20180805.

deviceUniqueAttestation

Present only in key attestation versions >= 4.

Corresponds to the Tag::DEVICE_UNIQUE_ATTESTATION authorization tag, which uses a tag ID value of 720.

attestationIdSecondImei

Present only in key attestation versions >= 300.

Corresponds to the Tag::ATTESTATION_ID_SECOND_IMEI authorization tag, which uses a tag ID value of 723.

moduleHash

Present only in key attestation versions >= 400.

Corresponds to the Tag::MODULE_HASH authorization tag, which uses a tag ID value of 724.

RootOfTrust fields

verifiedBootKey
A secure hash of the public key used to verify the integrity and authenticity of all code that executes during device boot up as part of Verified Boot . SHA-256 is recommended.
deviceLocked
Whether the device's bootloader is locked. true means that the device booted a signed image that was successfully verified by Verified Boot .
verifiedBootState
The device's Verified Boot state .
verifiedBootHash
A digest of all data protected by Verified Boot . For devices that use the Android Verified Boot reference implementation, this field contains the VBMeta digest .

VerifiedBootState values

Ценить Corresponding boot state Значение
Verified GREEN A full chain of trust extends from a hardware-protected root of trust to the bootloader and all partitions verified by Verified Boot . In this state, the verifiedBootKey field contains the hash of the embedded root of trust , which is the certificate embedded in the device's ROM by the device manufacturer in the factory.
SelfSigned YELLOW Same as Verified , except that the verification was done using a root of trust configured by the user instead of the root of trust embedded by the manufacturer in the factory. In this state, the verifiedBootKey field contains the hash of the public key configured by the user.
Unverified ORANGE The device's bootloader is unlocked, so a chain of trust cannot be established. The device can be freely modified, so the device's integrity must be verified by the user out-of-band. In this state the verifiedBootKey field contains 32 bytes of zeroes.
Failed RED The device failed verification. In this state, there are no guarantees about the contents of the other RootOfTrust fields.

AttestationApplicationId

This field reflects the Android platform's belief as to which apps are allowed to use the secret key material under attestation. It can contain multiple packages if and only if multiple packages share the same UID. The AttestationApplicationId field in AuthorizationList is of type OCTET_STRING and is formatted according to the following ASN.1 schema: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
A set of AttestationPackageInfo objects, each providing a package's name and version number.
signature_digests

A set of SHA-256 digests of the app's signing certificates. An app can have multiple signing key certificate chains. For each, the "leaf" certificate is digested and placed in the signature_digests field. The field name is misleading, since the digested data is the app's signing certificates, not the app signatures, because it is named for the Signature class returned by a call to getPackageInfo() . The following code snippet shows an example set: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Provisioning information extension

The provisioning information extension has OID 1.3.6.1.4.1.11129.2.1.30 . The extension provides information that's known about the device by the provisioning server.

Схема

The extension value consists of Concise Binary Object Representation (CBOR) data that conforms to this Concise Data Definition Language (CDDL) schema: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

The map is unversioned and new optional fields may be added.

certs_issued

An approximate number of certificates issued to the device in the last 30 days. This value can be used as a signal for potential abuse if the value is greater than average by some orders of magnitude.

validated_attested_entity

A string indicating the certified origin of the attested key, directly vouched for by the chipset manufacturer. For example, STRONG_BOX or TEE .

is_lost_device

A boolean indicating whether the device has been reported as lost. If present and true, the certificate was provisioned for a device currently marked as lost.

Attestation keys

Two keys, one RSA and one ECDSA, and the corresponding certificate chains, are securely provisioned into the device.

Android 12 introduces Remote Key Provisioning . This feature provides devices in the field with per-app ECDSA P-256 attestation certificates, which are shorter-lived than factory-provisioned certificates.

Уникальный идентификатор

The Unique ID is a 128-bit value that identifies the device, but only for a limited period of time. The value is computed with: 

HMAC_SHA256(T || C || R, HBK)

Где:

  • T is the "temporal counter value", computed by dividing the value of Tag::CREATION_DATETIME by 2592000000, dropping any remainder. T changes every 30 days (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C is the value of Tag::APPLICATION_ID
  • R is 1 if Tag::RESET_SINCE_ID_ROTATION is present in the attest_params parameter to the attest_key call, or 0 if the tag is not present.
  • HBK is a unique hardware-bound secret known to the Trusted Execution Environment and never revealed by it. The secret contains at least 128 bits of entropy and is unique to the individual device (probabilistic uniqueness is acceptable given the 128 bits of entropy). HBK should be derived from fused key material via HMAC or AES_CMAC.

Truncate the HMAC_SHA256 output to 128 bits.

Multiple IMEIs

Android 14 adds support for multiple IMEIs in the Android Key Attestation record. OEMs can implement this feature by adding a KeyMint tag for a second IMEI. It is becoming increasingly common for devices to have multiple cellular radios and OEMs can now support devices with two IMEIs.

OEMs are required to have a secondary IMEI, if present on their devices, to be provisioned to the KeyMint implementation(s) so that those implementations can attest to it in the same way they attest to the first IMEI.

ID attestation

Android 8.0 includes optional support for ID attestation for devices with Keymaster 3. ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. Although an optional feature, it is highly recommended that all Keymaster 3 implementations provide support for it because being able to prove the device's identity enables use cases such as true zero-touch remote configuration to be more secure (because the remote side can be certain it is talking to the right device, not a device spoofing its identity).

ID attestation works by creating copies of the device's hardware identifiers that only the TEE can access before the device leaves the factory. A user can unlock the device's bootloader and change the system software and the identifiers reported by the Android frameworks. The copies of the identifiers held by the TEE cannot be manipulated in this way, ensuring that device ID attestation only attests to the device's original hardware identifiers, thereby thwarting spoofing attempts.

The main API surface for ID attestation builds on top of the existing key attestation mechanism introduced with Keymaster 2. When requesting an attestation certificate for a key held by Keymaster, the caller can request that the device's hardware identifiers be included in the attestation certificate's metadata. If the key is held in the TEE, the certificate chains back to a known root of trust. The recipient of such a certificate can verify that the certificate and its contents, including the hardware identifiers, were written by the TEE. When asked to include hardware identifiers in the attestation certificate, the TEE attests only to the identifiers held in its storage, as populated on the factory floor.

Storage properties

The storage that holds the device's identifiers needs to have these properties:

  • The values derived from the device's original identifiers are copied to the storage before the device leaves the factory.
  • The destroyAttestationIds() method can permanently destroy this copy of the identifier-derived data. Permanent destruction means the data is completely removed so neither a factory reset nor any other procedure performed on the device can restore it. This is especially important for devices where a user has unlocked the bootloader and changed the system software and modified the identifiers returned by Android frameworks.
  • RMA facilities should have the ability to generate fresh copies of the hardware identifier-derived data. This way, a device that passes through RMA can perform ID attestation again. The mechanism used by RMA facilities must be protected so that users cannot invoke it themselves, as that would allow them to obtain attestations of spoofed IDs.
  • No code other than Keymaster trusted app in the TEE is able to read the identifier-derived data kept in the storage.
  • The storage is tamper-evident: If the content of the storage has been modified, the TEE treats it the same as if the copies of the content had been destroyed and refuses all ID attestation attempts. This is implemented by signing or MACing the storage as described below .
  • The storage does not hold the original identifiers. Because ID attestation involves a challenge, the caller always supplies the identifiers to be attested. The TEE only needs to verify that these match the values they originally had. Storing secure hashes of the original values rather than the values enables this verification.

Строительство

To create an implementation that has the properties listed above, store the ID-derived values in the following construction S. Do not store other copies of the ID values, excepting the normal places in the system, which a device owner can modify by rooting: 

S = D || HMAC(HBK, D)

где:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC is the HMAC construction with an appropriate secure hash (SHA-256 recommended)
  • HBK is a hardware-bound key not used for any other purpose
  • ID 1 ...ID n are the original ID values; association of a particular value to a particular index is implementation-dependent, as different devices have different numbers of identifiers
  • || represents concatenation

Because the HMAC outputs are fixed size, no headers or other structure are required to be able to find individual ID hashes, or the HMAC of D. In addition to checking provided values to perform attestation, implementations need to validate S by extracting D from S, computing HMAC(HBK, D) and comparing it to the value in S to verify that no individual IDs were modified/corrupted. Also, implementations must use constant-time comparisons for all individual ID elements and the validation of S. Comparison time must be constant regardless of the number of IDs provided and the correct matching of any part of the test.

Hardware identifiers

ID attestation supports the following hardware identifiers:

  1. Brand name, as returned by Build.BRAND in Android
  2. Device name, as returned by Build.DEVICE in Android
  3. Product name, as returned by Build.PRODUCT in Android
  4. Manufacturer name, as returned by Build.MANUFACTURER in Android
  5. Model name, as returned by Build.MODEL in Android
  6. Серийный номер
  7. IMEIs of all radios
  8. MEIDs of all radios

To support device ID attestation, a device attests to these identifiers. All devices running Android have the first six and they are necessary for this feature to work. If the device has any integrated cellular radios, the device must also support attestation for the IMEIs and/or MEIDs of the radios.

ID attestation is requested by performing a key attestation and including the device identifiers to attest in the request. The identifiers are tagged as:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

The identifier to attest is a UTF-8 encoded byte string. This format applies to numerical identifiers, as well. Each identifier to attest is expressed as a UTF-8 encoded string.

If the device does not support ID attestation (or destroyAttestationIds() was previously called and the device can no longer attest its IDs), any key attestation request that includes one or more of these tags fails with ErrorCode::CANNOT_ATTEST_IDS .

If the device supports ID attestation and one or more of the above tags have been included in a key attestation request, the TEE verifies the identifier supplied with each of the tags matches its copy of the hardware identifiers. If one or more identifiers do not match, the entire attestation fails with ErrorCode::CANNOT_ATTEST_IDS . It is valid for the same tag to be supplied multiple times. This can be useful, for example, when attesting IMEIs: A device can have multiple radios with multiple IMEIs. An attestation request is valid if the value supplied with each ATTESTATION_ID_IMEI matches one of the device's radios. The same applies to all other tags.

If attestation is successful, the attested IDs is added to the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) of the issued attestation certificate, using the schema from above . Changes from the Keymaster 2 attestation schema are bolded , with comments.

Java API

This section is informational only. Keymaster implementers neither implement nor use the Java API. This is provided to help implementers understand how the feature is used by apps. System components might use it differently, which is why it's crucial this section not be treated as normative.

,

Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and KeyMint (previously Keymaster) enforces restrictions that are difficult to subvert.

However, this is true only if the Keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available Keymaster hardware abstraction layer (HAL) and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, key attestation was introduced in Android 7.0 (Keymaster 2) and ID attestation was introduced in Android 8.0 (Keymaster 3).

Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Key attestation

To support key attestation, Android 7.0 introduced a set of tags, type, and method to the HAL.

Теги

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

Тип

Keymaster 2 and below

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

AttestKey method

Keymaster 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 and below

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev is the Keymaster device structure.
  • keyToAttest is the key blob returned from generateKey for which the attestation is created.
  • attestParams is a list of any parameters necessary for attestation. This includes Tag::ATTESTATION_CHALLENGE and possibly Tag::RESET_SINCE_ID_ROTATION , as well as Tag::APPLICATION_ID and Tag::APPLICATION_DATA . The latter two are necessary to decrypt the key blob if they were specified during key generation.
  • certChain is the output parameter, which returns an array of certificates. Entry 0 is the attestation certificate, meaning it certifies the key from keyToAttest and contains the attestation extension.

The attestKey method is considered a public key operation on the attested key, because it can be called at any time and doesn't need to meet authorization constraints. For example, if the attested key needs user authentication for use, an attestation can be generated without user authentication.

Attestation certificate

The attestation certificate is a standard X.509 certificate, with an optional attestation extension that contains a description of the attested key. The certificate is signed with a certified attestation key . The attestation key might use a different algorithm than the key being attested.

The attestation certificate contains the fields in the table below and can't contain any additional fields. Some fields specify a fixed field value. CTS tests validate that the certificate content is exactly as defined.

Certificate SEQUENCE

Field name (see RFC 5280 ) Ценить
tbsCertificate TBSCertificate SEQUENCE
signatureAlgorithm AlgorithmIdentifier of algorithm used to sign key:
ECDSA for EC keys, RSA for RSA keys.
signatureValue BIT STRING, signature computed on ASN.1 DER-encoded tbsCertificate.

TBSCertificate SEQUENCE

Field name (see RFC 5280 ) Ценить
version INTEGER 2 (means v3 certificate)
serialNumber INTEGER 1 (fixed value: same on all certs)
signature AlgorithmIdentifier of algorithm used to sign key: ECDSA for EC keys, RSA for RSA keys.
issuer Same as the subject field of the batch attestation key.
validity SEQUENCE of two dates, containing the values of Tag::ACTIVE_DATETIME and Tag::USAGE_EXPIRE_DATETIME . Those values are in milliseconds since Jan 1, 1970. See RFC 5280 for correct date representations in certificates.
If Tag::ACTIVE_DATETIME is not present, use the value of Tag::CREATION_DATETIME . If Tag::USAGE_EXPIRE_DATETIME is not present, use the expiration date of the batch attestation key certificate.
subject CN = "Android Keystore Key" (fixed value: same on all certs)
subjectPublicKeyInfo SubjectPublicKeyInfo containing attested public key.
extensions/Key Usage digitalSignature: set if key has purpose KeyPurpose::SIGN or KeyPurpose::VERIFY . All other bits unset.
extensions/CRL Distribution Points Value TBD
extensions/"attestation" The OID is 1.3.6.1.4.1.11129.2.1.17; the content is defined in the Attestation extension section below. As with all X.509 certificate extensions, the content is represented as an OCTET_STRING containing a DER encoding of the attestation SEQUENCE.

Attestation extension

The attestation extension has OID 1.3.6.1.4.1.11129.2.1.17 . It contains information about the key pair being attested and the state of the device at key generation time.

The Keymaster/KeyMint tag types defined in the AIDL interface specification are translated to ASN.1 types as follows:

KeyMint or Keymaster type ASN.1 type Примечания
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Milliseconds since Jan 1, 1970 00:00:00 GMT.
BOOL NULL Tag presence means true, absence means false.
BIGNUM No tags have this type, so no mapping is defined.
BYTES OCTET_STRING

Схема

The attestation extension content is described by the following ASN.1 schema. The ASN.1 schema for the AuthorizationList is also used to import encrypted keys . Any fields which will not appear in the attestation extension are noted as such.

Версия 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 300 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 100 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 4 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 2 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

Версия 1 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

KeyDescription fields

attestationVersion
The ASN.1 schema version.
Ценить KeyMint or Keymaster version
1 Keymaster version 2.0
2 Keymaster version 3.0
3 Keymaster version 4.0
4 Keymaster version 4.1
100 KeyMint version 1.0
200 KeyMint version 2.0
300 KeyMint version 3.0
400 KeyMint version 4.0
500 KeyMint version 5.0
attestationSecurityLevel

The security level of the location where the attested key is stored.

keymasterVersion / keyMintVersion
The version of the KeyMint or Keymaster HAL implementation.
Ценить KeyMint or Keymaster version
2 Keymaster version 2.0
3 Keymaster version 3.0
4 Keymaster version 4.0
41 Keymaster version 4.1
100 KeyMint version 1.0
200 KeyMint version 2.0
300 KeyMint version 3.0
400 KeyMint version 4.0
500 KeyMint version 5.0
keymasterSecurityLevel / keyMintSecurityLevel
The security level of the KeyMint or Keymaster implementation.
attestationChallenge
The challenge provided at key generation time.
uniqueId
A privacy-sensitive device identifier that system apps can request at key generation time. If the unique ID is not requested, this field is empty. For details, see the Unique ID section.
softwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the Android system. This information is collected or generated by code in the platform. It can be trusted as long as the device is running an operating system that complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
hardwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the device's Trusted Execution Environment (TEE) or StrongBox . This information is collected or generated by code in the secure hardware and is not controlled by the platform. For example, information can come from the bootloader or through a secure communication channel that does not involve trusting the platform.

SecurityLevel values

The SecurityLevel value indicates the extent to which a Keystore-related element (for example, key pair and attestation) is resilient to attack.

Ценить Значение
Software Secure as long as the device's Android system complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
TrustedEnvironment Secure as long as the TEE is not compromised. The isolation requirements for TEEs are defined in sections 9.11 [C-1-1] through [C-1-4] of the Android Compatibility Definition Document. TEEs are highly resistant to remote compromise and moderately resistant to compromise by direct hardware attack.
StrongBox Secure as long as StrongBox is not compromised. StrongBox is implemented in a secure element similar to a hardware security module. The implementation requirements for StrongBox are defined in section 9.11.2 of the Android Compatibility Definition Document. StrongBox is highly resistant to remote compromise and compromise by direct hardware attack (for example, physical tampering and side-channel attacks).

AuthorizationList fields

Each field corresponds to a Keymaster/KeyMint authorization tag from the AIDL interface specification . The specification is the source of truth about authorization tags: their meaning, the format of their contents, whether they are expected to appear in the softwareEnforced or hardwareEnforced fields in the KeyDescription object, whether they are mutually exclusive with other tags, etc. All AuthorizationList fields are optional.

Each field has an EXPLICIT context-specific tag equal to the KeyMint or Keymaster tag number, which enables a more compact representation of the data in the AuthorizationList . The ASN.1 parser must therefore know the expected data type for each context-specific tag. For example, Tag::USER_AUTH_TYPE is defined as ENUM | 504 . In the attestation extension schema, the purpose field in the AuthorizationList is specified as userAuthType [504] EXPLICIT INTEGER OPTIONAL . Its ASN.1 encoding will therefore contain the context-specific tag 504 instead of the UNIVERSAL class tag for the ASN.1 type INTEGER , which is 10 .

The following fields are present in attestations generated by KeyMint 5:
purpose
Corresponds to the Tag::PURPOSE authorization tag, which uses a tag ID value of 1.
algorithm

Corresponds to the Tag::ALGORITHM authorization tag, which uses a tag ID value of 2.

In an attestation AuthorizationList object, the algorithm value is always RSA , EC , or ML_DSA .

keySize
Corresponds to the Tag::KEY_SIZE authorization tag, which uses a tag ID value of 3.
blockMode
Corresponds to the Tag::BLOCK_MODE authorization tag, which uses a tag ID value of 4.
digest
Corresponds to the Tag::DIGEST authorization tag, which uses a tag ID value of 5.
padding
Corresponds to the Tag::PADDING authorization tag, which uses a tag ID value of 6.
callerNonce
Corresponds to the Tag::CALLER_NONCE authorization tag, which uses a tag ID value of 7. This tag is never present in attestations.
minMacLength
Corresponds to the Tag::MIN_MAC_LENGTH authorization tag, which uses a tag ID value of 8. This tag is never present in attestations.
ecCurve

Corresponds to the Tag::EC_CURVE authorization tag, which uses a tag ID value of 10.

The set of parameters used to generate an elliptic curve (EC) key pair, which uses ECDSA for signing and verification, within the Android system keystore.

mlDsaVariant

Present only in key attestation version >= 500.

Corresponds to the Tag::ML_DSA_VARIANT authorization tag, which uses a tag ID value of 11.

rsaPublicExponent
Corresponds to the Tag::RSA_PUBLIC_EXPONENT authorization tag, which uses a tag ID value of 200.
mgfDigest

Present only in key attestation version >= 100.

Corresponds to the Tag::RSA_OAEP_MGF_DIGEST KeyMint authorization tag, which uses a tag ID value of 203.
rollbackResistance

Present only in key attestation version >= 3.

Corresponds to the Tag::ROLLBACK_RESISTANCE authorization tag, which uses a tag ID value of 303.

earlyBootOnly

Present only in key attestation version >= 4.

Corresponds to the Tag::EARLY_BOOT_ONLY authorization tag, which uses a tag ID value of 305.

activeDateTime
Corresponds to the Tag::ACTIVE_DATETIME authorization tag, which uses a tag ID value of 400.
originationExpireDateTime
Corresponds to the Tag::ORIGINATION_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 401.
usageExpireDateTime
Corresponds to the Tag::USAGE_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 402.
usageCountLimit
Corresponds to the Tag::USAGE_COUNT_LIMIT authorization tag, which uses a tag ID value of 405.
userSecureId
Corresponds to the Tag::USER_SECURE_ID authorization tag, which uses a tag ID value of 502. This tag is never present in attestations.
noAuthRequired

Corresponds to the Tag::NO_AUTH_REQUIRED authorization tag, which uses a tag ID value of 503.

userAuthType
Corresponds to the Tag::USER_AUTH_TYPE authorization tag, which uses a tag ID value of 504.
authTimeout
Corresponds to the Tag::AUTH_TIMEOUT authorization tag, which uses a tag ID value of 505.
allowWhileOnBody

Corresponds to the Tag::ALLOW_WHILE_ON_BODY authorization tag, which uses a tag ID value of 506.

Allows the key to be used after its authentication timeout period if the user is still wearing the device on their body. Note that a secure on-body sensor determines whether the device is being worn on the user's body.

trustedUserPresenceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_USER_PRESENCE_REQUIRED authorization tag, which uses a tag ID value of 507.

Specifies that this key is usable only if the user has provided proof of physical presence. Several examples include the following:

  • For a StrongBox key, a hardware button hardwired to a pin on the StrongBox device.
  • For a TEE key, fingerprint authentication provides proof of presence as long as the TEE has exclusive control of the scanner and performs the fingerprint matching process.
trustedConfirmationReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_CONFIRMATION_REQUIRED authorization tag, which uses a tag ID value of 508.

Specifies that the key is usable only if the user provides confirmation of the data to be signed using an approval token. For more information about how to obtain user confirmation, see Android Protected Confirmation .

Note: This tag is only applicable to keys that use the SIGN purpose.

unlockedDeviceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::UNLOCKED_DEVICE_REQUIRED authorization tag, which uses a tag ID value of 509.

creationDateTime
Corresponds to the Tag::CREATION_DATETIME authorization tag, which uses a tag ID value of 701.
origin

Corresponds to the Tag::ORIGIN authorization tag, which uses a tag ID value of 702.

rootOfTrust

Corresponds to the Tag::ROOT_OF_TRUST authorization tag, which uses a tag ID value of 704.

For more details, see the section describing the RootOfTrust data structure.

osVersion

Corresponds to the Tag::OS_VERSION authorization tag, which uses a tag ID value of 705.

The version of the Android operating system associated with the Keymaster, specified as a six-digit integer. For example, version 8.1.0 is represented as 080100.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

osPatchLevel

Corresponds to the Tag::OS_PATCHLEVEL authorization tag, which uses a tag ID value of 706.

The month and year associated with the security patch that is being used within KeyMint (previously Keymaster), specified as a six-digit integer. For example, the August 2018 patch is represented as 201808.

Prefer using this field over vendorPatchLevel or bootPatchLevel for checking whether a device has been recently patched.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

attestationApplicationId

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_APPLICATION_ID authorization tag, which uses a tag ID value of 709.

For more details, see the section describing the AttestationApplicationId data structure.

attestationIdBrand

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_BRAND authorization tag, which uses a tag ID value of 710.

attestationIdDevice

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_DEVICE authorization tag, which uses a tag ID value of 711.

attestationIdProduct

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_PRODUCT authorization tag, which uses a tag ID value of 712.

attestationIdSerial

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_SERIAL authorization tag, which uses a tag ID value of 713.

attestationIdImei

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_IMEI authorization tag, which uses a tag ID value of 714.

attestationIdMeid

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MEID authorization tag, which uses a tag ID value of 715.

attestationIdManufacturer

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MANUFACTURER authorization tag, which uses a tag ID value of 716.

attestationIdModel

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MODEL authorization tag, which uses a tag ID value of 717.

vendorPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::VENDOR_PATCHLEVEL authorization tag, which uses a tag ID value of 718.

Specifies the vendor image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the vendor's 2018-08-05 security patch installed, this value would be 20180805.

bootPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::BOOT_PATCHLEVEL authorization tag, which uses a tag ID value of 719.

Specifies the kernel image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the kernel's 2018-08-05 security patch installed, this value would be 20180805.

deviceUniqueAttestation

Present only in key attestation versions >= 4.

Corresponds to the Tag::DEVICE_UNIQUE_ATTESTATION authorization tag, which uses a tag ID value of 720.

attestationIdSecondImei

Present only in key attestation versions >= 300.

Corresponds to the Tag::ATTESTATION_ID_SECOND_IMEI authorization tag, which uses a tag ID value of 723.

moduleHash

Present only in key attestation versions >= 400.

Corresponds to the Tag::MODULE_HASH authorization tag, which uses a tag ID value of 724.

RootOfTrust fields

verifiedBootKey
A secure hash of the public key used to verify the integrity and authenticity of all code that executes during device boot up as part of Verified Boot . SHA-256 is recommended.
deviceLocked
Whether the device's bootloader is locked. true means that the device booted a signed image that was successfully verified by Verified Boot .
verifiedBootState
The device's Verified Boot state .
verifiedBootHash
A digest of all data protected by Verified Boot . For devices that use the Android Verified Boot reference implementation, this field contains the VBMeta digest .

VerifiedBootState values

Ценить Corresponding boot state Значение
Verified GREEN A full chain of trust extends from a hardware-protected root of trust to the bootloader and all partitions verified by Verified Boot . In this state, the verifiedBootKey field contains the hash of the embedded root of trust , which is the certificate embedded in the device's ROM by the device manufacturer in the factory.
SelfSigned YELLOW Same as Verified , except that the verification was done using a root of trust configured by the user instead of the root of trust embedded by the manufacturer in the factory. In this state, the verifiedBootKey field contains the hash of the public key configured by the user.
Unverified ORANGE The device's bootloader is unlocked, so a chain of trust cannot be established. The device can be freely modified, so the device's integrity must be verified by the user out-of-band. In this state the verifiedBootKey field contains 32 bytes of zeroes.
Failed RED The device failed verification. In this state, there are no guarantees about the contents of the other RootOfTrust fields.

AttestationApplicationId

This field reflects the Android platform's belief as to which apps are allowed to use the secret key material under attestation. It can contain multiple packages if and only if multiple packages share the same UID. The AttestationApplicationId field in AuthorizationList is of type OCTET_STRING and is formatted according to the following ASN.1 schema: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
A set of AttestationPackageInfo objects, each providing a package's name and version number.
signature_digests

A set of SHA-256 digests of the app's signing certificates. An app can have multiple signing key certificate chains. For each, the "leaf" certificate is digested and placed in the signature_digests field. The field name is misleading, since the digested data is the app's signing certificates, not the app signatures, because it is named for the Signature class returned by a call to getPackageInfo() . The following code snippet shows an example set: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Provisioning information extension

The provisioning information extension has OID 1.3.6.1.4.1.11129.2.1.30 . The extension provides information that's known about the device by the provisioning server.

Схема

The extension value consists of Concise Binary Object Representation (CBOR) data that conforms to this Concise Data Definition Language (CDDL) schema: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

The map is unversioned and new optional fields may be added.

certs_issued

An approximate number of certificates issued to the device in the last 30 days. This value can be used as a signal for potential abuse if the value is greater than average by some orders of magnitude.

validated_attested_entity

A string indicating the certified origin of the attested key, directly vouched for by the chipset manufacturer. For example, STRONG_BOX or TEE .

is_lost_device

A boolean indicating whether the device has been reported as lost. If present and true, the certificate was provisioned for a device currently marked as lost.

Attestation keys

Two keys, one RSA and one ECDSA, and the corresponding certificate chains, are securely provisioned into the device.

Android 12 introduces Remote Key Provisioning . This feature provides devices in the field with per-app ECDSA P-256 attestation certificates, which are shorter-lived than factory-provisioned certificates.

Уникальный идентификатор

The Unique ID is a 128-bit value that identifies the device, but only for a limited period of time. The value is computed with: 

HMAC_SHA256(T || C || R, HBK)

Где:

  • T is the "temporal counter value", computed by dividing the value of Tag::CREATION_DATETIME by 2592000000, dropping any remainder. T changes every 30 days (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C is the value of Tag::APPLICATION_ID
  • R is 1 if Tag::RESET_SINCE_ID_ROTATION is present in the attest_params parameter to the attest_key call, or 0 if the tag is not present.
  • HBK is a unique hardware-bound secret known to the Trusted Execution Environment and never revealed by it. The secret contains at least 128 bits of entropy and is unique to the individual device (probabilistic uniqueness is acceptable given the 128 bits of entropy). HBK should be derived from fused key material via HMAC or AES_CMAC.

Truncate the HMAC_SHA256 output to 128 bits.

Multiple IMEIs

Android 14 adds support for multiple IMEIs in the Android Key Attestation record. OEMs can implement this feature by adding a KeyMint tag for a second IMEI. It is becoming increasingly common for devices to have multiple cellular radios and OEMs can now support devices with two IMEIs.

OEMs are required to have a secondary IMEI, if present on their devices, to be provisioned to the KeyMint implementation(s) so that those implementations can attest to it in the same way they attest to the first IMEI.

ID attestation

Android 8.0 includes optional support for ID attestation for devices with Keymaster 3. ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. Although an optional feature, it is highly recommended that all Keymaster 3 implementations provide support for it because being able to prove the device's identity enables use cases such as true zero-touch remote configuration to be more secure (because the remote side can be certain it is talking to the right device, not a device spoofing its identity).

ID attestation works by creating copies of the device's hardware identifiers that only the TEE can access before the device leaves the factory. A user can unlock the device's bootloader and change the system software and the identifiers reported by the Android frameworks. The copies of the identifiers held by the TEE cannot be manipulated in this way, ensuring that device ID attestation only attests to the device's original hardware identifiers, thereby thwarting spoofing attempts.

The main API surface for ID attestation builds on top of the existing key attestation mechanism introduced with Keymaster 2. When requesting an attestation certificate for a key held by Keymaster, the caller can request that the device's hardware identifiers be included in the attestation certificate's metadata. If the key is held in the TEE, the certificate chains back to a known root of trust. The recipient of such a certificate can verify that the certificate and its contents, including the hardware identifiers, were written by the TEE. When asked to include hardware identifiers in the attestation certificate, the TEE attests only to the identifiers held in its storage, as populated on the factory floor.

Storage properties

The storage that holds the device's identifiers needs to have these properties:

  • The values derived from the device's original identifiers are copied to the storage before the device leaves the factory.
  • The destroyAttestationIds() method can permanently destroy this copy of the identifier-derived data. Permanent destruction means the data is completely removed so neither a factory reset nor any other procedure performed on the device can restore it. This is especially important for devices where a user has unlocked the bootloader and changed the system software and modified the identifiers returned by Android frameworks.
  • RMA facilities should have the ability to generate fresh copies of the hardware identifier-derived data. This way, a device that passes through RMA can perform ID attestation again. The mechanism used by RMA facilities must be protected so that users cannot invoke it themselves, as that would allow them to obtain attestations of spoofed IDs.
  • No code other than Keymaster trusted app in the TEE is able to read the identifier-derived data kept in the storage.
  • The storage is tamper-evident: If the content of the storage has been modified, the TEE treats it the same as if the copies of the content had been destroyed and refuses all ID attestation attempts. This is implemented by signing or MACing the storage as described below .
  • The storage does not hold the original identifiers. Because ID attestation involves a challenge, the caller always supplies the identifiers to be attested. The TEE only needs to verify that these match the values they originally had. Storing secure hashes of the original values rather than the values enables this verification.

Строительство

To create an implementation that has the properties listed above, store the ID-derived values in the following construction S. Do not store other copies of the ID values, excepting the normal places in the system, which a device owner can modify by rooting: 

S = D || HMAC(HBK, D)

где:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC is the HMAC construction with an appropriate secure hash (SHA-256 recommended)
  • HBK is a hardware-bound key not used for any other purpose
  • ID 1 ...ID n are the original ID values; association of a particular value to a particular index is implementation-dependent, as different devices have different numbers of identifiers
  • || represents concatenation

Because the HMAC outputs are fixed size, no headers or other structure are required to be able to find individual ID hashes, or the HMAC of D. In addition to checking provided values to perform attestation, implementations need to validate S by extracting D from S, computing HMAC(HBK, D) and comparing it to the value in S to verify that no individual IDs were modified/corrupted. Also, implementations must use constant-time comparisons for all individual ID elements and the validation of S. Comparison time must be constant regardless of the number of IDs provided and the correct matching of any part of the test.

Hardware identifiers

ID attestation supports the following hardware identifiers:

  1. Brand name, as returned by Build.BRAND in Android
  2. Device name, as returned by Build.DEVICE in Android
  3. Product name, as returned by Build.PRODUCT in Android
  4. Manufacturer name, as returned by Build.MANUFACTURER in Android
  5. Model name, as returned by Build.MODEL in Android
  6. Серийный номер
  7. IMEIs of all radios
  8. MEIDs of all radios

To support device ID attestation, a device attests to these identifiers. All devices running Android have the first six and they are necessary for this feature to work. If the device has any integrated cellular radios, the device must also support attestation for the IMEIs and/or MEIDs of the radios.

ID attestation is requested by performing a key attestation and including the device identifiers to attest in the request. The identifiers are tagged as:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

The identifier to attest is a UTF-8 encoded byte string. This format applies to numerical identifiers, as well. Each identifier to attest is expressed as a UTF-8 encoded string.

If the device does not support ID attestation (or destroyAttestationIds() was previously called and the device can no longer attest its IDs), any key attestation request that includes one or more of these tags fails with ErrorCode::CANNOT_ATTEST_IDS .

If the device supports ID attestation and one or more of the above tags have been included in a key attestation request, the TEE verifies the identifier supplied with each of the tags matches its copy of the hardware identifiers. If one or more identifiers do not match, the entire attestation fails with ErrorCode::CANNOT_ATTEST_IDS . It is valid for the same tag to be supplied multiple times. This can be useful, for example, when attesting IMEIs: A device can have multiple radios with multiple IMEIs. An attestation request is valid if the value supplied with each ATTESTATION_ID_IMEI matches one of the device's radios. The same applies to all other tags.

If attestation is successful, the attested IDs is added to the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) of the issued attestation certificate, using the schema from above . Changes from the Keymaster 2 attestation schema are bolded , with comments.

Java API

This section is informational only. Keymaster implementers neither implement nor use the Java API. This is provided to help implementers understand how the feature is used by apps. System components might use it differently, which is why it's crucial this section not be treated as normative.

,

Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and KeyMint (previously Keymaster) enforces restrictions that are difficult to subvert.

However, this is true only if the Keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available Keymaster hardware abstraction layer (HAL) and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, key attestation was introduced in Android 7.0 (Keymaster 2) and ID attestation was introduced in Android 8.0 (Keymaster 3).

Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Key attestation

To support key attestation, Android 7.0 introduced a set of tags, type, and method to the HAL.

Теги

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

Тип

Keymaster 2 and below

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

AttestKey method

Keymaster 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 and below

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev is the Keymaster device structure.
  • keyToAttest is the key blob returned from generateKey for which the attestation is created.
  • attestParams is a list of any parameters necessary for attestation. This includes Tag::ATTESTATION_CHALLENGE and possibly Tag::RESET_SINCE_ID_ROTATION , as well as Tag::APPLICATION_ID and Tag::APPLICATION_DATA . The latter two are necessary to decrypt the key blob if they were specified during key generation.
  • certChain is the output parameter, which returns an array of certificates. Entry 0 is the attestation certificate, meaning it certifies the key from keyToAttest and contains the attestation extension.

The attestKey method is considered a public key operation on the attested key, because it can be called at any time and doesn't need to meet authorization constraints. For example, if the attested key needs user authentication for use, an attestation can be generated without user authentication.

Attestation certificate

The attestation certificate is a standard X.509 certificate, with an optional attestation extension that contains a description of the attested key. The certificate is signed with a certified attestation key . The attestation key might use a different algorithm than the key being attested.

The attestation certificate contains the fields in the table below and can't contain any additional fields. Some fields specify a fixed field value. CTS tests validate that the certificate content is exactly as defined.

Certificate SEQUENCE

Field name (see RFC 5280 ) Ценить
tbsCertificate TBSCertificate SEQUENCE
signatureAlgorithm AlgorithmIdentifier of algorithm used to sign key:
ECDSA for EC keys, RSA for RSA keys.
signatureValue BIT STRING, signature computed on ASN.1 DER-encoded tbsCertificate.

TBSCertificate SEQUENCE

Field name (see RFC 5280 ) Ценить
version INTEGER 2 (means v3 certificate)
serialNumber INTEGER 1 (fixed value: same on all certs)
signature AlgorithmIdentifier of algorithm used to sign key: ECDSA for EC keys, RSA for RSA keys.
issuer Same as the subject field of the batch attestation key.
validity SEQUENCE of two dates, containing the values of Tag::ACTIVE_DATETIME and Tag::USAGE_EXPIRE_DATETIME . Those values are in milliseconds since Jan 1, 1970. See RFC 5280 for correct date representations in certificates.
If Tag::ACTIVE_DATETIME is not present, use the value of Tag::CREATION_DATETIME . If Tag::USAGE_EXPIRE_DATETIME is not present, use the expiration date of the batch attestation key certificate.
subject CN = "Android Keystore Key" (fixed value: same on all certs)
subjectPublicKeyInfo SubjectPublicKeyInfo containing attested public key.
extensions/Key Usage digitalSignature: set if key has purpose KeyPurpose::SIGN or KeyPurpose::VERIFY . All other bits unset.
extensions/CRL Distribution Points Value TBD
extensions/"attestation" The OID is 1.3.6.1.4.1.11129.2.1.17; the content is defined in the Attestation extension section below. As with all X.509 certificate extensions, the content is represented as an OCTET_STRING containing a DER encoding of the attestation SEQUENCE.

Attestation extension

The attestation extension has OID 1.3.6.1.4.1.11129.2.1.17 . It contains information about the key pair being attested and the state of the device at key generation time.

The Keymaster/KeyMint tag types defined in the AIDL interface specification are translated to ASN.1 types as follows:

KeyMint or Keymaster type ASN.1 type Примечания
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Milliseconds since Jan 1, 1970 00:00:00 GMT.
BOOL NULL Tag presence means true, absence means false.
BIGNUM No tags have this type, so no mapping is defined.
BYTES OCTET_STRING

Схема

The attestation extension content is described by the following ASN.1 schema. The ASN.1 schema for the AuthorizationList is also used to import encrypted keys . Any fields which will not appear in the attestation extension are noted as such.

Версия 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 300 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 100 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 4 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Версия 2 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

Версия 1 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

KeyDescription fields

attestationVersion
The ASN.1 schema version.
Ценить KeyMint or Keymaster version
1 Keymaster version 2.0
2 Keymaster version 3.0
3 Keymaster version 4.0
4 Keymaster version 4.1
100 KeyMint version 1.0
200 KeyMint version 2.0
300 KeyMint version 3.0
400 KeyMint version 4.0
500 KeyMint version 5.0
attestationSecurityLevel

The security level of the location where the attested key is stored.

keymasterVersion / keyMintVersion
The version of the KeyMint or Keymaster HAL implementation.
Ценить KeyMint or Keymaster version
2 Keymaster version 2.0
3 Keymaster version 3.0
4 Keymaster version 4.0
41 Keymaster version 4.1
100 KeyMint version 1.0
200 KeyMint version 2.0
300 KeyMint version 3.0
400 KeyMint version 4.0
500 KeyMint version 5.0
keymasterSecurityLevel / keyMintSecurityLevel
The security level of the KeyMint or Keymaster implementation.
attestationChallenge
The challenge provided at key generation time.
uniqueId
A privacy-sensitive device identifier that system apps can request at key generation time. If the unique ID is not requested, this field is empty. For details, see the Unique ID section.
softwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the Android system. This information is collected or generated by code in the platform. It can be trusted as long as the device is running an operating system that complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
hardwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the device's Trusted Execution Environment (TEE) or StrongBox . This information is collected or generated by code in the secure hardware and is not controlled by the platform. For example, information can come from the bootloader or through a secure communication channel that does not involve trusting the platform.

SecurityLevel values

The SecurityLevel value indicates the extent to which a Keystore-related element (for example, key pair and attestation) is resilient to attack.

Ценить Значение
Software Secure as long as the device's Android system complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
TrustedEnvironment Secure as long as the TEE is not compromised. The isolation requirements for TEEs are defined in sections 9.11 [C-1-1] through [C-1-4] of the Android Compatibility Definition Document. TEEs are highly resistant to remote compromise and moderately resistant to compromise by direct hardware attack.
StrongBox Secure as long as StrongBox is not compromised. StrongBox is implemented in a secure element similar to a hardware security module. The implementation requirements for StrongBox are defined in section 9.11.2 of the Android Compatibility Definition Document. StrongBox is highly resistant to remote compromise and compromise by direct hardware attack (for example, physical tampering and side-channel attacks).

AuthorizationList fields

Each field corresponds to a Keymaster/KeyMint authorization tag from the AIDL interface specification . The specification is the source of truth about authorization tags: their meaning, the format of their contents, whether they are expected to appear in the softwareEnforced or hardwareEnforced fields in the KeyDescription object, whether they are mutually exclusive with other tags, etc. All AuthorizationList fields are optional.

Each field has an EXPLICIT context-specific tag equal to the KeyMint or Keymaster tag number, which enables a more compact representation of the data in the AuthorizationList . The ASN.1 parser must therefore know the expected data type for each context-specific tag. For example, Tag::USER_AUTH_TYPE is defined as ENUM | 504 . In the attestation extension schema, the purpose field in the AuthorizationList is specified as userAuthType [504] EXPLICIT INTEGER OPTIONAL . Its ASN.1 encoding will therefore contain the context-specific tag 504 instead of the UNIVERSAL class tag for the ASN.1 type INTEGER , which is 10 .

The following fields are present in attestations generated by KeyMint 5:
purpose
Corresponds to the Tag::PURPOSE authorization tag, which uses a tag ID value of 1.
algorithm

Corresponds to the Tag::ALGORITHM authorization tag, which uses a tag ID value of 2.

In an attestation AuthorizationList object, the algorithm value is always RSA , EC , or ML_DSA .

keySize
Corresponds to the Tag::KEY_SIZE authorization tag, which uses a tag ID value of 3.
blockMode
Corresponds to the Tag::BLOCK_MODE authorization tag, which uses a tag ID value of 4.
digest
Corresponds to the Tag::DIGEST authorization tag, which uses a tag ID value of 5.
padding
Corresponds to the Tag::PADDING authorization tag, which uses a tag ID value of 6.
callerNonce
Corresponds to the Tag::CALLER_NONCE authorization tag, which uses a tag ID value of 7. This tag is never present in attestations.
minMacLength
Corresponds to the Tag::MIN_MAC_LENGTH authorization tag, which uses a tag ID value of 8. This tag is never present in attestations.
ecCurve

Corresponds to the Tag::EC_CURVE authorization tag, which uses a tag ID value of 10.

The set of parameters used to generate an elliptic curve (EC) key pair, which uses ECDSA for signing and verification, within the Android system keystore.

mlDsaVariant

Present only in key attestation version >= 500.

Corresponds to the Tag::ML_DSA_VARIANT authorization tag, which uses a tag ID value of 11.

rsaPublicExponent
Corresponds to the Tag::RSA_PUBLIC_EXPONENT authorization tag, which uses a tag ID value of 200.
mgfDigest

Present only in key attestation version >= 100.

Corresponds to the Tag::RSA_OAEP_MGF_DIGEST KeyMint authorization tag, which uses a tag ID value of 203.
rollbackResistance

Present only in key attestation version >= 3.

Corresponds to the Tag::ROLLBACK_RESISTANCE authorization tag, which uses a tag ID value of 303.

earlyBootOnly

Present only in key attestation version >= 4.

Corresponds to the Tag::EARLY_BOOT_ONLY authorization tag, which uses a tag ID value of 305.

activeDateTime
Corresponds to the Tag::ACTIVE_DATETIME authorization tag, which uses a tag ID value of 400.
originationExpireDateTime
Corresponds to the Tag::ORIGINATION_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 401.
usageExpireDateTime
Corresponds to the Tag::USAGE_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 402.
usageCountLimit
Corresponds to the Tag::USAGE_COUNT_LIMIT authorization tag, which uses a tag ID value of 405.
userSecureId
Corresponds to the Tag::USER_SECURE_ID authorization tag, which uses a tag ID value of 502. This tag is never present in attestations.
noAuthRequired

Corresponds to the Tag::NO_AUTH_REQUIRED authorization tag, which uses a tag ID value of 503.

userAuthType
Corresponds to the Tag::USER_AUTH_TYPE authorization tag, which uses a tag ID value of 504.
authTimeout
Corresponds to the Tag::AUTH_TIMEOUT authorization tag, which uses a tag ID value of 505.
allowWhileOnBody

Corresponds to the Tag::ALLOW_WHILE_ON_BODY authorization tag, which uses a tag ID value of 506.

Allows the key to be used after its authentication timeout period if the user is still wearing the device on their body. Note that a secure on-body sensor determines whether the device is being worn on the user's body.

trustedUserPresenceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_USER_PRESENCE_REQUIRED authorization tag, which uses a tag ID value of 507.

Specifies that this key is usable only if the user has provided proof of physical presence. Several examples include the following:

  • For a StrongBox key, a hardware button hardwired to a pin on the StrongBox device.
  • For a TEE key, fingerprint authentication provides proof of presence as long as the TEE has exclusive control of the scanner and performs the fingerprint matching process.
trustedConfirmationReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_CONFIRMATION_REQUIRED authorization tag, which uses a tag ID value of 508.

Specifies that the key is usable only if the user provides confirmation of the data to be signed using an approval token. For more information about how to obtain user confirmation, see Android Protected Confirmation .

Note: This tag is only applicable to keys that use the SIGN purpose.

unlockedDeviceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::UNLOCKED_DEVICE_REQUIRED authorization tag, which uses a tag ID value of 509.

creationDateTime
Corresponds to the Tag::CREATION_DATETIME authorization tag, which uses a tag ID value of 701.
origin

Corresponds to the Tag::ORIGIN authorization tag, which uses a tag ID value of 702.

rootOfTrust

Corresponds to the Tag::ROOT_OF_TRUST authorization tag, which uses a tag ID value of 704.

For more details, see the section describing the RootOfTrust data structure.

osVersion

Corresponds to the Tag::OS_VERSION authorization tag, which uses a tag ID value of 705.

The version of the Android operating system associated with the Keymaster, specified as a six-digit integer. For example, version 8.1.0 is represented as 080100.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

osPatchLevel

Corresponds to the Tag::OS_PATCHLEVEL authorization tag, which uses a tag ID value of 706.

The month and year associated with the security patch that is being used within KeyMint (previously Keymaster), specified as a six-digit integer. For example, the August 2018 patch is represented as 201808.

Prefer using this field over vendorPatchLevel or bootPatchLevel for checking whether a device has been recently patched.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

attestationApplicationId

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_APPLICATION_ID authorization tag, which uses a tag ID value of 709.

For more details, see the section describing the AttestationApplicationId data structure.

attestationIdBrand

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_BRAND authorization tag, which uses a tag ID value of 710.

attestationIdDevice

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_DEVICE authorization tag, which uses a tag ID value of 711.

attestationIdProduct

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_PRODUCT authorization tag, which uses a tag ID value of 712.

attestationIdSerial

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_SERIAL authorization tag, which uses a tag ID value of 713.

attestationIdImei

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_IMEI authorization tag, which uses a tag ID value of 714.

attestationIdMeid

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MEID authorization tag, which uses a tag ID value of 715.

attestationIdManufacturer

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MANUFACTURER authorization tag, which uses a tag ID value of 716.

attestationIdModel

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MODEL authorization tag, which uses a tag ID value of 717.

vendorPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::VENDOR_PATCHLEVEL authorization tag, which uses a tag ID value of 718.

Specifies the vendor image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the vendor's 2018-08-05 security patch installed, this value would be 20180805.

bootPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::BOOT_PATCHLEVEL authorization tag, which uses a tag ID value of 719.

Specifies the kernel image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the kernel's 2018-08-05 security patch installed, this value would be 20180805.

deviceUniqueAttestation

Present only in key attestation versions >= 4.

Corresponds to the Tag::DEVICE_UNIQUE_ATTESTATION authorization tag, which uses a tag ID value of 720.

attestationIdSecondImei

Present only in key attestation versions >= 300.

Corresponds to the Tag::ATTESTATION_ID_SECOND_IMEI authorization tag, which uses a tag ID value of 723.

moduleHash

Present only in key attestation versions >= 400.

Corresponds to the Tag::MODULE_HASH authorization tag, which uses a tag ID value of 724.

RootOfTrust fields

verifiedBootKey
A secure hash of the public key used to verify the integrity and authenticity of all code that executes during device boot up as part of Verified Boot . SHA-256 is recommended.
deviceLocked
Whether the device's bootloader is locked. true means that the device booted a signed image that was successfully verified by Verified Boot .
verifiedBootState
The device's Verified Boot state .
verifiedBootHash
A digest of all data protected by Verified Boot . For devices that use the Android Verified Boot reference implementation, this field contains the VBMeta digest .

VerifiedBootState values

Ценить Corresponding boot state Значение
Verified GREEN A full chain of trust extends from a hardware-protected root of trust to the bootloader and all partitions verified by Verified Boot . In this state, the verifiedBootKey field contains the hash of the embedded root of trust , which is the certificate embedded in the device's ROM by the device manufacturer in the factory.
SelfSigned YELLOW Same as Verified , except that the verification was done using a root of trust configured by the user instead of the root of trust embedded by the manufacturer in the factory. In this state, the verifiedBootKey field contains the hash of the public key configured by the user.
Unverified ORANGE The device's bootloader is unlocked, so a chain of trust cannot be established. The device can be freely modified, so the device's integrity must be verified by the user out-of-band. In this state the verifiedBootKey field contains 32 bytes of zeroes.
Failed RED The device failed verification. In this state, there are no guarantees about the contents of the other RootOfTrust fields.

AttestationApplicationId

This field reflects the Android platform's belief as to which apps are allowed to use the secret key material under attestation. It can contain multiple packages if and only if multiple packages share the same UID. The AttestationApplicationId field in AuthorizationList is of type OCTET_STRING and is formatted according to the following ASN.1 schema: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
A set of AttestationPackageInfo objects, each providing a package's name and version number.
signature_digests

A set of SHA-256 digests of the app's signing certificates. An app can have multiple signing key certificate chains. For each, the "leaf" certificate is digested and placed in the signature_digests field. The field name is misleading, since the digested data is the app's signing certificates, not the app signatures, because it is named for the Signature class returned by a call to getPackageInfo() . The following code snippet shows an example set: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Provisioning information extension

The provisioning information extension has OID 1.3.6.1.4.1.11129.2.1.30 . The extension provides information that's known about the device by the provisioning server.

Схема

The extension value consists of Concise Binary Object Representation (CBOR) data that conforms to this Concise Data Definition Language (CDDL) schema: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

The map is unversioned and new optional fields may be added.

certs_issued

An approximate number of certificates issued to the device in the last 30 days. This value can be used as a signal for potential abuse if the value is greater than average by some orders of magnitude.

validated_attested_entity

A string indicating the certified origin of the attested key, directly vouched for by the chipset manufacturer. For example, STRONG_BOX or TEE .

is_lost_device

A boolean indicating whether the device has been reported as lost. If present and true, the certificate was provisioned for a device currently marked as lost.

Attestation keys

Two keys, one RSA and one ECDSA, and the corresponding certificate chains, are securely provisioned into the device.

Android 12 introduces Remote Key Provisioning . This feature provides devices in the field with per-app ECDSA P-256 attestation certificates, which are shorter-lived than factory-provisioned certificates.

Уникальный идентификатор

The Unique ID is a 128-bit value that identifies the device, but only for a limited period of time. The value is computed with: 

HMAC_SHA256(T || C || R, HBK)

Где:

  • T is the "temporal counter value", computed by dividing the value of Tag::CREATION_DATETIME by 2592000000, dropping any remainder. T changes every 30 days (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C is the value of Tag::APPLICATION_ID
  • R is 1 if Tag::RESET_SINCE_ID_ROTATION is present in the attest_params parameter to the attest_key call, or 0 if the tag is not present.
  • HBK is a unique hardware-bound secret known to the Trusted Execution Environment and never revealed by it. The secret contains at least 128 bits of entropy and is unique to the individual device (probabilistic uniqueness is acceptable given the 128 bits of entropy). HBK should be derived from fused key material via HMAC or AES_CMAC.

Truncate the HMAC_SHA256 output to 128 bits.

Multiple IMEIs

Android 14 adds support for multiple IMEIs in the Android Key Attestation record. OEMs can implement this feature by adding a KeyMint tag for a second IMEI. It is becoming increasingly common for devices to have multiple cellular radios and OEMs can now support devices with two IMEIs.

OEMs are required to have a secondary IMEI, if present on their devices, to be provisioned to the KeyMint implementation(s) so that those implementations can attest to it in the same way they attest to the first IMEI.

ID attestation

Android 8.0 includes optional support for ID attestation for devices with Keymaster 3. ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. Although an optional feature, it is highly recommended that all Keymaster 3 implementations provide support for it because being able to prove the device's identity enables use cases such as true zero-touch remote configuration to be more secure (because the remote side can be certain it is talking to the right device, not a device spoofing its identity).

ID attestation works by creating copies of the device's hardware identifiers that only the TEE can access before the device leaves the factory. A user can unlock the device's bootloader and change the system software and the identifiers reported by the Android frameworks. The copies of the identifiers held by the TEE cannot be manipulated in this way, ensuring that device ID attestation only attests to the device's original hardware identifiers, thereby thwarting spoofing attempts.

The main API surface for ID attestation builds on top of the existing key attestation mechanism introduced with Keymaster 2. When requesting an attestation certificate for a key held by Keymaster, the caller can request that the device's hardware identifiers be included in the attestation certificate's metadata. If the key is held in the TEE, the certificate chains back to a known root of trust. The recipient of such a certificate can verify that the certificate and its contents, including the hardware identifiers, were written by the TEE. When asked to include hardware identifiers in the attestation certificate, the TEE attests only to the identifiers held in its storage, as populated on the factory floor.

Storage properties

The storage that holds the device's identifiers needs to have these properties:

  • The values derived from the device's original identifiers are copied to the storage before the device leaves the factory.
  • The destroyAttestationIds() method can permanently destroy this copy of the identifier-derived data. Permanent destruction means the data is completely removed so neither a factory reset nor any other procedure performed on the device can restore it. This is especially important for devices where a user has unlocked the bootloader and changed the system software and modified the identifiers returned by Android frameworks.
  • RMA facilities should have the ability to generate fresh copies of the hardware identifier-derived data. This way, a device that passes through RMA can perform ID attestation again. The mechanism used by RMA facilities must be protected so that users cannot invoke it themselves, as that would allow them to obtain attestations of spoofed IDs.
  • No code other than Keymaster trusted app in the TEE is able to read the identifier-derived data kept in the storage.
  • The storage is tamper-evident: If the content of the storage has been modified, the TEE treats it the same as if the copies of the content had been destroyed and refuses all ID attestation attempts. This is implemented by signing or MACing the storage as described below .
  • The storage does not hold the original identifiers. Because ID attestation involves a challenge, the caller always supplies the identifiers to be attested. The TEE only needs to verify that these match the values they originally had. Storing secure hashes of the original values rather than the values enables this verification.

Строительство

To create an implementation that has the properties listed above, store the ID-derived values in the following construction S. Do not store other copies of the ID values, excepting the normal places in the system, which a device owner can modify by rooting: 

S = D || HMAC(HBK, D)

где:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC is the HMAC construction with an appropriate secure hash (SHA-256 recommended)
  • HBK is a hardware-bound key not used for any other purpose
  • ID 1 ...ID n are the original ID values; association of a particular value to a particular index is implementation-dependent, as different devices have different numbers of identifiers
  • || represents concatenation

Because the HMAC outputs are fixed size, no headers or other structure are required to be able to find individual ID hashes, or the HMAC of D. In addition to checking provided values to perform attestation, implementations need to validate S by extracting D from S, computing HMAC(HBK, D) and comparing it to the value in S to verify that no individual IDs were modified/corrupted. Also, implementations must use constant-time comparisons for all individual ID elements and the validation of S. Comparison time must be constant regardless of the number of IDs provided and the correct matching of any part of the test.

Hardware identifiers

ID attestation supports the following hardware identifiers:

  1. Brand name, as returned by Build.BRAND in Android
  2. Device name, as returned by Build.DEVICE in Android
  3. Product name, as returned by Build.PRODUCT in Android
  4. Manufacturer name, as returned by Build.MANUFACTURER in Android
  5. Model name, as returned by Build.MODEL in Android
  6. Серийный номер
  7. IMEIs of all radios
  8. MEIDs of all radios

To support device ID attestation, a device attests to these identifiers. All devices running Android have the first six and they are necessary for this feature to work. If the device has any integrated cellular radios, the device must also support attestation for the IMEIs and/or MEIDs of the radios.

ID attestation is requested by performing a key attestation and including the device identifiers to attest in the request. The identifiers are tagged as:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

The identifier to attest is a UTF-8 encoded byte string. This format applies to numerical identifiers, as well. Each identifier to attest is expressed as a UTF-8 encoded string.

If the device does not support ID attestation (or destroyAttestationIds() was previously called and the device can no longer attest its IDs), any key attestation request that includes one or more of these tags fails with ErrorCode::CANNOT_ATTEST_IDS .

If the device supports ID attestation and one or more of the above tags have been included in a key attestation request, the TEE verifies the identifier supplied with each of the tags matches its copy of the hardware identifiers. If one or more identifiers do not match, the entire attestation fails with ErrorCode::CANNOT_ATTEST_IDS . It is valid for the same tag to be supplied multiple times. This can be useful, for example, when attesting IMEIs: A device can have multiple radios with multiple IMEIs. An attestation request is valid if the value supplied with each ATTESTATION_ID_IMEI matches one of the device's radios. The same applies to all other tags.

If attestation is successful, the attested IDs is added to the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) of the issued attestation certificate, using the schema from above . Changes from the Keymaster 2 attestation schema are bolded , with comments.

Java API

This section is informational only. Keymaster implementers neither implement nor use the Java API. This is provided to help implementers understand how the feature is used by apps. System components might use it differently, which is why it's crucial this section not be treated as normative.