گواهی کلید و شناسه، گواهی کلید و شناسه

کی‌استور (Keystore) مکانی امن‌تر برای ایجاد، ذخیره و استفاده از کلیدهای رمزنگاری به روشی کنترل‌شده فراهم می‌کند. هنگامی که ذخیره‌سازی کلید با پشتیبانی سخت‌افزاری در دسترس و مورد استفاده قرار می‌گیرد، محتوای کلید در برابر استخراج از دستگاه ایمن‌تر است و کی‌مینت (که قبلاً کی‌مستر (Keymaster) نام داشت) محدودیت‌هایی را اعمال می‌کند که دور زدن آنها دشوار است.

با این حال، این تنها در صورتی صادق است که کلیدهای Keystore در حافظه‌ی پشتیبانی‌شده توسط سخت‌افزار قرار داشته باشند. در Keymaster 1، هیچ راهی برای برنامه‌ها یا سرورهای راه دور وجود نداشت که بتوانند به طور قابل اعتمادی تأیید کنند که آیا این مورد وجود دارد یا خیر. سرویس Keystore، لایه انتزاعی سخت‌افزاری Keymaster (HAL) موجود را بارگذاری می‌کرد و هر آنچه HAL در مورد پشتیبانی سخت‌افزاری کلیدها می‌گفت را باور می‌کرد.

برای رفع این مشکل، قابلیت تصدیق کلید در اندروید ۷.۰ (Keymaster 2) و قابلیت تصدیق شناسه در اندروید ۸.۰ (Keymaster 3) معرفی شدند.

هدف از تصدیق کلید، ارائه روشی برای تعیین دقیق این است که آیا یک جفت کلید نامتقارن دارای پشتیبانی سخت‌افزاری است یا خیر، ویژگی‌های کلید چیست و چه محدودیت‌هایی برای استفاده از آن اعمال می‌شود.

تأیید شناسه به دستگاه اجازه می‌دهد تا مدرکی دال بر شناسه‌های سخت‌افزاری خود، مانند شماره سریال یا IMEI، ارائه دهد.

گواهی کلیدی

برای پشتیبانی از گواهی کلید، اندروید ۷.۰ مجموعه‌ای از برچسب‌ها، نوع‌ها و متدها را به HAL معرفی کرد.

برچسب‌ها

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

نوع

کلیدساز ۲ و پایین‌تر

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

روش AttestKey

کلیدساز ۳

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

کلیدساز ۲ و پایین‌تر

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev ساختار دستگاه Keymaster است.
  • keyToAttest قطعه کلید برگردانده شده از generateKey است که گواهی برای آن ایجاد شده است.
  • attestParams فهرستی از پارامترهای لازم برای تصدیق است. این شامل Tag::ATTESTATION_CHALLENGE و احتمالاً Tag::RESET_SINCE_ID_ROTATION و همچنین Tag::APPLICATION_ID و Tag::APPLICATION_DATA می‌شود. دو مورد آخر در صورتی که در طول تولید کلید مشخص شده باشند، برای رمزگشایی key blob ضروری هستند.
  • certChain پارامتر خروجی است که آرایه‌ای از گواهی‌ها را برمی‌گرداند. ورودی ۰ گواهی گواهی است، به این معنی که کلید را از keyToAttest گواهی می‌کند و شامل پسوند گواهی است.

متد attestKey یک عملیات کلید عمومی روی کلید تایید شده در نظر گرفته می‌شود، زیرا می‌تواند در هر زمانی فراخوانی شود و نیازی به رعایت محدودیت‌های مجوز ندارد. به عنوان مثال، اگر کلید تایید شده برای استفاده نیاز به احراز هویت کاربر داشته باشد، می‌توان بدون احراز هویت کاربر، یک تاییدیه ایجاد کرد.

گواهی تأیید

گواهی تأیید، یک گواهی استاندارد X.509 است، با یک افزونه تأیید اختیاری که شامل توضیحی از کلید تأیید شده است. گواهی با یک کلید تأیید گواهی شده امضا شده است. کلید تأیید ممکن است از الگوریتمی متفاوت از کلید مورد تأیید استفاده کند.

گواهی تأیید شامل فیلدهای جدول زیر است و نمی‌تواند شامل هیچ فیلد اضافی باشد. برخی از فیلدها مقدار فیلد ثابتی را مشخص می‌کنند. آزمون‌های CTS تأیید می‌کنند که محتوای گواهی دقیقاً مطابق تعریف است.

توالی گواهی

نام فیلد (به RFC 5280 مراجعه کنید) ارزش
گواهی tbs توالی گواهی TBSC
الگوریتم امضا شناسه الگوریتم مورد استفاده برای امضای کلید:
ECDSA برای کلیدهای EC، RSA برای کلیدهای RSA.
مقدار امضا رشته بیتی، امضا روی tbsCertificate کدگذاری شده توسط ASN.1 DER محاسبه شده است.

توالی گواهی TBSC

نام فیلد (به RFC 5280 مراجعه کنید) ارزش
version عدد صحیح ۲ (به معنی گواهی نسخه ۳)
serialNumber عدد صحیح ۱ (مقدار ثابت: در همه گواهی‌ها یکسان است)
signature شناسه الگوریتم مورد استفاده برای امضای کلید: ECDSA برای کلیدهای EC، RSA برای کلیدهای RSA.
issuer همانند فیلد موضوع کلید تأیید دسته‌ای.
validity توالی دو تاریخ، شامل مقادیر Tag::ACTIVE_DATETIME و Tag::USAGE_EXPIRE_DATETIME . این مقادیر از اول ژانویه ۱۹۷۰ به میلی‌ثانیه هستند. برای نمایش صحیح تاریخ در گواهی‌ها به RFC 5280 مراجعه کنید.
اگر Tag::ACTIVE_DATETIME وجود ندارد، از مقدار Tag::CREATION_DATETIME استفاده کنید. اگر Tag::USAGE_EXPIRE_DATETIME وجود ندارد، از تاریخ انقضای گواهی کلید تایید دسته‌ای استفاده کنید.
subject CN = "کلید ذخیره کلید اندروید" (مقدار ثابت: در همه گواهی‌ها یکسان است)
subjectPublicKeyInfo SubjectPublicKeyInfo حاوی کلید عمومی تأیید شده.
extensions/Key Usage امضای دیجیتال: اگر کلید هدفی داشته باشد، تنظیم می‌شود. KeyPurpose::SIGN یا KeyPurpose::VERIFY . تمام بیت‌های دیگر تنظیم نشده‌اند.
extensions/CRL Distribution Points ارزش نامشخص
extensions/"attestation" شناسه OID برابر با ۱.۳.۶.۱.۴.۱.۱۱۱۲۹.۲.۱.۱۷ است؛ محتوا در بخش افزونه گواهی در زیر تعریف شده است. همانند تمام افزونه‌های گواهی X.۵۰۹، محتوا به صورت یک OCTET_STRING نمایش داده می‌شود که حاوی یک کدگذاری DER از توالی گواهی است.

تمدید گواهینامه

افزونه‌ی attestation دارای OID 1.3.6.1.4.1.11129.2.1.17 است که حاوی اطلاعاتی در مورد جفت کلید مورد گواهی و وضعیت دستگاه در زمان تولید کلید است.

انواع برچسب Keymaster/KeyMint که در مشخصات رابط AIDL تعریف شده‌اند، به صورت زیر به انواع ASN.1 ترجمه می‌شوند:

نوع KeyMint یا Keymaster نوع ASN.1 یادداشت‌ها
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER میلی‌ثانیه از ۱ ژانویه ۱۹۷۰، ساعت ۰۰:۰۰:۰۰ به وقت گرینویچ.
BOOL NULL حضور در برچسب به معنای درست و غیبت به معنای نادرست است.
BIGNUM هیچ تگی این نوع را ندارد، بنابراین هیچ نگاشتی تعریف نشده است.
BYTES OCTET_STRING

طرحواره

محتوای افزونه‌ی گواهی توسط طرح ASN.1 زیر توصیف می‌شود. طرح ASN.1 برای AuthorizationList همچنین برای وارد کردن کلیدهای رمزگذاری شده استفاده می‌شود. هر فیلدی که در افزونه‌ی گواهی ظاهر نشود، به همین صورت ذکر می‌شود.

نسخه ۵۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۴۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۳۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۲۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۱۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۴ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۳ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۲ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

نسخه ۱ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

فیلدهای توضیحات کلید

attestationVersion
نسخه طرحواره ASN.1.
ارزش نسخه KeyMint یا Keymaster
۱ نسخه ۲.۰ کی‌مستر
۲ نسخه ۳.۰ کی‌مستر
۳ نسخه ۴.۰ کی‌مستر
۴ نسخه ۴.۱ کی‌مستر
۱۰۰ نسخه ۱.۰ کی‌مینت
۲۰۰ نسخه ۲.۰ کی‌مینت
۳۰۰ نسخه ۳.۰ کی‌مینت
۴۰۰ نسخه ۴.۰ کی‌مینت
۵۰۰ نسخه ۵.۰ کی‌مینت
attestationSecurityLevel

سطح امنیتی مکانی که کلید گواهی‌شده در آن ذخیره شده است.

keymasterVersion / keyMintVersion
نسخه پیاده‌سازی KeyMint یا Keymaster HAL.
ارزش نسخه KeyMint یا Keymaster
۲ نسخه ۲.۰ کی‌مستر
۳ نسخه ۳.۰ کی‌مستر
۴ نسخه ۴.۰ کی‌مستر
۴۱ نسخه ۴.۱ کی‌مستر
۱۰۰ نسخه ۱.۰ کی‌مینت
۲۰۰ نسخه ۲.۰ کی‌مینت
۳۰۰ نسخه ۳.۰ کی‌مینت
۴۰۰ نسخه ۴.۰ کی‌مینت
۵۰۰ نسخه ۵.۰ کی‌مینت
keymasterSecurityLevel / keyMintSecurityLevel
سطح امنیتی پیاده‌سازی KeyMint یا Keymaster.
attestationChallenge
چالشی که در زمان تولید کلید ارائه می‌شود.
uniqueId
یک شناسه دستگاه حساس به حریم خصوصی که برنامه‌های سیستم می‌توانند در زمان تولید کلید درخواست کنند. اگر شناسه منحصر به فرد درخواست نشود، این فیلد خالی است. برای جزئیات بیشتر، به بخش شناسه منحصر به فرد مراجعه کنید.
softwareEnforced
فهرست مجوزهای KeyMint یا Keymaster که توسط سیستم اندروید اعمال می‌شود. این اطلاعات توسط کد موجود در پلتفرم جمع‌آوری یا تولید می‌شوند. تا زمانی که دستگاه سیستم عاملی را اجرا می‌کند که با مدل امنیتی پلتفرم اندروید مطابقت دارد (یعنی بوت لودر دستگاه قفل شده و وضعیت بوت verifiedBootState ، Verified باشد)، می‌توان به آن اعتماد کرد.
hardwareEnforced
فهرست مجوزهای KeyMint یا Keymaster که توسط محیط اجرای مطمئن (TEE) یا StrongBox دستگاه اعمال می‌شود. این اطلاعات توسط کد موجود در سخت‌افزار امن جمع‌آوری یا تولید می‌شود و توسط پلتفرم کنترل نمی‌شود. به عنوان مثال، اطلاعات می‌توانند از طریق بوت لودر یا از طریق یک کانال ارتباطی امن که شامل اعتماد به پلتفرم نمی‌شود، دریافت شوند.

مقادیر SecurityLevel

مقدار SecurityLevel نشان می‌دهد که یک عنصر مرتبط با Keystore (برای مثال، جفت کلید و گواهی) تا چه حد در برابر حملات مقاوم است.

ارزش معنی
Software تا زمانی که سیستم اندروید دستگاه با مدل امنیتی پلتفرم اندروید مطابقت داشته باشد (یعنی بوت لودر دستگاه قفل شده و verifiedBootState ) Verified باشد)، ایمن است.
TrustedEnvironment تا زمانی که TEE به خطر نیفتد، ایمن است. الزامات جداسازی برای TEEها در بخش‌های 9.11 [C-1-1] تا [C-1-4] از سند تعریف سازگاری اندروید تعریف شده‌اند. TEEها در برابر نفوذ از راه دور بسیار مقاوم و در برابر نفوذ از طریق حمله مستقیم سخت‌افزاری نسبتاً مقاوم هستند.
StrongBox تا زمانی که StrongBox به خطر نیفتد، امن است. StrongBox در یک عنصر امن مشابه یک ماژول امنیتی سخت‌افزاری پیاده‌سازی شده است. الزامات پیاده‌سازی برای StrongBox در بخش 9.11.2 از سند تعریف سازگاری اندروید تعریف شده است. StrongBox در برابر نفوذ از راه دور و نفوذ از طریق حمله مستقیم سخت‌افزاری (به عنوان مثال، دستکاری فیزیکی و حملات کانال جانبی) بسیار مقاوم است.

فیلدهای لیست مجوز

هر فیلد مربوط به یک برچسب مجوز Keymaster/KeyMint از مشخصات رابط AIDL است. این مشخصات منبع حقیقت در مورد برچسب‌های مجوز است: معنی آنها، قالب محتوای آنها، اینکه آیا انتظار می‌رود در فیلدهای softwareEnforced یا hardwareEnforced در شیء KeyDescription ظاهر شوند، اینکه آیا با سایر برچسب‌ها ناسازگار هستند و غیره. همه فیلدهای AuthorizationList اختیاری هستند.

هر فیلد دارای یک برچسب مختص به متن EXPLICIT برابر با شماره برچسب KeyMint یا Keymaster است که امکان نمایش فشرده‌تر داده‌ها در AuthorizationList را فراهم می‌کند. بنابراین، تجزیه‌کننده ASN.1 باید نوع داده مورد انتظار برای هر برچسب مختص به متن را بداند. برای مثال، Tag::USER_AUTH_TYPE به صورت ENUM | 504 تعریف شده است. در طرحواره توسعه گواهی، فیلد purpose در AuthorizationList به صورت userAuthType [504] EXPLICIT INTEGER OPTIONAL مشخص شده است. بنابراین، کدگذاری ASN.1 آن به جای برچسب کلاس UNIVERSAL برای نوع ASN.1 INTEGER که 10 است، حاوی برچسب مختص به متن 504 خواهد بود.

فیلدهای زیر در گواهی‌های تولید شده توسط KeyMint 5 وجود دارند:
purpose
مربوط به تگ مجوز Tag::PURPOSE است که از مقدار شناسه تگ ۱ استفاده می‌کند.
algorithm

مربوط به تگ مجوز Tag::ALGORITHM است که از مقدار شناسه تگ ۲ استفاده می‌کند.

در یک شیء attestation AuthorizationList ، مقدار الگوریتم همیشه RSA ، EC یا ML_DSA است.

keySize
مربوط به تگ مجوز Tag::KEY_SIZE است که از مقدار شناسه تگ ۳ استفاده می‌کند.
blockMode
مربوط به تگ مجوز Tag::BLOCK_MODE است که از مقدار شناسه تگ ۴ استفاده می‌کند.
digest
مربوط به تگ مجوز Tag::DIGEST است که از مقدار شناسه تگ ۵ استفاده می‌کند.
padding
مربوط به تگ مجوز Tag::PADDING است که از مقدار شناسه تگ ۶ استفاده می‌کند.
callerNonce
مربوط به تگ مجوز Tag::CALLER_NONCE است که از شناسه تگ با مقدار ۷ استفاده می‌کند. این تگ هرگز در گواهی‌ها وجود ندارد.
minMacLength
مربوط به برچسب مجوز Tag::MIN_MAC_LENGTH است که از شناسه برچسب با مقدار ۸ استفاده می‌کند. این برچسب هرگز در گواهی‌ها وجود ندارد.
ecCurve

مربوط به تگ مجوز Tag::EC_CURVE است که از مقدار شناسه تگ ۱۰ استفاده می‌کند.

مجموعه‌ای از پارامترهای مورد استفاده برای تولید یک جفت کلید منحنی بیضوی (EC)، که از ECDSA برای امضا و تأیید، در مخزن کلید سیستم اندروید استفاده می‌کند.

mlDsaVariant

فقط در نسخه گواهی کلید >= 500 ارائه شود.

مربوط به برچسب مجوز Tag::ML_DSA_VARIANT است که از مقدار شناسه برچسب ۱۱ استفاده می‌کند.

rsaPublicExponent
مربوط به تگ مجوز Tag::RSA_PUBLIC_EXPONENT است که از مقدار شناسه تگ ۲۰۰ استفاده می‌کند.
mgfDigest

فقط در نسخه گواهی کلید >= 100 ارائه شود.

مربوط به تگ مجوز Tag::RSA_OAEP_MGF_DIGEST در KeyMint است که از شناسه تگ با مقدار ۲۰۳ استفاده می‌کند.
rollbackResistance

فقط در نسخه گواهی کلید >= 3 ارائه شود.

مربوط به تگ مجوز Tag::ROLLBACK_RESISTANCE است که از مقدار شناسه تگ 303 استفاده می‌کند.

earlyBootOnly

فقط در نسخه گواهی کلید >= 4 ارائه شود.

مربوط به تگ مجوز Tag::EARLY_BOOT_ONLY است که از مقدار شناسه تگ ۳۰۵ استفاده می‌کند.

activeDateTime
مربوط به تگ مجوز Tag::ACTIVE_DATETIME است که از مقدار شناسه تگ ۴۰۰ استفاده می‌کند.
originationExpireDateTime
مربوط به تگ مجوز Tag::ORIGINATION_EXPIRE_DATETIME است که از مقدار شناسه تگ ۴۰۱ استفاده می‌کند.
usageExpireDateTime
مربوط به تگ مجوز Tag::USAGE_EXPIRE_DATETIME است که از مقدار شناسه تگ ۴۰۲ استفاده می‌کند.
usageCountLimit
مربوط به تگ مجوز Tag::USAGE_COUNT_LIMIT است که از مقدار شناسه تگ ۴۰۵ استفاده می‌کند.
userSecureId
مربوط به برچسب مجوز Tag::USER_SECURE_ID است که از مقدار شناسه برچسب ۵۰۲ استفاده می‌کند. این برچسب هرگز در گواهی‌ها وجود ندارد.
noAuthRequired

مربوط به تگ مجوز Tag::NO_AUTH_REQUIRED است که از مقدار شناسه تگ ۵۰۳ استفاده می‌کند.

userAuthType
مربوط به تگ مجوز Tag::USER_AUTH_TYPE است که از مقدار شناسه تگ ۵۰۴ استفاده می‌کند.
authTimeout
مربوط به تگ مجوز Tag::AUTH_TIMEOUT است که از مقدار شناسه تگ ۵۰۵ استفاده می‌کند.
allowWhileOnBody

مربوط به تگ مجوز Tag::ALLOW_WHILE_ON_BODY است که از مقدار شناسه تگ ۵۰۶ استفاده می‌کند.

اگر کاربر هنوز دستگاه را روی بدن خود داشته باشد، پس از پایان مهلت احراز هویت، امکان استفاده از کلید را فراهم می‌کند. توجه داشته باشید که یک حسگر ایمن روی بدن تعیین می‌کند که آیا دستگاه روی بدن کاربر پوشیده شده است یا خیر.

trustedUserPresenceReq

فقط در نسخه گواهی کلید >= 3 ارائه شود.

مربوط به Tag::TRUSTED_USER_PRESENCE_REQUIRED است که از مقدار شناسه برچسب ۵۰۷ استفاده می‌کند.

مشخص می‌کند که این کلید فقط در صورتی قابل استفاده است که کاربر مدرک حضور فیزیکی ارائه داده باشد. چندین مثال شامل موارد زیر است:

  • برای یک کلید StrongBox، یک دکمه سخت‌افزاری که به یک پین روی دستگاه StrongBox متصل شده است.
  • برای یک کلید TEE، احراز هویت اثر انگشت تا زمانی که TEE کنترل انحصاری اسکنر را داشته باشد و فرآیند تطبیق اثر انگشت را انجام دهد، اثبات حضور را ارائه می‌دهد.
trustedConfirmationReq

فقط در نسخه گواهی کلید >= 3 ارائه شود.

مربوط به Tag::TRUSTED_CONFIRMATION_REQUIRED است که از مقدار شناسه برچسب ۵۰۸ استفاده می‌کند.

مشخص می‌کند که کلید فقط در صورتی قابل استفاده است که کاربر با استفاده از یک توکن تأیید، تأیید داده‌هایی که قرار است امضا شوند را ارائه دهد. برای اطلاعات بیشتر در مورد نحوه دریافت تأیید کاربر، به تأیید محافظت‌شده اندروید مراجعه کنید.

نکته: این برچسب فقط برای کلیدهایی که از هدف SIGN استفاده می‌کنند، قابل استفاده است.

unlockedDeviceReq

فقط در نسخه گواهی کلید >= 3 ارائه شود.

مربوط به Tag::UNLOCKED_DEVICE_REQUIRED است که از مقدار شناسه برچسب ۵۰۹ استفاده می‌کند.

creationDateTime
مربوط به تگ مجوز Tag::CREATION_DATETIME است که از مقدار شناسه تگ ۷۰۱ استفاده می‌کند.
origin

مربوط به تگ مجوز Tag::ORIGIN است که از مقدار شناسه تگ ۷۰۲ استفاده می‌کند.

rootOfTrust

مربوط به تگ مجوز Tag::ROOT_OF_TRUST است که از مقدار شناسه تگ ۷۰۴ استفاده می‌کند.

برای جزئیات بیشتر، به بخش توصیف ساختار داده RootOfTrust مراجعه کنید.

osVersion

مربوط به تگ مجوز Tag::OS_VERSION است که از مقدار شناسه تگ ۷۰۵ استفاده می‌کند.

نسخه سیستم عامل اندروید مرتبط با Keymaster که به صورت یک عدد صحیح شش رقمی مشخص می‌شود. برای مثال، نسخه ۸.۱.۰ به صورت ۰۸۰۱۰۰ نمایش داده می‌شود.

فقط Keymaster نسخه ۱.۰ یا بالاتر این مقدار را در لیست مجوزها قرار می‌دهد.

osPatchLevel

مربوط به تگ مجوز Tag::OS_PATCHLEVEL است که از مقدار شناسه تگ ۷۰۶ استفاده می‌کند.

ماه و سال مرتبط با وصله امنیتی که در KeyMint (قبلاً Keymaster) استفاده می‌شود، به صورت یک عدد صحیح شش رقمی مشخص می‌شود. برای مثال، وصله آگوست ۲۰۱۸ به صورت ۲۰۱۸۰۸ نمایش داده می‌شود.

برای بررسی اینکه آیا دستگاه اخیراً وصله شده است یا خیر، استفاده از این فیلد را به جای vendorPatchLevel یا bootPatchLevel ترجیح دهید.

فقط Keymaster نسخه ۱.۰ یا بالاتر این مقدار را در لیست مجوزها قرار می‌دهد.

attestationApplicationId

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_APPLICATION_ID است که از مقدار شناسه برچسب ۷۰۹ استفاده می‌کند.

برای جزئیات بیشتر، به بخش توصیف ساختار داده‌ی AttestationApplicationId مراجعه کنید.

attestationIdBrand

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_ID_BRAND است که از مقدار شناسه برچسب ۷۱۰ استفاده می‌کند.

attestationIdDevice

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به Tag::ATTESTATION_ID_DEVICE است که از مقدار شناسه برچسب ۷۱۱ استفاده می‌کند.

attestationIdProduct

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_ID_PRODUCT است که از مقدار شناسه برچسب ۷۱۲ استفاده می‌کند.

attestationIdSerial

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_ID_SERIAL است که از مقدار شناسه برچسب ۷۱۳ استفاده می‌کند.

attestationIdImei

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_ID_IMEI است که از مقدار شناسه برچسب ۷۱۴ استفاده می‌کند.

attestationIdMeid

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_ID_MEID است که از مقدار شناسه برچسب ۷۱۵ استفاده می‌کند.

attestationIdManufacturer

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به Tag::ATTESTATION_ID_MANUFACTURER است که از مقدار شناسه برچسب ۷۱۶ استفاده می‌کند.

attestationIdModel

فقط در نسخه‌های گواهی کلید >= ۲ ارائه می‌شود.

مربوط به برچسب مجوز Tag::ATTESTATION_ID_MODEL است که از مقدار شناسه برچسب ۷۱۷ استفاده می‌کند.

vendorPatchLevel

فقط در نسخه‌های گواهی کلید >= 3 ارائه می‌شود.

مربوط به برچسب مجوز Tag::VENDOR_PATCHLEVEL است که از مقدار شناسه برچسب ۷۱۸ استفاده می‌کند.

سطح وصله امنیتی تصویر فروشنده را که باید برای استفاده از این کلید روی دستگاه نصب شود، مشخص می‌کند. مقدار، عدد صحیحی است که با در نظر گرفتن سطح وصله امنیتی و حذف خط تیره‌ها تشکیل می‌شود. به عنوان مثال، اگر کلیدی در دستگاه اندرویدی با نصب وصله امنیتی 2018-08-05 فروشنده ایجاد شود، این مقدار 20180805 خواهد بود.

bootPatchLevel

فقط در نسخه‌های گواهی کلید >= 3 ارائه می‌شود.

مربوط به برچسب مجوز Tag::BOOT_PATCHLEVEL است که از مقدار شناسه برچسب ۷۱۹ استفاده می‌کند.

سطح وصله امنیتی تصویر هسته را که باید برای استفاده از این کلید روی دستگاه نصب شود، مشخص می‌کند. مقدار، عدد صحیحی است که با در نظر گرفتن سطح وصله امنیتی و حذف خط تیره‌ها تشکیل می‌شود. به عنوان مثال، اگر کلیدی در دستگاه اندرویدی با وصله امنیتی 2018-08-05 هسته ایجاد شود، این مقدار 20180805 خواهد بود.

deviceUniqueAttestation

فقط در نسخه‌های گواهی کلید >= 4 ارائه می‌شود.

مربوط به Tag::DEVICE_UNIQUE_ATTESTATION است که از مقدار شناسه برچسب ۷۲۰ استفاده می‌کند.

attestationIdSecondImei

فقط در نسخه‌های گواهی کلید >= 300 ارائه می‌شود.

مربوط به Tag::ATTESTATION_ID_SECOND_IMEI است که از مقدار شناسه برچسب ۷۲۳ استفاده می‌کند.

moduleHash

فقط در نسخه‌های گواهی کلید >= ۴۰۰ ارائه می‌شود.

مربوط به تگ مجوز Tag::MODULE_HASH است که از مقدار شناسه تگ ۷۲۴ استفاده می‌کند.

فیلدهای RootOfTrust

verifiedBootKey
یک هش امن از کلید عمومی که برای تأیید صحت و اعتبار تمام کدهایی که هنگام بوت شدن دستگاه به عنوان بخشی از Verified Boot اجرا می‌شوند، استفاده می‌شود. SHA-256 توصیه می‌شود.
deviceLocked
آیا بوت لودر دستگاه قفل شده است یا خیر. true به این معنی است که دستگاه یک ایمیج امضا شده را بوت کرده است که با موفقیت توسط Verified Boot تأیید شده است.
verifiedBootState
وضعیت بوت تأیید شده دستگاه.
verifiedBootHash
خلاصه‌ای از تمام داده‌های محافظت‌شده توسط Verified Boot . برای دستگاه‌هایی که از پیاده‌سازی مرجع Android Verified Boot استفاده می‌کنند، این فیلد حاوی خلاصه VBMeta است.

مقادیر تأیید شده‌ی BootState

ارزش وضعیت بوت مربوطه معنی
Verified GREEN یک زنجیره کامل اعتماد از یک ریشه اعتماد محافظت‌شده توسط سخت‌افزار تا بوت‌لودر و تمام پارتیشن‌های تأییدشده توسط Verified Boot امتداد می‌یابد. در این حالت، فیلد verifiedBootKey حاوی هش ریشه اعتماد تعبیه‌شده است که همان گواهی تعبیه‌شده در ROM دستگاه توسط سازنده دستگاه در کارخانه است.
SelfSigned YELLOW همانند حالت Verified است، با این تفاوت که تأیید با استفاده از ریشه اعتمادی که توسط کاربر پیکربندی شده است، به جای ریشه اعتمادی که توسط سازنده در کارخانه تعبیه شده است، انجام شده است. در این حالت، فیلد verifiedBootKey حاوی هش کلید عمومی پیکربندی شده توسط کاربر است.
Unverified ORANGE بوت لودر دستگاه قفل‌گشایی شده است، بنابراین نمی‌توان زنجیره اعتمادی ایجاد کرد. دستگاه را می‌توان آزادانه تغییر داد، بنابراین یکپارچگی دستگاه باید توسط کاربر خارج از باند تأیید شود. در این حالت، فیلد verifiedBootKey حاوی ۳۲ بایت صفر است.
Failed RED تأیید دستگاه ناموفق بود. در این حالت، هیچ تضمینی در مورد محتوای سایر فیلدهای RootOfTrust وجود ندارد.

شناسه برنامه گواهی

این فیلد، باور پلتفرم اندروید را در مورد اینکه کدام برنامه‌ها مجاز به استفاده از کلید مخفی تحت گواهی هستند، منعکس می‌کند. این فیلد می‌تواند شامل چندین بسته باشد، اگر و تنها اگر چندین بسته، UID یکسانی داشته باشند. فیلد AttestationApplicationId در AuthorizationList از نوع OCTET_STRING است و طبق طرح ASN.1 زیر قالب‌بندی شده است: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
مجموعه‌ای از اشیاء AttestationPackageInfo که هر کدام نام و شماره نسخه یک بسته را ارائه می‌دهند.
signature_digests

مجموعه‌ای از خلاصه‌های SHA-256 از گواهی‌های امضای برنامه. یک برنامه می‌تواند چندین زنجیره گواهی کلید امضا داشته باشد. برای هر کدام، گواهی "leaf" خلاصه شده و در فیلد signature_digests قرار می‌گیرد. نام فیلد گمراه‌کننده است، زیرا داده‌های خلاصه شده گواهی‌های امضای برنامه هستند، نه امضاهای برنامه، زیرا برای کلاس Signature که توسط فراخوانی getPackageInfo() برگردانده می‌شود، نامگذاری شده است. قطعه کد زیر یک مجموعه مثال را نشان می‌دهد: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

افزونه‌ی اطلاعات تأمین‌کننده

افزونه‌ی اطلاعات تأمین‌کننده دارای OID 1.3.6.1.4.1.11129.2.1.30 است. این افزونه اطلاعاتی را که توسط سرور تأمین‌کننده در مورد دستگاه شناخته شده است، ارائه می‌دهد.

طرحواره

مقدار افزونه شامل داده‌های نمایش مختصر شیء دودویی (CBOR) است که با این طرحواره زبان تعریف مختصر داده‌ها (CDDL) مطابقت دارد: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

نقشه بدون نسخه است و ممکن است فیلدهای اختیاری جدیدی اضافه شود.

certs_issued

تعداد تقریبی گواهی‌های صادر شده برای دستگاه در 30 روز گذشته. اگر این مقدار چند برابر بیشتر از میانگین باشد، می‌تواند به عنوان نشانه‌ای برای سوءاستفاده احتمالی مورد استفاده قرار گیرد.

validated_attested_entity

رشته‌ای که نشان دهنده‌ی مبدا گواهی‌شده‌ی کلید تایید شده است و مستقیماً توسط سازنده‌ی چیپست تایید شده است. برای مثال، STRONG_BOX یا TEE .

is_lost_device

یک مقدار بولی که نشان می‌دهد آیا دستگاه به عنوان گم‌شده گزارش شده است یا خیر. اگر موجود و درست باشد، گواهی برای دستگاهی که در حال حاضر به عنوان گم‌شده علامت‌گذاری شده است، ارائه شده است.

کلیدهای تأیید

دو کلید، یکی RSA و یکی ECDSA، و زنجیره‌های گواهی مربوطه، به طور ایمن در دستگاه تعبیه شده‌اند.

اندروید ۱۲ قابلیت تأمین کلید از راه دور (Remote Key Provisioning) را معرفی می‌کند. این ویژگی، گواهی‌های تأیید ECDSA P-256 را برای هر برنامه در اختیار دستگاه‌های موجود در میدان قرار می‌دهد که نسبت به گواهی‌های تأمین‌شده توسط کارخانه، عمر کوتاه‌تری دارند.

شناسه منحصر به فرد

شناسه منحصر به فرد یک مقدار ۱۲۸ بیتی است که دستگاه را شناسایی می‌کند، اما فقط برای مدت زمان محدودی. این مقدار با فرمول زیر محاسبه می‌شود: 

HMAC_SHA256(T || C || R, HBK)

کجا:

  • T «مقدار شمارنده زمانی» است که با تقسیم مقدار Tag::CREATION_DATETIME بر ۲۵۹۲۰۰۰۰۰۰ و حذف باقیمانده محاسبه می‌شود. T هر ۳۰ روز یکبار تغییر می‌کند (۲۵۹۲۰۰۰۰۰۰ = ۳۰ * ۲۴ * ۶۰ * ۶۰ * ۱۰۰۰).
  • C مقدار Tag::APPLICATION_ID است.
  • اگر Tag::RESET_SINCE_ID_ROTATION در پارامتر attest_params در فراخوانی attest_key وجود داشته باشد، R برابر با ۱ است، و اگر برچسب وجود نداشته باشد، برابر با ۰ است.
  • HBK یک راز منحصر به فرد وابسته به سخت‌افزار است که برای محیط اجرای قابل اعتماد (Trusted Execution Environment) شناخته شده است و هرگز توسط آن فاش نشده است. این راز حاوی حداقل ۱۲۸ بیت آنتروپی است و برای هر دستگاه منحصر به فرد است (با توجه به ۱۲۸ بیت آنتروپی، منحصر به فرد بودن احتمالی قابل قبول است). HBK باید از طریق HMAC یا AES_CMAC از مواد کلید ترکیبی استخراج شود.

خروجی HMAC_SHA256 را به ۱۲۸ بیت کوتاه کنید.

چندین IMEI

اندروید ۱۴ پشتیبانی از چندین IMEI را در رکورد Android Key Attestation اضافه می‌کند. تولیدکنندگان اصلی تجهیزات (OEM) می‌توانند این ویژگی را با اضافه کردن یک برچسب KeyMint برای IMEI دوم پیاده‌سازی کنند. داشتن چندین رادیوی سلولی برای دستگاه‌ها به طور فزاینده‌ای رایج شده است و تولیدکنندگان اصلی تجهیزات اکنون می‌توانند از دستگاه‌هایی با دو IMEI پشتیبانی کنند.

تولیدکنندگان اصلی تجهیزات (OEM) موظفند در صورت وجود IMEI ثانویه در دستگاه‌های خود، آن را برای پیاده‌سازی (یا پیاده‌سازی‌های) KeyMint آماده کنند تا آن پیاده‌سازی‌ها بتوانند آن را به همان روشی که IMEI اول را تأیید می‌کنند، تأیید کنند.

تأیید هویت

اندروید ۸.۰ شامل پشتیبانی اختیاری برای تأیید هویت برای دستگاه‌هایی با Keymaster 3 است. تأیید هویت به دستگاه اجازه می‌دهد تا مدرکی برای شناسه‌های سخت‌افزاری خود، مانند شماره سریال یا IMEI، ارائه دهد. اگرچه یک ویژگی اختیاری است، اکیداً توصیه می‌شود که تمام پیاده‌سازی‌های Keymaster 3 از آن پشتیبانی کنند زیرا توانایی اثبات هویت دستگاه، موارد استفاده‌ای مانند پیکربندی از راه دور بدون تماس واقعی را ایمن‌تر می‌کند (زیرا طرف از راه دور می‌تواند مطمئن باشد که با دستگاه درست صحبت می‌کند، نه دستگاهی که هویت آن را جعل می‌کند).

گواهی شناسه با ایجاد کپی‌هایی از شناسه‌های سخت‌افزاری دستگاه کار می‌کند که فقط TEE می‌تواند قبل از خروج دستگاه از کارخانه به آنها دسترسی داشته باشد. کاربر می‌تواند بوت‌لودر دستگاه را باز کند و نرم‌افزار سیستم و شناسه‌های گزارش شده توسط چارچوب‌های اندروید را تغییر دهد. کپی‌های شناسه‌های نگهداری شده توسط TEE را نمی‌توان از این طریق دستکاری کرد، و تضمین می‌کند که گواهی شناسه دستگاه فقط شناسه‌های سخت‌افزاری اصلی دستگاه را تأیید می‌کند و در نتیجه تلاش‌های جعل را خنثی می‌کند.

سطح اصلی API برای گواهی شناسه بر روی مکانیزم گواهی کلید موجود که با Keymaster 2 معرفی شد، ساخته شده است. هنگام درخواست گواهی گواهی برای کلیدی که در اختیار Keymaster است، تماس‌گیرنده می‌تواند درخواست کند که شناسه‌های سخت‌افزاری دستگاه در فراداده گواهی گواهی گنجانده شوند. اگر کلید در TEE نگهداری شود، گواهی به یک ریشه اعتماد شناخته‌شده زنجیر می‌شود. گیرنده چنین گواهی می‌تواند تأیید کند که گواهی و محتویات آن، از جمله شناسه‌های سخت‌افزاری، توسط TEE نوشته شده است. هنگامی که از TEE خواسته می‌شود شناسه‌های سخت‌افزاری را در گواهی گواهی بگنجاند، TEE فقط شناسه‌های موجود در انبار خود را، همانطور که در کارخانه قرار گرفته‌اند، گواهی می‌دهد.

خواص ذخیره سازی

حافظه‌ای که شناسه‌های دستگاه را در خود نگه می‌دارد، باید این ویژگی‌ها را داشته باشد:

  • مقادیر به‌دست‌آمده از شناسه‌های اصلی دستگاه، قبل از خروج دستگاه از کارخانه، در حافظه کپی می‌شوند.
  • متد destroyAttestationIds() می‌تواند این کپی از داده‌های مشتق‌شده از شناسه را به‌طور دائم از بین ببرد. تخریب دائمی به این معنی است که داده‌ها به‌طور کامل حذف می‌شوند، به‌طوری که نه تنظیم مجدد کارخانه و نه هیچ روش دیگری که روی دستگاه انجام می‌شود، نمی‌تواند آن را بازیابی کند. این امر به‌ویژه برای دستگاه‌هایی که کاربر قفل بوت‌لودر را باز کرده و نرم‌افزار سیستم را تغییر داده و شناسه‌های برگردانده‌شده توسط چارچوب‌های اندروید را اصلاح کرده است، اهمیت دارد.
  • مراکز RMA باید توانایی تولید کپی‌های جدید از داده‌های مشتق‌شده از شناسه سخت‌افزاری را داشته باشند. به این ترتیب، دستگاهی که از RMA عبور می‌کند می‌تواند دوباره گواهی شناسه را انجام دهد. مکانیسم مورد استفاده مراکز RMA باید محافظت شود تا کاربران نتوانند خودشان آن را فراخوانی کنند، زیرا این امر به آنها اجازه می‌دهد گواهی شناسه‌های جعلی را دریافت کنند.
  • هیچ کدی غیر از برنامه‌ی مورد اعتماد Keymaster در TEE قادر به خواندن داده‌های مشتق‌شده از شناسه‌ی نگهداری‌شده در حافظه نیست.
  • فضای ذخیره‌سازی در برابر دستکاری مقاوم است: اگر محتوای فضای ذخیره‌سازی تغییر کرده باشد، TEE با آن مانند زمانی که کپی‌های محتوا از بین رفته‌اند رفتار می‌کند و تمام تلاش‌های تأیید هویت را رد می‌کند. این کار با امضا یا MAC کردن فضای ذخیره‌سازی همانطور که در زیر توضیح داده شده است، پیاده‌سازی می‌شود.
  • این ذخیره‌سازی، شناسه‌های اصلی را در خود نگه نمی‌دارد. از آنجا که تأیید شناسه با چالشی همراه است، فراخوانی‌کننده همیشه شناسه‌هایی را که باید تأیید شوند، ارائه می‌دهد. TEE فقط باید تأیید کند که این شناسه‌ها با مقادیری که در ابتدا داشته‌اند، مطابقت دارند. ذخیره‌سازی هش‌های امن از مقادیر اصلی به جای خود مقادیر، این تأیید را امکان‌پذیر می‌کند.

ساخت و ساز

برای ایجاد پیاده‌سازی که ویژگی‌های ذکر شده در بالا را داشته باشد، مقادیر مشتق شده از شناسه را در ساختار S زیر ذخیره کنید. کپی‌های دیگری از مقادیر شناسه را ذخیره نکنید، به جز مکان‌های عادی در سیستم که صاحب دستگاه می‌تواند با روت کردن آنها را تغییر دهد: 

S = D || HMAC(HBK, D)

کجا:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC ساختار HMAC با یک هش امن مناسب است (توصیه می‌شود از SHA-256 استفاده شود)
  • HBK یک کلید سخت‌افزاری است که برای هیچ هدف دیگری استفاده نمی‌شود.
  • ID 1 ...ID n مقادیر اصلی ID هستند؛ ارتباط یک مقدار خاص با یک شاخص خاص وابسته به پیاده‌سازی است، زیرا دستگاه‌های مختلف تعداد شناسه‌های متفاوتی دارند.
  • || نشان دهنده الحاق است

از آنجا که خروجی‌های HMAC اندازه ثابتی دارند، برای یافتن هش‌های شناسه منفرد یا HMAC مربوط به D، نیازی به هدر یا ساختار دیگری نیست. علاوه بر بررسی مقادیر ارائه شده برای انجام گواهی، پیاده‌سازی‌ها باید S را با استخراج D از S، محاسبه HMAC(HBK, D) و مقایسه آن با مقدار موجود در S اعتبارسنجی کنند تا تأیید شود که هیچ شناسه منفردی تغییر/خراب نشده است. همچنین، پیاده‌سازی‌ها باید از مقایسه‌های زمان ثابت برای همه عناصر شناسه منفرد و اعتبارسنجی S استفاده کنند. زمان مقایسه باید صرف نظر از تعداد شناسه‌های ارائه شده و تطابق صحیح هر بخش از آزمون، ثابت باشد.

شناسه‌های سخت‌افزاری

گواهی شناسایی از شناسه‌های سخت‌افزاری زیر پشتیبانی می‌کند:

  1. نام تجاری، همانطور که توسط Build.BRAND در اندروید برگردانده می‌شود
  2. نام دستگاه، همانطور که توسط Build.DEVICE در اندروید برگردانده می‌شود
  3. نام محصول، همانطور که توسط Build.PRODUCT در اندروید برگردانده می‌شود
  4. نام سازنده، همانطور که توسط Build.MANUFACTURER در اندروید برگردانده می‌شود
  5. نام مدل، همانطور که توسط Build.MODEL در اندروید برگردانده می‌شود
  6. شماره سریال
  7. IMEI همه رادیوها
  8. شناسه‌های MEID همه رادیوها

برای پشتیبانی از گواهی شناسه دستگاه، دستگاه این شناسه‌ها را گواهی می‌کند. همه دستگاه‌هایی که اندروید را اجرا می‌کنند، شش مورد اول را دارند و برای عملکرد این ویژگی ضروری هستند. اگر دستگاه دارای هرگونه رادیوی تلفن همراه یکپارچه باشد، دستگاه باید از گواهی IMEI و/یا MEID رادیوها نیز پشتیبانی کند.

تأیید شناسه با انجام یک تأیید کلید و گنجاندن شناسه‌های دستگاه برای تأیید در درخواست، درخواست می‌شود. شناسه‌ها به صورت زیر برچسب‌گذاری می‌شوند:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

شناسه‌ای که باید گواهی شود، یک رشته بایت کدگذاری شده با UTF-8 است. این قالب برای شناسه‌های عددی نیز اعمال می‌شود. هر شناسه‌ای که باید گواهی شود، به صورت یک رشته کدگذاری شده با UTF-8 بیان می‌شود.

اگر دستگاه از تأیید شناسه پشتیبانی نکند (یا قبلاً تابع destroyAttestationIds() فراخوانی شده باشد و دستگاه دیگر نتواند شناسه‌های خود را تأیید کند)، هرگونه درخواست تأیید کلید که شامل یک یا چند مورد از این برچسب‌ها باشد، با ErrorCode::CANNOT_ATTEST_IDS مواجه می‌شود.

اگر دستگاه از گواهی شناسه پشتیبانی کند و یک یا چند مورد از برچسب‌های فوق در درخواست گواهی کلید گنجانده شده باشند، TEE تأیید می‌کند که شناسه ارائه شده با هر یک از برچسب‌ها با کپی شناسه‌های سخت‌افزاری آن مطابقت دارد. اگر یک یا چند شناسه مطابقت نداشته باشند، کل گواهی با ErrorCode::CANNOT_ATTEST_IDS رد می‌شود. معتبر است که یک برچسب چندین بار ارائه شود. این می‌تواند مفید باشد، به عنوان مثال، هنگام تأیید IMEIها: یک دستگاه می‌تواند چندین رادیو با چندین IMEI داشته باشد. یک درخواست گواهی در صورتی معتبر است که مقدار ارائه شده با هر ATTESTATION_ID_IMEI با یکی از رادیوهای دستگاه مطابقت داشته باشد. همین امر در مورد همه برچسب‌های دیگر نیز صدق می‌کند.

اگر گواهی موفقیت‌آمیز باشد، شناسه‌های گواهی‌شده با استفاده از طرحواره‌ی بالا به افزونه‌ی گواهی (OID 1.3.6.1.4.1.11129.2.1.17) گواهی گواهی صادرشده اضافه می‌شوند. تغییرات نسبت به طرحواره‌ی گواهی Keymaster 2 پررنگ شده و توضیحاتی در مورد آنها ارائه شده است.

رابط برنامه‌نویسی جاوا

این بخش صرفاً جهت اطلاع‌رسانی است. مجریان اصلی نه API جاوا را پیاده‌سازی می‌کنند و نه از آن استفاده می‌کنند. این بخش برای کمک به مجریان در درک نحوه استفاده از این ویژگی توسط برنامه‌ها ارائه شده است. اجزای سیستم ممکن است از آن به طور متفاوتی استفاده کنند، به همین دلیل بسیار مهم است که این بخش به عنوان یک بخش عادی تلقی نشود.

،

Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and KeyMint (previously Keymaster) enforces restrictions that are difficult to subvert.

However, this is true only if the Keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available Keymaster hardware abstraction layer (HAL) and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, key attestation was introduced in Android 7.0 (Keymaster 2) and ID attestation was introduced in Android 8.0 (Keymaster 3).

Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Key attestation

To support key attestation, Android 7.0 introduced a set of tags, type, and method to the HAL.

برچسب‌ها

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

نوع

Keymaster 2 and below

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

AttestKey method

Keymaster 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 and below

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev is the Keymaster device structure.
  • keyToAttest is the key blob returned from generateKey for which the attestation is created.
  • attestParams is a list of any parameters necessary for attestation. This includes Tag::ATTESTATION_CHALLENGE and possibly Tag::RESET_SINCE_ID_ROTATION , as well as Tag::APPLICATION_ID and Tag::APPLICATION_DATA . The latter two are necessary to decrypt the key blob if they were specified during key generation.
  • certChain is the output parameter, which returns an array of certificates. Entry 0 is the attestation certificate, meaning it certifies the key from keyToAttest and contains the attestation extension.

The attestKey method is considered a public key operation on the attested key, because it can be called at any time and doesn't need to meet authorization constraints. For example, if the attested key needs user authentication for use, an attestation can be generated without user authentication.

Attestation certificate

The attestation certificate is a standard X.509 certificate, with an optional attestation extension that contains a description of the attested key. The certificate is signed with a certified attestation key . The attestation key might use a different algorithm than the key being attested.

The attestation certificate contains the fields in the table below and can't contain any additional fields. Some fields specify a fixed field value. CTS tests validate that the certificate content is exactly as defined.

Certificate SEQUENCE

Field name (see RFC 5280 ) ارزش
tbsCertificate TBSCertificate SEQUENCE
signatureAlgorithm AlgorithmIdentifier of algorithm used to sign key:
ECDSA for EC keys, RSA for RSA keys.
signatureValue BIT STRING, signature computed on ASN.1 DER-encoded tbsCertificate.

TBSCertificate SEQUENCE

Field name (see RFC 5280 ) ارزش
version INTEGER 2 (means v3 certificate)
serialNumber INTEGER 1 (fixed value: same on all certs)
signature AlgorithmIdentifier of algorithm used to sign key: ECDSA for EC keys, RSA for RSA keys.
issuer Same as the subject field of the batch attestation key.
validity SEQUENCE of two dates, containing the values of Tag::ACTIVE_DATETIME and Tag::USAGE_EXPIRE_DATETIME . Those values are in milliseconds since Jan 1, 1970. See RFC 5280 for correct date representations in certificates.
If Tag::ACTIVE_DATETIME is not present, use the value of Tag::CREATION_DATETIME . If Tag::USAGE_EXPIRE_DATETIME is not present, use the expiration date of the batch attestation key certificate.
subject CN = "Android Keystore Key" (fixed value: same on all certs)
subjectPublicKeyInfo SubjectPublicKeyInfo containing attested public key.
extensions/Key Usage digitalSignature: set if key has purpose KeyPurpose::SIGN or KeyPurpose::VERIFY . All other bits unset.
extensions/CRL Distribution Points Value TBD
extensions/"attestation" The OID is 1.3.6.1.4.1.11129.2.1.17; the content is defined in the Attestation extension section below. As with all X.509 certificate extensions, the content is represented as an OCTET_STRING containing a DER encoding of the attestation SEQUENCE.

Attestation extension

The attestation extension has OID 1.3.6.1.4.1.11129.2.1.17 . It contains information about the key pair being attested and the state of the device at key generation time.

The Keymaster/KeyMint tag types defined in the AIDL interface specification are translated to ASN.1 types as follows:

KeyMint or Keymaster type ASN.1 type یادداشت‌ها
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Milliseconds since Jan 1, 1970 00:00:00 GMT.
BOOL NULL Tag presence means true, absence means false.
BIGNUM No tags have this type, so no mapping is defined.
BYTES OCTET_STRING

طرحواره

The attestation extension content is described by the following ASN.1 schema. The ASN.1 schema for the AuthorizationList is also used to import encrypted keys . Any fields which will not appear in the attestation extension are noted as such.

Version 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۳۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۱۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۴ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۲ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

نسخه ۱ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

KeyDescription fields

attestationVersion
The ASN.1 schema version.
ارزش KeyMint or Keymaster version
۱ Keymaster version 2.0
۲ Keymaster version 3.0
۳ Keymaster version 4.0
۴ Keymaster version 4.1
100 KeyMint version 1.0
۲۰۰ KeyMint version 2.0
۳۰۰ KeyMint version 3.0
۴۰۰ KeyMint version 4.0
۵۰۰ KeyMint version 5.0
attestationSecurityLevel

The security level of the location where the attested key is stored.

keymasterVersion / keyMintVersion
The version of the KeyMint or Keymaster HAL implementation.
ارزش KeyMint or Keymaster version
۲ Keymaster version 2.0
۳ Keymaster version 3.0
۴ Keymaster version 4.0
۴۱ Keymaster version 4.1
100 KeyMint version 1.0
۲۰۰ KeyMint version 2.0
۳۰۰ KeyMint version 3.0
۴۰۰ KeyMint version 4.0
۵۰۰ KeyMint version 5.0
keymasterSecurityLevel / keyMintSecurityLevel
The security level of the KeyMint or Keymaster implementation.
attestationChallenge
The challenge provided at key generation time.
uniqueId
A privacy-sensitive device identifier that system apps can request at key generation time. If the unique ID is not requested, this field is empty. For details, see the Unique ID section.
softwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the Android system. This information is collected or generated by code in the platform. It can be trusted as long as the device is running an operating system that complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
hardwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the device's Trusted Execution Environment (TEE) or StrongBox . This information is collected or generated by code in the secure hardware and is not controlled by the platform. For example, information can come from the bootloader or through a secure communication channel that does not involve trusting the platform.

SecurityLevel values

The SecurityLevel value indicates the extent to which a Keystore-related element (for example, key pair and attestation) is resilient to attack.

ارزش Meaning
Software Secure as long as the device's Android system complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
TrustedEnvironment Secure as long as the TEE is not compromised. The isolation requirements for TEEs are defined in sections 9.11 [C-1-1] through [C-1-4] of the Android Compatibility Definition Document. TEEs are highly resistant to remote compromise and moderately resistant to compromise by direct hardware attack.
StrongBox Secure as long as StrongBox is not compromised. StrongBox is implemented in a secure element similar to a hardware security module. The implementation requirements for StrongBox are defined in section 9.11.2 of the Android Compatibility Definition Document. StrongBox is highly resistant to remote compromise and compromise by direct hardware attack (for example, physical tampering and side-channel attacks).

AuthorizationList fields

Each field corresponds to a Keymaster/KeyMint authorization tag from the AIDL interface specification . The specification is the source of truth about authorization tags: their meaning, the format of their contents, whether they are expected to appear in the softwareEnforced or hardwareEnforced fields in the KeyDescription object, whether they are mutually exclusive with other tags, etc. All AuthorizationList fields are optional.

Each field has an EXPLICIT context-specific tag equal to the KeyMint or Keymaster tag number, which enables a more compact representation of the data in the AuthorizationList . The ASN.1 parser must therefore know the expected data type for each context-specific tag. For example, Tag::USER_AUTH_TYPE is defined as ENUM | 504 . In the attestation extension schema, the purpose field in the AuthorizationList is specified as userAuthType [504] EXPLICIT INTEGER OPTIONAL . Its ASN.1 encoding will therefore contain the context-specific tag 504 instead of the UNIVERSAL class tag for the ASN.1 type INTEGER , which is 10 .

The following fields are present in attestations generated by KeyMint 5:
purpose
Corresponds to the Tag::PURPOSE authorization tag, which uses a tag ID value of 1.
algorithm

Corresponds to the Tag::ALGORITHM authorization tag, which uses a tag ID value of 2.

In an attestation AuthorizationList object, the algorithm value is always RSA , EC , or ML_DSA .

keySize
Corresponds to the Tag::KEY_SIZE authorization tag, which uses a tag ID value of 3.
blockMode
Corresponds to the Tag::BLOCK_MODE authorization tag, which uses a tag ID value of 4.
digest
Corresponds to the Tag::DIGEST authorization tag, which uses a tag ID value of 5.
padding
Corresponds to the Tag::PADDING authorization tag, which uses a tag ID value of 6.
callerNonce
Corresponds to the Tag::CALLER_NONCE authorization tag, which uses a tag ID value of 7. This tag is never present in attestations.
minMacLength
Corresponds to the Tag::MIN_MAC_LENGTH authorization tag, which uses a tag ID value of 8. This tag is never present in attestations.
ecCurve

Corresponds to the Tag::EC_CURVE authorization tag, which uses a tag ID value of 10.

The set of parameters used to generate an elliptic curve (EC) key pair, which uses ECDSA for signing and verification, within the Android system keystore.

mlDsaVariant

Present only in key attestation version >= 500.

Corresponds to the Tag::ML_DSA_VARIANT authorization tag, which uses a tag ID value of 11.

rsaPublicExponent
Corresponds to the Tag::RSA_PUBLIC_EXPONENT authorization tag, which uses a tag ID value of 200.
mgfDigest

Present only in key attestation version >= 100.

Corresponds to the Tag::RSA_OAEP_MGF_DIGEST KeyMint authorization tag, which uses a tag ID value of 203.
rollbackResistance

Present only in key attestation version >= 3.

Corresponds to the Tag::ROLLBACK_RESISTANCE authorization tag, which uses a tag ID value of 303.

earlyBootOnly

Present only in key attestation version >= 4.

Corresponds to the Tag::EARLY_BOOT_ONLY authorization tag, which uses a tag ID value of 305.

activeDateTime
Corresponds to the Tag::ACTIVE_DATETIME authorization tag, which uses a tag ID value of 400.
originationExpireDateTime
Corresponds to the Tag::ORIGINATION_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 401.
usageExpireDateTime
Corresponds to the Tag::USAGE_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 402.
usageCountLimit
Corresponds to the Tag::USAGE_COUNT_LIMIT authorization tag, which uses a tag ID value of 405.
userSecureId
Corresponds to the Tag::USER_SECURE_ID authorization tag, which uses a tag ID value of 502. This tag is never present in attestations.
noAuthRequired

Corresponds to the Tag::NO_AUTH_REQUIRED authorization tag, which uses a tag ID value of 503.

userAuthType
Corresponds to the Tag::USER_AUTH_TYPE authorization tag, which uses a tag ID value of 504.
authTimeout
Corresponds to the Tag::AUTH_TIMEOUT authorization tag, which uses a tag ID value of 505.
allowWhileOnBody

Corresponds to the Tag::ALLOW_WHILE_ON_BODY authorization tag, which uses a tag ID value of 506.

Allows the key to be used after its authentication timeout period if the user is still wearing the device on their body. Note that a secure on-body sensor determines whether the device is being worn on the user's body.

trustedUserPresenceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_USER_PRESENCE_REQUIRED authorization tag, which uses a tag ID value of 507.

Specifies that this key is usable only if the user has provided proof of physical presence. Several examples include the following:

  • For a StrongBox key, a hardware button hardwired to a pin on the StrongBox device.
  • For a TEE key, fingerprint authentication provides proof of presence as long as the TEE has exclusive control of the scanner and performs the fingerprint matching process.
trustedConfirmationReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_CONFIRMATION_REQUIRED authorization tag, which uses a tag ID value of 508.

Specifies that the key is usable only if the user provides confirmation of the data to be signed using an approval token. For more information about how to obtain user confirmation, see Android Protected Confirmation .

Note: This tag is only applicable to keys that use the SIGN purpose.

unlockedDeviceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::UNLOCKED_DEVICE_REQUIRED authorization tag, which uses a tag ID value of 509.

creationDateTime
Corresponds to the Tag::CREATION_DATETIME authorization tag, which uses a tag ID value of 701.
origin

Corresponds to the Tag::ORIGIN authorization tag, which uses a tag ID value of 702.

rootOfTrust

Corresponds to the Tag::ROOT_OF_TRUST authorization tag, which uses a tag ID value of 704.

For more details, see the section describing the RootOfTrust data structure.

osVersion

Corresponds to the Tag::OS_VERSION authorization tag, which uses a tag ID value of 705.

The version of the Android operating system associated with the Keymaster, specified as a six-digit integer. For example, version 8.1.0 is represented as 080100.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

osPatchLevel

Corresponds to the Tag::OS_PATCHLEVEL authorization tag, which uses a tag ID value of 706.

The month and year associated with the security patch that is being used within KeyMint (previously Keymaster), specified as a six-digit integer. For example, the August 2018 patch is represented as 201808.

Prefer using this field over vendorPatchLevel or bootPatchLevel for checking whether a device has been recently patched.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

attestationApplicationId

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_APPLICATION_ID authorization tag, which uses a tag ID value of 709.

For more details, see the section describing the AttestationApplicationId data structure.

attestationIdBrand

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_BRAND authorization tag, which uses a tag ID value of 710.

attestationIdDevice

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_DEVICE authorization tag, which uses a tag ID value of 711.

attestationIdProduct

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_PRODUCT authorization tag, which uses a tag ID value of 712.

attestationIdSerial

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_SERIAL authorization tag, which uses a tag ID value of 713.

attestationIdImei

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_IMEI authorization tag, which uses a tag ID value of 714.

attestationIdMeid

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MEID authorization tag, which uses a tag ID value of 715.

attestationIdManufacturer

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MANUFACTURER authorization tag, which uses a tag ID value of 716.

attestationIdModel

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MODEL authorization tag, which uses a tag ID value of 717.

vendorPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::VENDOR_PATCHLEVEL authorization tag, which uses a tag ID value of 718.

Specifies the vendor image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the vendor's 2018-08-05 security patch installed, this value would be 20180805.

bootPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::BOOT_PATCHLEVEL authorization tag, which uses a tag ID value of 719.

Specifies the kernel image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the kernel's 2018-08-05 security patch installed, this value would be 20180805.

deviceUniqueAttestation

Present only in key attestation versions >= 4.

Corresponds to the Tag::DEVICE_UNIQUE_ATTESTATION authorization tag, which uses a tag ID value of 720.

attestationIdSecondImei

Present only in key attestation versions >= 300.

Corresponds to the Tag::ATTESTATION_ID_SECOND_IMEI authorization tag, which uses a tag ID value of 723.

moduleHash

Present only in key attestation versions >= 400.

Corresponds to the Tag::MODULE_HASH authorization tag, which uses a tag ID value of 724.

RootOfTrust fields

verifiedBootKey
A secure hash of the public key used to verify the integrity and authenticity of all code that executes during device boot up as part of Verified Boot . SHA-256 is recommended.
deviceLocked
Whether the device's bootloader is locked. true means that the device booted a signed image that was successfully verified by Verified Boot .
verifiedBootState
The device's Verified Boot state .
verifiedBootHash
A digest of all data protected by Verified Boot . For devices that use the Android Verified Boot reference implementation, this field contains the VBMeta digest .

VerifiedBootState values

ارزش Corresponding boot state Meaning
Verified GREEN A full chain of trust extends from a hardware-protected root of trust to the bootloader and all partitions verified by Verified Boot . In this state, the verifiedBootKey field contains the hash of the embedded root of trust , which is the certificate embedded in the device's ROM by the device manufacturer in the factory.
SelfSigned YELLOW Same as Verified , except that the verification was done using a root of trust configured by the user instead of the root of trust embedded by the manufacturer in the factory. In this state, the verifiedBootKey field contains the hash of the public key configured by the user.
Unverified ORANGE The device's bootloader is unlocked, so a chain of trust cannot be established. The device can be freely modified, so the device's integrity must be verified by the user out-of-band. In this state the verifiedBootKey field contains 32 bytes of zeroes.
Failed RED The device failed verification. In this state, there are no guarantees about the contents of the other RootOfTrust fields.

AttestationApplicationId

This field reflects the Android platform's belief as to which apps are allowed to use the secret key material under attestation. It can contain multiple packages if and only if multiple packages share the same UID. The AttestationApplicationId field in AuthorizationList is of type OCTET_STRING and is formatted according to the following ASN.1 schema: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
A set of AttestationPackageInfo objects, each providing a package's name and version number.
signature_digests

A set of SHA-256 digests of the app's signing certificates. An app can have multiple signing key certificate chains. For each, the "leaf" certificate is digested and placed in the signature_digests field. The field name is misleading, since the digested data is the app's signing certificates, not the app signatures, because it is named for the Signature class returned by a call to getPackageInfo() . The following code snippet shows an example set: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Provisioning information extension

The provisioning information extension has OID 1.3.6.1.4.1.11129.2.1.30 . The extension provides information that's known about the device by the provisioning server.

طرحواره

The extension value consists of Concise Binary Object Representation (CBOR) data that conforms to this Concise Data Definition Language (CDDL) schema: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

The map is unversioned and new optional fields may be added.

certs_issued

An approximate number of certificates issued to the device in the last 30 days. This value can be used as a signal for potential abuse if the value is greater than average by some orders of magnitude.

validated_attested_entity

A string indicating the certified origin of the attested key, directly vouched for by the chipset manufacturer. For example, STRONG_BOX or TEE .

is_lost_device

A boolean indicating whether the device has been reported as lost. If present and true, the certificate was provisioned for a device currently marked as lost.

Attestation keys

Two keys, one RSA and one ECDSA, and the corresponding certificate chains, are securely provisioned into the device.

Android 12 introduces Remote Key Provisioning . This feature provides devices in the field with per-app ECDSA P-256 attestation certificates, which are shorter-lived than factory-provisioned certificates.

شناسه منحصر به فرد

The Unique ID is a 128-bit value that identifies the device, but only for a limited period of time. The value is computed with: 

HMAC_SHA256(T || C || R, HBK)

کجا:

  • T is the "temporal counter value", computed by dividing the value of Tag::CREATION_DATETIME by 2592000000, dropping any remainder. T changes every 30 days (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C is the value of Tag::APPLICATION_ID
  • R is 1 if Tag::RESET_SINCE_ID_ROTATION is present in the attest_params parameter to the attest_key call, or 0 if the tag is not present.
  • HBK is a unique hardware-bound secret known to the Trusted Execution Environment and never revealed by it. The secret contains at least 128 bits of entropy and is unique to the individual device (probabilistic uniqueness is acceptable given the 128 bits of entropy). HBK should be derived from fused key material via HMAC or AES_CMAC.

Truncate the HMAC_SHA256 output to 128 bits.

Multiple IMEIs

Android 14 adds support for multiple IMEIs in the Android Key Attestation record. OEMs can implement this feature by adding a KeyMint tag for a second IMEI. It is becoming increasingly common for devices to have multiple cellular radios and OEMs can now support devices with two IMEIs.

OEMs are required to have a secondary IMEI, if present on their devices, to be provisioned to the KeyMint implementation(s) so that those implementations can attest to it in the same way they attest to the first IMEI.

ID attestation

Android 8.0 includes optional support for ID attestation for devices with Keymaster 3. ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. Although an optional feature, it is highly recommended that all Keymaster 3 implementations provide support for it because being able to prove the device's identity enables use cases such as true zero-touch remote configuration to be more secure (because the remote side can be certain it is talking to the right device, not a device spoofing its identity).

ID attestation works by creating copies of the device's hardware identifiers that only the TEE can access before the device leaves the factory. A user can unlock the device's bootloader and change the system software and the identifiers reported by the Android frameworks. The copies of the identifiers held by the TEE cannot be manipulated in this way, ensuring that device ID attestation only attests to the device's original hardware identifiers, thereby thwarting spoofing attempts.

The main API surface for ID attestation builds on top of the existing key attestation mechanism introduced with Keymaster 2. When requesting an attestation certificate for a key held by Keymaster, the caller can request that the device's hardware identifiers be included in the attestation certificate's metadata. If the key is held in the TEE, the certificate chains back to a known root of trust. The recipient of such a certificate can verify that the certificate and its contents, including the hardware identifiers, were written by the TEE. When asked to include hardware identifiers in the attestation certificate, the TEE attests only to the identifiers held in its storage, as populated on the factory floor.

Storage properties

The storage that holds the device's identifiers needs to have these properties:

  • The values derived from the device's original identifiers are copied to the storage before the device leaves the factory.
  • The destroyAttestationIds() method can permanently destroy this copy of the identifier-derived data. Permanent destruction means the data is completely removed so neither a factory reset nor any other procedure performed on the device can restore it. This is especially important for devices where a user has unlocked the bootloader and changed the system software and modified the identifiers returned by Android frameworks.
  • RMA facilities should have the ability to generate fresh copies of the hardware identifier-derived data. This way, a device that passes through RMA can perform ID attestation again. The mechanism used by RMA facilities must be protected so that users cannot invoke it themselves, as that would allow them to obtain attestations of spoofed IDs.
  • No code other than Keymaster trusted app in the TEE is able to read the identifier-derived data kept in the storage.
  • The storage is tamper-evident: If the content of the storage has been modified, the TEE treats it the same as if the copies of the content had been destroyed and refuses all ID attestation attempts. This is implemented by signing or MACing the storage as described below .
  • The storage does not hold the original identifiers. Because ID attestation involves a challenge, the caller always supplies the identifiers to be attested. The TEE only needs to verify that these match the values they originally had. Storing secure hashes of the original values rather than the values enables this verification.

ساخت و ساز

To create an implementation that has the properties listed above, store the ID-derived values in the following construction S. Do not store other copies of the ID values, excepting the normal places in the system, which a device owner can modify by rooting: 

S = D || HMAC(HBK, D)

کجا:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC is the HMAC construction with an appropriate secure hash (SHA-256 recommended)
  • HBK is a hardware-bound key not used for any other purpose
  • ID 1 ...ID n are the original ID values; association of a particular value to a particular index is implementation-dependent, as different devices have different numbers of identifiers
  • || represents concatenation

Because the HMAC outputs are fixed size, no headers or other structure are required to be able to find individual ID hashes, or the HMAC of D. In addition to checking provided values to perform attestation, implementations need to validate S by extracting D from S, computing HMAC(HBK, D) and comparing it to the value in S to verify that no individual IDs were modified/corrupted. Also, implementations must use constant-time comparisons for all individual ID elements and the validation of S. Comparison time must be constant regardless of the number of IDs provided and the correct matching of any part of the test.

Hardware identifiers

ID attestation supports the following hardware identifiers:

  1. Brand name, as returned by Build.BRAND in Android
  2. Device name, as returned by Build.DEVICE in Android
  3. Product name, as returned by Build.PRODUCT in Android
  4. Manufacturer name, as returned by Build.MANUFACTURER in Android
  5. Model name, as returned by Build.MODEL in Android
  6. شماره سریال
  7. IMEIs of all radios
  8. MEIDs of all radios

To support device ID attestation, a device attests to these identifiers. All devices running Android have the first six and they are necessary for this feature to work. If the device has any integrated cellular radios, the device must also support attestation for the IMEIs and/or MEIDs of the radios.

ID attestation is requested by performing a key attestation and including the device identifiers to attest in the request. The identifiers are tagged as:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

The identifier to attest is a UTF-8 encoded byte string. This format applies to numerical identifiers, as well. Each identifier to attest is expressed as a UTF-8 encoded string.

If the device does not support ID attestation (or destroyAttestationIds() was previously called and the device can no longer attest its IDs), any key attestation request that includes one or more of these tags fails with ErrorCode::CANNOT_ATTEST_IDS .

If the device supports ID attestation and one or more of the above tags have been included in a key attestation request, the TEE verifies the identifier supplied with each of the tags matches its copy of the hardware identifiers. If one or more identifiers do not match, the entire attestation fails with ErrorCode::CANNOT_ATTEST_IDS . It is valid for the same tag to be supplied multiple times. This can be useful, for example, when attesting IMEIs: A device can have multiple radios with multiple IMEIs. An attestation request is valid if the value supplied with each ATTESTATION_ID_IMEI matches one of the device's radios. The same applies to all other tags.

If attestation is successful, the attested IDs is added to the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) of the issued attestation certificate, using the schema from above . Changes from the Keymaster 2 attestation schema are bolded , with comments.

رابط برنامه‌نویسی جاوا

This section is informational only. Keymaster implementers neither implement nor use the Java API. This is provided to help implementers understand how the feature is used by apps. System components might use it differently, which is why it's crucial this section not be treated as normative.

،

Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and KeyMint (previously Keymaster) enforces restrictions that are difficult to subvert.

However, this is true only if the Keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available Keymaster hardware abstraction layer (HAL) and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, key attestation was introduced in Android 7.0 (Keymaster 2) and ID attestation was introduced in Android 8.0 (Keymaster 3).

Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Key attestation

To support key attestation, Android 7.0 introduced a set of tags, type, and method to the HAL.

برچسب‌ها

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

نوع

Keymaster 2 and below

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

AttestKey method

Keymaster 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 and below

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev is the Keymaster device structure.
  • keyToAttest is the key blob returned from generateKey for which the attestation is created.
  • attestParams is a list of any parameters necessary for attestation. This includes Tag::ATTESTATION_CHALLENGE and possibly Tag::RESET_SINCE_ID_ROTATION , as well as Tag::APPLICATION_ID and Tag::APPLICATION_DATA . The latter two are necessary to decrypt the key blob if they were specified during key generation.
  • certChain is the output parameter, which returns an array of certificates. Entry 0 is the attestation certificate, meaning it certifies the key from keyToAttest and contains the attestation extension.

The attestKey method is considered a public key operation on the attested key, because it can be called at any time and doesn't need to meet authorization constraints. For example, if the attested key needs user authentication for use, an attestation can be generated without user authentication.

Attestation certificate

The attestation certificate is a standard X.509 certificate, with an optional attestation extension that contains a description of the attested key. The certificate is signed with a certified attestation key . The attestation key might use a different algorithm than the key being attested.

The attestation certificate contains the fields in the table below and can't contain any additional fields. Some fields specify a fixed field value. CTS tests validate that the certificate content is exactly as defined.

Certificate SEQUENCE

Field name (see RFC 5280 ) ارزش
tbsCertificate TBSCertificate SEQUENCE
signatureAlgorithm AlgorithmIdentifier of algorithm used to sign key:
ECDSA for EC keys, RSA for RSA keys.
signatureValue BIT STRING, signature computed on ASN.1 DER-encoded tbsCertificate.

TBSCertificate SEQUENCE

Field name (see RFC 5280 ) ارزش
version INTEGER 2 (means v3 certificate)
serialNumber INTEGER 1 (fixed value: same on all certs)
signature AlgorithmIdentifier of algorithm used to sign key: ECDSA for EC keys, RSA for RSA keys.
issuer Same as the subject field of the batch attestation key.
validity SEQUENCE of two dates, containing the values of Tag::ACTIVE_DATETIME and Tag::USAGE_EXPIRE_DATETIME . Those values are in milliseconds since Jan 1, 1970. See RFC 5280 for correct date representations in certificates.
If Tag::ACTIVE_DATETIME is not present, use the value of Tag::CREATION_DATETIME . If Tag::USAGE_EXPIRE_DATETIME is not present, use the expiration date of the batch attestation key certificate.
subject CN = "Android Keystore Key" (fixed value: same on all certs)
subjectPublicKeyInfo SubjectPublicKeyInfo containing attested public key.
extensions/Key Usage digitalSignature: set if key has purpose KeyPurpose::SIGN or KeyPurpose::VERIFY . All other bits unset.
extensions/CRL Distribution Points Value TBD
extensions/"attestation" The OID is 1.3.6.1.4.1.11129.2.1.17; the content is defined in the Attestation extension section below. As with all X.509 certificate extensions, the content is represented as an OCTET_STRING containing a DER encoding of the attestation SEQUENCE.

Attestation extension

The attestation extension has OID 1.3.6.1.4.1.11129.2.1.17 . It contains information about the key pair being attested and the state of the device at key generation time.

The Keymaster/KeyMint tag types defined in the AIDL interface specification are translated to ASN.1 types as follows:

KeyMint or Keymaster type ASN.1 type یادداشت‌ها
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Milliseconds since Jan 1, 1970 00:00:00 GMT.
BOOL NULL Tag presence means true, absence means false.
BIGNUM No tags have this type, so no mapping is defined.
BYTES OCTET_STRING

طرحواره

The attestation extension content is described by the following ASN.1 schema. The ASN.1 schema for the AuthorizationList is also used to import encrypted keys . Any fields which will not appear in the attestation extension are noted as such.

Version 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۳۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۱۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۴ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۲ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

نسخه ۱ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

KeyDescription fields

attestationVersion
The ASN.1 schema version.
ارزش KeyMint or Keymaster version
۱ Keymaster version 2.0
۲ Keymaster version 3.0
۳ Keymaster version 4.0
۴ Keymaster version 4.1
100 KeyMint version 1.0
۲۰۰ KeyMint version 2.0
۳۰۰ KeyMint version 3.0
۴۰۰ KeyMint version 4.0
۵۰۰ KeyMint version 5.0
attestationSecurityLevel

The security level of the location where the attested key is stored.

keymasterVersion / keyMintVersion
The version of the KeyMint or Keymaster HAL implementation.
ارزش KeyMint or Keymaster version
۲ Keymaster version 2.0
۳ Keymaster version 3.0
۴ Keymaster version 4.0
۴۱ Keymaster version 4.1
100 KeyMint version 1.0
۲۰۰ KeyMint version 2.0
۳۰۰ KeyMint version 3.0
۴۰۰ KeyMint version 4.0
۵۰۰ KeyMint version 5.0
keymasterSecurityLevel / keyMintSecurityLevel
The security level of the KeyMint or Keymaster implementation.
attestationChallenge
The challenge provided at key generation time.
uniqueId
A privacy-sensitive device identifier that system apps can request at key generation time. If the unique ID is not requested, this field is empty. For details, see the Unique ID section.
softwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the Android system. This information is collected or generated by code in the platform. It can be trusted as long as the device is running an operating system that complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
hardwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the device's Trusted Execution Environment (TEE) or StrongBox . This information is collected or generated by code in the secure hardware and is not controlled by the platform. For example, information can come from the bootloader or through a secure communication channel that does not involve trusting the platform.

SecurityLevel values

The SecurityLevel value indicates the extent to which a Keystore-related element (for example, key pair and attestation) is resilient to attack.

ارزش Meaning
Software Secure as long as the device's Android system complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
TrustedEnvironment Secure as long as the TEE is not compromised. The isolation requirements for TEEs are defined in sections 9.11 [C-1-1] through [C-1-4] of the Android Compatibility Definition Document. TEEs are highly resistant to remote compromise and moderately resistant to compromise by direct hardware attack.
StrongBox Secure as long as StrongBox is not compromised. StrongBox is implemented in a secure element similar to a hardware security module. The implementation requirements for StrongBox are defined in section 9.11.2 of the Android Compatibility Definition Document. StrongBox is highly resistant to remote compromise and compromise by direct hardware attack (for example, physical tampering and side-channel attacks).

AuthorizationList fields

Each field corresponds to a Keymaster/KeyMint authorization tag from the AIDL interface specification . The specification is the source of truth about authorization tags: their meaning, the format of their contents, whether they are expected to appear in the softwareEnforced or hardwareEnforced fields in the KeyDescription object, whether they are mutually exclusive with other tags, etc. All AuthorizationList fields are optional.

Each field has an EXPLICIT context-specific tag equal to the KeyMint or Keymaster tag number, which enables a more compact representation of the data in the AuthorizationList . The ASN.1 parser must therefore know the expected data type for each context-specific tag. For example, Tag::USER_AUTH_TYPE is defined as ENUM | 504 . In the attestation extension schema, the purpose field in the AuthorizationList is specified as userAuthType [504] EXPLICIT INTEGER OPTIONAL . Its ASN.1 encoding will therefore contain the context-specific tag 504 instead of the UNIVERSAL class tag for the ASN.1 type INTEGER , which is 10 .

The following fields are present in attestations generated by KeyMint 5:
purpose
Corresponds to the Tag::PURPOSE authorization tag, which uses a tag ID value of 1.
algorithm

Corresponds to the Tag::ALGORITHM authorization tag, which uses a tag ID value of 2.

In an attestation AuthorizationList object, the algorithm value is always RSA , EC , or ML_DSA .

keySize
Corresponds to the Tag::KEY_SIZE authorization tag, which uses a tag ID value of 3.
blockMode
Corresponds to the Tag::BLOCK_MODE authorization tag, which uses a tag ID value of 4.
digest
Corresponds to the Tag::DIGEST authorization tag, which uses a tag ID value of 5.
padding
Corresponds to the Tag::PADDING authorization tag, which uses a tag ID value of 6.
callerNonce
Corresponds to the Tag::CALLER_NONCE authorization tag, which uses a tag ID value of 7. This tag is never present in attestations.
minMacLength
Corresponds to the Tag::MIN_MAC_LENGTH authorization tag, which uses a tag ID value of 8. This tag is never present in attestations.
ecCurve

Corresponds to the Tag::EC_CURVE authorization tag, which uses a tag ID value of 10.

The set of parameters used to generate an elliptic curve (EC) key pair, which uses ECDSA for signing and verification, within the Android system keystore.

mlDsaVariant

Present only in key attestation version >= 500.

Corresponds to the Tag::ML_DSA_VARIANT authorization tag, which uses a tag ID value of 11.

rsaPublicExponent
Corresponds to the Tag::RSA_PUBLIC_EXPONENT authorization tag, which uses a tag ID value of 200.
mgfDigest

Present only in key attestation version >= 100.

Corresponds to the Tag::RSA_OAEP_MGF_DIGEST KeyMint authorization tag, which uses a tag ID value of 203.
rollbackResistance

Present only in key attestation version >= 3.

Corresponds to the Tag::ROLLBACK_RESISTANCE authorization tag, which uses a tag ID value of 303.

earlyBootOnly

Present only in key attestation version >= 4.

Corresponds to the Tag::EARLY_BOOT_ONLY authorization tag, which uses a tag ID value of 305.

activeDateTime
Corresponds to the Tag::ACTIVE_DATETIME authorization tag, which uses a tag ID value of 400.
originationExpireDateTime
Corresponds to the Tag::ORIGINATION_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 401.
usageExpireDateTime
Corresponds to the Tag::USAGE_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 402.
usageCountLimit
Corresponds to the Tag::USAGE_COUNT_LIMIT authorization tag, which uses a tag ID value of 405.
userSecureId
Corresponds to the Tag::USER_SECURE_ID authorization tag, which uses a tag ID value of 502. This tag is never present in attestations.
noAuthRequired

Corresponds to the Tag::NO_AUTH_REQUIRED authorization tag, which uses a tag ID value of 503.

userAuthType
Corresponds to the Tag::USER_AUTH_TYPE authorization tag, which uses a tag ID value of 504.
authTimeout
Corresponds to the Tag::AUTH_TIMEOUT authorization tag, which uses a tag ID value of 505.
allowWhileOnBody

Corresponds to the Tag::ALLOW_WHILE_ON_BODY authorization tag, which uses a tag ID value of 506.

Allows the key to be used after its authentication timeout period if the user is still wearing the device on their body. Note that a secure on-body sensor determines whether the device is being worn on the user's body.

trustedUserPresenceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_USER_PRESENCE_REQUIRED authorization tag, which uses a tag ID value of 507.

Specifies that this key is usable only if the user has provided proof of physical presence. Several examples include the following:

  • For a StrongBox key, a hardware button hardwired to a pin on the StrongBox device.
  • For a TEE key, fingerprint authentication provides proof of presence as long as the TEE has exclusive control of the scanner and performs the fingerprint matching process.
trustedConfirmationReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_CONFIRMATION_REQUIRED authorization tag, which uses a tag ID value of 508.

Specifies that the key is usable only if the user provides confirmation of the data to be signed using an approval token. For more information about how to obtain user confirmation, see Android Protected Confirmation .

Note: This tag is only applicable to keys that use the SIGN purpose.

unlockedDeviceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::UNLOCKED_DEVICE_REQUIRED authorization tag, which uses a tag ID value of 509.

creationDateTime
Corresponds to the Tag::CREATION_DATETIME authorization tag, which uses a tag ID value of 701.
origin

Corresponds to the Tag::ORIGIN authorization tag, which uses a tag ID value of 702.

rootOfTrust

Corresponds to the Tag::ROOT_OF_TRUST authorization tag, which uses a tag ID value of 704.

For more details, see the section describing the RootOfTrust data structure.

osVersion

Corresponds to the Tag::OS_VERSION authorization tag, which uses a tag ID value of 705.

The version of the Android operating system associated with the Keymaster, specified as a six-digit integer. For example, version 8.1.0 is represented as 080100.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

osPatchLevel

Corresponds to the Tag::OS_PATCHLEVEL authorization tag, which uses a tag ID value of 706.

The month and year associated with the security patch that is being used within KeyMint (previously Keymaster), specified as a six-digit integer. For example, the August 2018 patch is represented as 201808.

Prefer using this field over vendorPatchLevel or bootPatchLevel for checking whether a device has been recently patched.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

attestationApplicationId

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_APPLICATION_ID authorization tag, which uses a tag ID value of 709.

For more details, see the section describing the AttestationApplicationId data structure.

attestationIdBrand

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_BRAND authorization tag, which uses a tag ID value of 710.

attestationIdDevice

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_DEVICE authorization tag, which uses a tag ID value of 711.

attestationIdProduct

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_PRODUCT authorization tag, which uses a tag ID value of 712.

attestationIdSerial

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_SERIAL authorization tag, which uses a tag ID value of 713.

attestationIdImei

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_IMEI authorization tag, which uses a tag ID value of 714.

attestationIdMeid

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MEID authorization tag, which uses a tag ID value of 715.

attestationIdManufacturer

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MANUFACTURER authorization tag, which uses a tag ID value of 716.

attestationIdModel

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MODEL authorization tag, which uses a tag ID value of 717.

vendorPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::VENDOR_PATCHLEVEL authorization tag, which uses a tag ID value of 718.

Specifies the vendor image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the vendor's 2018-08-05 security patch installed, this value would be 20180805.

bootPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::BOOT_PATCHLEVEL authorization tag, which uses a tag ID value of 719.

Specifies the kernel image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the kernel's 2018-08-05 security patch installed, this value would be 20180805.

deviceUniqueAttestation

Present only in key attestation versions >= 4.

Corresponds to the Tag::DEVICE_UNIQUE_ATTESTATION authorization tag, which uses a tag ID value of 720.

attestationIdSecondImei

Present only in key attestation versions >= 300.

Corresponds to the Tag::ATTESTATION_ID_SECOND_IMEI authorization tag, which uses a tag ID value of 723.

moduleHash

Present only in key attestation versions >= 400.

Corresponds to the Tag::MODULE_HASH authorization tag, which uses a tag ID value of 724.

RootOfTrust fields

verifiedBootKey
A secure hash of the public key used to verify the integrity and authenticity of all code that executes during device boot up as part of Verified Boot . SHA-256 is recommended.
deviceLocked
Whether the device's bootloader is locked. true means that the device booted a signed image that was successfully verified by Verified Boot .
verifiedBootState
The device's Verified Boot state .
verifiedBootHash
A digest of all data protected by Verified Boot . For devices that use the Android Verified Boot reference implementation, this field contains the VBMeta digest .

VerifiedBootState values

ارزش Corresponding boot state Meaning
Verified GREEN A full chain of trust extends from a hardware-protected root of trust to the bootloader and all partitions verified by Verified Boot . In this state, the verifiedBootKey field contains the hash of the embedded root of trust , which is the certificate embedded in the device's ROM by the device manufacturer in the factory.
SelfSigned YELLOW Same as Verified , except that the verification was done using a root of trust configured by the user instead of the root of trust embedded by the manufacturer in the factory. In this state, the verifiedBootKey field contains the hash of the public key configured by the user.
Unverified ORANGE The device's bootloader is unlocked, so a chain of trust cannot be established. The device can be freely modified, so the device's integrity must be verified by the user out-of-band. In this state the verifiedBootKey field contains 32 bytes of zeroes.
Failed RED The device failed verification. In this state, there are no guarantees about the contents of the other RootOfTrust fields.

AttestationApplicationId

This field reflects the Android platform's belief as to which apps are allowed to use the secret key material under attestation. It can contain multiple packages if and only if multiple packages share the same UID. The AttestationApplicationId field in AuthorizationList is of type OCTET_STRING and is formatted according to the following ASN.1 schema: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
A set of AttestationPackageInfo objects, each providing a package's name and version number.
signature_digests

A set of SHA-256 digests of the app's signing certificates. An app can have multiple signing key certificate chains. For each, the "leaf" certificate is digested and placed in the signature_digests field. The field name is misleading, since the digested data is the app's signing certificates, not the app signatures, because it is named for the Signature class returned by a call to getPackageInfo() . The following code snippet shows an example set: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Provisioning information extension

The provisioning information extension has OID 1.3.6.1.4.1.11129.2.1.30 . The extension provides information that's known about the device by the provisioning server.

طرحواره

The extension value consists of Concise Binary Object Representation (CBOR) data that conforms to this Concise Data Definition Language (CDDL) schema: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

The map is unversioned and new optional fields may be added.

certs_issued

An approximate number of certificates issued to the device in the last 30 days. This value can be used as a signal for potential abuse if the value is greater than average by some orders of magnitude.

validated_attested_entity

A string indicating the certified origin of the attested key, directly vouched for by the chipset manufacturer. For example, STRONG_BOX or TEE .

is_lost_device

A boolean indicating whether the device has been reported as lost. If present and true, the certificate was provisioned for a device currently marked as lost.

Attestation keys

Two keys, one RSA and one ECDSA, and the corresponding certificate chains, are securely provisioned into the device.

Android 12 introduces Remote Key Provisioning . This feature provides devices in the field with per-app ECDSA P-256 attestation certificates, which are shorter-lived than factory-provisioned certificates.

شناسه منحصر به فرد

The Unique ID is a 128-bit value that identifies the device, but only for a limited period of time. The value is computed with: 

HMAC_SHA256(T || C || R, HBK)

کجا:

  • T is the "temporal counter value", computed by dividing the value of Tag::CREATION_DATETIME by 2592000000, dropping any remainder. T changes every 30 days (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C is the value of Tag::APPLICATION_ID
  • R is 1 if Tag::RESET_SINCE_ID_ROTATION is present in the attest_params parameter to the attest_key call, or 0 if the tag is not present.
  • HBK is a unique hardware-bound secret known to the Trusted Execution Environment and never revealed by it. The secret contains at least 128 bits of entropy and is unique to the individual device (probabilistic uniqueness is acceptable given the 128 bits of entropy). HBK should be derived from fused key material via HMAC or AES_CMAC.

Truncate the HMAC_SHA256 output to 128 bits.

Multiple IMEIs

Android 14 adds support for multiple IMEIs in the Android Key Attestation record. OEMs can implement this feature by adding a KeyMint tag for a second IMEI. It is becoming increasingly common for devices to have multiple cellular radios and OEMs can now support devices with two IMEIs.

OEMs are required to have a secondary IMEI, if present on their devices, to be provisioned to the KeyMint implementation(s) so that those implementations can attest to it in the same way they attest to the first IMEI.

ID attestation

Android 8.0 includes optional support for ID attestation for devices with Keymaster 3. ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. Although an optional feature, it is highly recommended that all Keymaster 3 implementations provide support for it because being able to prove the device's identity enables use cases such as true zero-touch remote configuration to be more secure (because the remote side can be certain it is talking to the right device, not a device spoofing its identity).

ID attestation works by creating copies of the device's hardware identifiers that only the TEE can access before the device leaves the factory. A user can unlock the device's bootloader and change the system software and the identifiers reported by the Android frameworks. The copies of the identifiers held by the TEE cannot be manipulated in this way, ensuring that device ID attestation only attests to the device's original hardware identifiers, thereby thwarting spoofing attempts.

The main API surface for ID attestation builds on top of the existing key attestation mechanism introduced with Keymaster 2. When requesting an attestation certificate for a key held by Keymaster, the caller can request that the device's hardware identifiers be included in the attestation certificate's metadata. If the key is held in the TEE, the certificate chains back to a known root of trust. The recipient of such a certificate can verify that the certificate and its contents, including the hardware identifiers, were written by the TEE. When asked to include hardware identifiers in the attestation certificate, the TEE attests only to the identifiers held in its storage, as populated on the factory floor.

Storage properties

The storage that holds the device's identifiers needs to have these properties:

  • The values derived from the device's original identifiers are copied to the storage before the device leaves the factory.
  • The destroyAttestationIds() method can permanently destroy this copy of the identifier-derived data. Permanent destruction means the data is completely removed so neither a factory reset nor any other procedure performed on the device can restore it. This is especially important for devices where a user has unlocked the bootloader and changed the system software and modified the identifiers returned by Android frameworks.
  • RMA facilities should have the ability to generate fresh copies of the hardware identifier-derived data. This way, a device that passes through RMA can perform ID attestation again. The mechanism used by RMA facilities must be protected so that users cannot invoke it themselves, as that would allow them to obtain attestations of spoofed IDs.
  • No code other than Keymaster trusted app in the TEE is able to read the identifier-derived data kept in the storage.
  • The storage is tamper-evident: If the content of the storage has been modified, the TEE treats it the same as if the copies of the content had been destroyed and refuses all ID attestation attempts. This is implemented by signing or MACing the storage as described below .
  • The storage does not hold the original identifiers. Because ID attestation involves a challenge, the caller always supplies the identifiers to be attested. The TEE only needs to verify that these match the values they originally had. Storing secure hashes of the original values rather than the values enables this verification.

ساخت و ساز

To create an implementation that has the properties listed above, store the ID-derived values in the following construction S. Do not store other copies of the ID values, excepting the normal places in the system, which a device owner can modify by rooting: 

S = D || HMAC(HBK, D)

کجا:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC is the HMAC construction with an appropriate secure hash (SHA-256 recommended)
  • HBK is a hardware-bound key not used for any other purpose
  • ID 1 ...ID n are the original ID values; association of a particular value to a particular index is implementation-dependent, as different devices have different numbers of identifiers
  • || represents concatenation

Because the HMAC outputs are fixed size, no headers or other structure are required to be able to find individual ID hashes, or the HMAC of D. In addition to checking provided values to perform attestation, implementations need to validate S by extracting D from S, computing HMAC(HBK, D) and comparing it to the value in S to verify that no individual IDs were modified/corrupted. Also, implementations must use constant-time comparisons for all individual ID elements and the validation of S. Comparison time must be constant regardless of the number of IDs provided and the correct matching of any part of the test.

Hardware identifiers

ID attestation supports the following hardware identifiers:

  1. Brand name, as returned by Build.BRAND in Android
  2. Device name, as returned by Build.DEVICE in Android
  3. Product name, as returned by Build.PRODUCT in Android
  4. Manufacturer name, as returned by Build.MANUFACTURER in Android
  5. Model name, as returned by Build.MODEL in Android
  6. شماره سریال
  7. IMEIs of all radios
  8. MEIDs of all radios

To support device ID attestation, a device attests to these identifiers. All devices running Android have the first six and they are necessary for this feature to work. If the device has any integrated cellular radios, the device must also support attestation for the IMEIs and/or MEIDs of the radios.

ID attestation is requested by performing a key attestation and including the device identifiers to attest in the request. The identifiers are tagged as:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

The identifier to attest is a UTF-8 encoded byte string. This format applies to numerical identifiers, as well. Each identifier to attest is expressed as a UTF-8 encoded string.

If the device does not support ID attestation (or destroyAttestationIds() was previously called and the device can no longer attest its IDs), any key attestation request that includes one or more of these tags fails with ErrorCode::CANNOT_ATTEST_IDS .

If the device supports ID attestation and one or more of the above tags have been included in a key attestation request, the TEE verifies the identifier supplied with each of the tags matches its copy of the hardware identifiers. If one or more identifiers do not match, the entire attestation fails with ErrorCode::CANNOT_ATTEST_IDS . It is valid for the same tag to be supplied multiple times. This can be useful, for example, when attesting IMEIs: A device can have multiple radios with multiple IMEIs. An attestation request is valid if the value supplied with each ATTESTATION_ID_IMEI matches one of the device's radios. The same applies to all other tags.

If attestation is successful, the attested IDs is added to the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) of the issued attestation certificate, using the schema from above . Changes from the Keymaster 2 attestation schema are bolded , with comments.

رابط برنامه‌نویسی جاوا

This section is informational only. Keymaster implementers neither implement nor use the Java API. This is provided to help implementers understand how the feature is used by apps. System components might use it differently, which is why it's crucial this section not be treated as normative.

،

Keystore provides a more secure place to create, store, and use cryptographic keys in a controlled way. When hardware-backed key storage is available and used, key material is more secure against extraction from the device, and KeyMint (previously Keymaster) enforces restrictions that are difficult to subvert.

However, this is true only if the Keystore keys are known to be in hardware-backed storage. In Keymaster 1, there was no way for apps or remote servers to reliably verify if this was the case. The keystore daemon loaded the available Keymaster hardware abstraction layer (HAL) and believed whatever the HAL said with respect to hardware backing of keys.

To remedy this, key attestation was introduced in Android 7.0 (Keymaster 2) and ID attestation was introduced in Android 8.0 (Keymaster 3).

Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.

ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI.

Key attestation

To support key attestation, Android 7.0 introduced a set of tags, type, and method to the HAL.

برچسب‌ها

  • Tag::ATTESTATION_CHALLENGE
  • Tag::INCLUDE_UNIQUE_ID
  • Tag::RESET_SINCE_ID_ROTATION

نوع

Keymaster 2 and below

typedef struct {
    keymaster_blob_t* entries;
    size_t entry_count;
} keymaster_cert_chain_t;

AttestKey method

Keymaster 3

    attestKey(vec<uint8_t> keyToAttest, vec<KeyParameter> attestParams)
        generates(ErrorCode error, vec<vec<uint8_t>> certChain);

Keymaster 2 and below

keymaster_error_t (*attest_key)(const struct keymaster2_device* dev,
        const keymaster_key_blob_t* key_to_attest,
        const keymaster_key_param_set_t* attest_params,
        keymaster_cert_chain_t* cert_chain);
  • dev is the Keymaster device structure.
  • keyToAttest is the key blob returned from generateKey for which the attestation is created.
  • attestParams is a list of any parameters necessary for attestation. This includes Tag::ATTESTATION_CHALLENGE and possibly Tag::RESET_SINCE_ID_ROTATION , as well as Tag::APPLICATION_ID and Tag::APPLICATION_DATA . The latter two are necessary to decrypt the key blob if they were specified during key generation.
  • certChain is the output parameter, which returns an array of certificates. Entry 0 is the attestation certificate, meaning it certifies the key from keyToAttest and contains the attestation extension.

The attestKey method is considered a public key operation on the attested key, because it can be called at any time and doesn't need to meet authorization constraints. For example, if the attested key needs user authentication for use, an attestation can be generated without user authentication.

Attestation certificate

The attestation certificate is a standard X.509 certificate, with an optional attestation extension that contains a description of the attested key. The certificate is signed with a certified attestation key . The attestation key might use a different algorithm than the key being attested.

The attestation certificate contains the fields in the table below and can't contain any additional fields. Some fields specify a fixed field value. CTS tests validate that the certificate content is exactly as defined.

Certificate SEQUENCE

Field name (see RFC 5280 ) ارزش
tbsCertificate TBSCertificate SEQUENCE
signatureAlgorithm AlgorithmIdentifier of algorithm used to sign key:
ECDSA for EC keys, RSA for RSA keys.
signatureValue BIT STRING, signature computed on ASN.1 DER-encoded tbsCertificate.

TBSCertificate SEQUENCE

Field name (see RFC 5280 ) ارزش
version INTEGER 2 (means v3 certificate)
serialNumber INTEGER 1 (fixed value: same on all certs)
signature AlgorithmIdentifier of algorithm used to sign key: ECDSA for EC keys, RSA for RSA keys.
issuer Same as the subject field of the batch attestation key.
validity SEQUENCE of two dates, containing the values of Tag::ACTIVE_DATETIME and Tag::USAGE_EXPIRE_DATETIME . Those values are in milliseconds since Jan 1, 1970. See RFC 5280 for correct date representations in certificates.
If Tag::ACTIVE_DATETIME is not present, use the value of Tag::CREATION_DATETIME . If Tag::USAGE_EXPIRE_DATETIME is not present, use the expiration date of the batch attestation key certificate.
subject CN = "Android Keystore Key" (fixed value: same on all certs)
subjectPublicKeyInfo SubjectPublicKeyInfo containing attested public key.
extensions/Key Usage digitalSignature: set if key has purpose KeyPurpose::SIGN or KeyPurpose::VERIFY . All other bits unset.
extensions/CRL Distribution Points Value TBD
extensions/"attestation" The OID is 1.3.6.1.4.1.11129.2.1.17; the content is defined in the Attestation extension section below. As with all X.509 certificate extensions, the content is represented as an OCTET_STRING containing a DER encoding of the attestation SEQUENCE.

Attestation extension

The attestation extension has OID 1.3.6.1.4.1.11129.2.1.17 . It contains information about the key pair being attested and the state of the device at key generation time.

The Keymaster/KeyMint tag types defined in the AIDL interface specification are translated to ASN.1 types as follows:

KeyMint or Keymaster type ASN.1 type یادداشت‌ها
ENUM INTEGER
ENUM_REP SET of INTEGER
UINT INTEGER
UINT_REP SET of INTEGER
ULONG INTEGER
ULONG_REP SET of INTEGER
DATE INTEGER Milliseconds since Jan 1, 1970 00:00:00 GMT.
BOOL NULL Tag presence means true, absence means false.
BIGNUM No tags have this type, so no mapping is defined.
BYTES OCTET_STRING

طرحواره

The attestation extension content is described by the following ASN.1 schema. The ASN.1 schema for the AuthorizationList is also used to import encrypted keys . Any fields which will not appear in the attestation extension are noted as such.

Version 500 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 500
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 500
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    mlDsaVariant                [11] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 400 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 400
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 400
    keyMintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
    moduleHash                 [724] EXPLICIT OCTET_STRING OPTIONAL,
}

Modules ::= SET OF Module
Module ::= SEQUENCE {
    packageName                OCTET_STRING,
    version                    INTEGER,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۳۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 300
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 300
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
    attestationIdSecondImei    [723] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 200 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 200
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 200
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۱۰۰ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 100
    attestationSecurityLevel     SecurityLevel,
    keyMintVersion               INTEGER, # Value 100
    keymintSecurityLevel         SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    mgfDigest                  [203] EXPLICIT SET OF INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    earlyBootOnly              [305] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    usageCountLimit            [405] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۴ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 4
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 41
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
    deviceUniqueAttestation    [720] EXPLICIT NULL OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

Version 3 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 3
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 4
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
    StrongBox                    (2),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    blockMode                    [4] EXPLICIT SET OF INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    callerNonce                  [7] EXPLICIT NULL OPTIONAL, # Non-attestation
    minMacLength                 [8] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    rollbackResistance         [303] EXPLICIT NULL OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    userSecureId               [502] EXPLICIT INTEGER OPTIONAL, # Non-attestation
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    trustedUserPresenceReq     [507] EXPLICIT NULL OPTIONAL,
    trustedConfirmationReq     [508] EXPLICIT NULL OPTIONAL,
    unlockedDeviceReq          [509] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
    vendorPatchLevel           [718] EXPLICIT INTEGER OPTIONAL,
    bootPatchLevel             [719] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
    verifiedBootHash           OCTET_STRING,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

نسخه ۲ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 2
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 3
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
    attestationApplicationId   [709] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdBrand         [710] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdDevice        [711] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdProduct       [712] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdSerial        [713] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdImei          [714] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdMeid          [715] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdManufacturer  [716] EXPLICIT OCTET_STRING OPTIONAL,
    attestationIdModel         [717] EXPLICIT OCTET_STRING OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey           OCTET_STRING,
    deviceLocked              BOOLEAN,
    verifiedBootState         VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                  (0),
    SelfSigned                (1),
    Unverified                (2),
    Failed                    (3),
}

نسخه ۱ 

KeyDescription ::= SEQUENCE {
    attestationVersion           INTEGER, # Value 1
    attestationSecurityLevel     SecurityLevel,
    keymasterVersion             INTEGER, # Value 2
    keymasterSecurityLevel       SecurityLevel,
    attestationChallenge         OCTET_STRING,
    uniqueId                     OCTET_STRING,
    softwareEnforced             AuthorizationList,
    hardwareEnforced             AuthorizationList,
}

SecurityLevel ::= ENUMERATED {
    Software                     (0),
    TrustedEnvironment           (1),
}

AuthorizationList ::= SEQUENCE {
    purpose                      [1] EXPLICIT SET OF INTEGER OPTIONAL,
    algorithm                    [2] EXPLICIT INTEGER OPTIONAL,
    keySize                      [3] EXPLICIT INTEGER OPTIONAL,
    digest                       [5] EXPLICIT SET OF INTEGER OPTIONAL,
    padding                      [6] EXPLICIT SET OF INTEGER OPTIONAL,
    ecCurve                     [10] EXPLICIT INTEGER OPTIONAL,
    rsaPublicExponent          [200] EXPLICIT INTEGER OPTIONAL,
    activeDateTime             [400] EXPLICIT INTEGER OPTIONAL,
    originationExpireDateTime  [401] EXPLICIT INTEGER OPTIONAL,
    usageExpireDateTime        [402] EXPLICIT INTEGER OPTIONAL,
    noAuthRequired             [503] EXPLICIT NULL OPTIONAL,
    userAuthType               [504] EXPLICIT INTEGER OPTIONAL,
    authTimeout                [505] EXPLICIT INTEGER OPTIONAL,
    allowWhileOnBody           [506] EXPLICIT NULL OPTIONAL,
    allApplications            [600] EXPLICIT NULL OPTIONAL,
    creationDateTime           [701] EXPLICIT INTEGER OPTIONAL,
    origin                     [702] EXPLICIT INTEGER OPTIONAL,
    rollbackResistant          [703] EXPLICIT NULL OPTIONAL,
    rootOfTrust                [704] EXPLICIT RootOfTrust OPTIONAL,
    osVersion                  [705] EXPLICIT INTEGER OPTIONAL,
    osPatchLevel               [706] EXPLICIT INTEGER OPTIONAL,
}

RootOfTrust ::= SEQUENCE {
    verifiedBootKey            OCTET_STRING,
    deviceLocked               BOOLEAN,
    verifiedBootState          VerifiedBootState,
}

VerifiedBootState ::= ENUMERATED {
    Verified                   (0),
    SelfSigned                 (1),
    Unverified                 (2),
    Failed                     (3),
}

KeyDescription fields

attestationVersion
The ASN.1 schema version.
ارزش KeyMint or Keymaster version
۱ Keymaster version 2.0
۲ Keymaster version 3.0
۳ Keymaster version 4.0
۴ Keymaster version 4.1
100 KeyMint version 1.0
۲۰۰ KeyMint version 2.0
۳۰۰ KeyMint version 3.0
۴۰۰ KeyMint version 4.0
۵۰۰ KeyMint version 5.0
attestationSecurityLevel

The security level of the location where the attested key is stored.

keymasterVersion / keyMintVersion
The version of the KeyMint or Keymaster HAL implementation.
ارزش KeyMint or Keymaster version
۲ Keymaster version 2.0
۳ Keymaster version 3.0
۴ Keymaster version 4.0
۴۱ Keymaster version 4.1
100 KeyMint version 1.0
۲۰۰ KeyMint version 2.0
۳۰۰ KeyMint version 3.0
۴۰۰ KeyMint version 4.0
۵۰۰ KeyMint version 5.0
keymasterSecurityLevel / keyMintSecurityLevel
The security level of the KeyMint or Keymaster implementation.
attestationChallenge
The challenge provided at key generation time.
uniqueId
A privacy-sensitive device identifier that system apps can request at key generation time. If the unique ID is not requested, this field is empty. For details, see the Unique ID section.
softwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the Android system. This information is collected or generated by code in the platform. It can be trusted as long as the device is running an operating system that complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
hardwareEnforced
The KeyMint or Keymaster authorization list that is enforced by the device's Trusted Execution Environment (TEE) or StrongBox . This information is collected or generated by code in the secure hardware and is not controlled by the platform. For example, information can come from the bootloader or through a secure communication channel that does not involve trusting the platform.

SecurityLevel values

The SecurityLevel value indicates the extent to which a Keystore-related element (for example, key pair and attestation) is resilient to attack.

ارزش Meaning
Software Secure as long as the device's Android system complies with the Android Platform Security Model (that is, the device's bootloader is locked and the verifiedBootState is Verified ).
TrustedEnvironment Secure as long as the TEE is not compromised. The isolation requirements for TEEs are defined in sections 9.11 [C-1-1] through [C-1-4] of the Android Compatibility Definition Document. TEEs are highly resistant to remote compromise and moderately resistant to compromise by direct hardware attack.
StrongBox Secure as long as StrongBox is not compromised. StrongBox is implemented in a secure element similar to a hardware security module. The implementation requirements for StrongBox are defined in section 9.11.2 of the Android Compatibility Definition Document. StrongBox is highly resistant to remote compromise and compromise by direct hardware attack (for example, physical tampering and side-channel attacks).

AuthorizationList fields

Each field corresponds to a Keymaster/KeyMint authorization tag from the AIDL interface specification . The specification is the source of truth about authorization tags: their meaning, the format of their contents, whether they are expected to appear in the softwareEnforced or hardwareEnforced fields in the KeyDescription object, whether they are mutually exclusive with other tags, etc. All AuthorizationList fields are optional.

Each field has an EXPLICIT context-specific tag equal to the KeyMint or Keymaster tag number, which enables a more compact representation of the data in the AuthorizationList . The ASN.1 parser must therefore know the expected data type for each context-specific tag. For example, Tag::USER_AUTH_TYPE is defined as ENUM | 504 . In the attestation extension schema, the purpose field in the AuthorizationList is specified as userAuthType [504] EXPLICIT INTEGER OPTIONAL . Its ASN.1 encoding will therefore contain the context-specific tag 504 instead of the UNIVERSAL class tag for the ASN.1 type INTEGER , which is 10 .

The following fields are present in attestations generated by KeyMint 5:
purpose
Corresponds to the Tag::PURPOSE authorization tag, which uses a tag ID value of 1.
algorithm

Corresponds to the Tag::ALGORITHM authorization tag, which uses a tag ID value of 2.

In an attestation AuthorizationList object, the algorithm value is always RSA , EC , or ML_DSA .

keySize
Corresponds to the Tag::KEY_SIZE authorization tag, which uses a tag ID value of 3.
blockMode
Corresponds to the Tag::BLOCK_MODE authorization tag, which uses a tag ID value of 4.
digest
Corresponds to the Tag::DIGEST authorization tag, which uses a tag ID value of 5.
padding
Corresponds to the Tag::PADDING authorization tag, which uses a tag ID value of 6.
callerNonce
Corresponds to the Tag::CALLER_NONCE authorization tag, which uses a tag ID value of 7. This tag is never present in attestations.
minMacLength
Corresponds to the Tag::MIN_MAC_LENGTH authorization tag, which uses a tag ID value of 8. This tag is never present in attestations.
ecCurve

Corresponds to the Tag::EC_CURVE authorization tag, which uses a tag ID value of 10.

The set of parameters used to generate an elliptic curve (EC) key pair, which uses ECDSA for signing and verification, within the Android system keystore.

mlDsaVariant

Present only in key attestation version >= 500.

Corresponds to the Tag::ML_DSA_VARIANT authorization tag, which uses a tag ID value of 11.

rsaPublicExponent
Corresponds to the Tag::RSA_PUBLIC_EXPONENT authorization tag, which uses a tag ID value of 200.
mgfDigest

Present only in key attestation version >= 100.

Corresponds to the Tag::RSA_OAEP_MGF_DIGEST KeyMint authorization tag, which uses a tag ID value of 203.
rollbackResistance

Present only in key attestation version >= 3.

Corresponds to the Tag::ROLLBACK_RESISTANCE authorization tag, which uses a tag ID value of 303.

earlyBootOnly

Present only in key attestation version >= 4.

Corresponds to the Tag::EARLY_BOOT_ONLY authorization tag, which uses a tag ID value of 305.

activeDateTime
Corresponds to the Tag::ACTIVE_DATETIME authorization tag, which uses a tag ID value of 400.
originationExpireDateTime
Corresponds to the Tag::ORIGINATION_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 401.
usageExpireDateTime
Corresponds to the Tag::USAGE_EXPIRE_DATETIME authorization tag, which uses a tag ID value of 402.
usageCountLimit
Corresponds to the Tag::USAGE_COUNT_LIMIT authorization tag, which uses a tag ID value of 405.
userSecureId
Corresponds to the Tag::USER_SECURE_ID authorization tag, which uses a tag ID value of 502. This tag is never present in attestations.
noAuthRequired

Corresponds to the Tag::NO_AUTH_REQUIRED authorization tag, which uses a tag ID value of 503.

userAuthType
Corresponds to the Tag::USER_AUTH_TYPE authorization tag, which uses a tag ID value of 504.
authTimeout
Corresponds to the Tag::AUTH_TIMEOUT authorization tag, which uses a tag ID value of 505.
allowWhileOnBody

Corresponds to the Tag::ALLOW_WHILE_ON_BODY authorization tag, which uses a tag ID value of 506.

Allows the key to be used after its authentication timeout period if the user is still wearing the device on their body. Note that a secure on-body sensor determines whether the device is being worn on the user's body.

trustedUserPresenceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_USER_PRESENCE_REQUIRED authorization tag, which uses a tag ID value of 507.

Specifies that this key is usable only if the user has provided proof of physical presence. Several examples include the following:

  • For a StrongBox key, a hardware button hardwired to a pin on the StrongBox device.
  • For a TEE key, fingerprint authentication provides proof of presence as long as the TEE has exclusive control of the scanner and performs the fingerprint matching process.
trustedConfirmationReq

Present only in key attestation version >= 3.

Corresponds to the Tag::TRUSTED_CONFIRMATION_REQUIRED authorization tag, which uses a tag ID value of 508.

Specifies that the key is usable only if the user provides confirmation of the data to be signed using an approval token. For more information about how to obtain user confirmation, see Android Protected Confirmation .

Note: This tag is only applicable to keys that use the SIGN purpose.

unlockedDeviceReq

Present only in key attestation version >= 3.

Corresponds to the Tag::UNLOCKED_DEVICE_REQUIRED authorization tag, which uses a tag ID value of 509.

creationDateTime
Corresponds to the Tag::CREATION_DATETIME authorization tag, which uses a tag ID value of 701.
origin

Corresponds to the Tag::ORIGIN authorization tag, which uses a tag ID value of 702.

rootOfTrust

Corresponds to the Tag::ROOT_OF_TRUST authorization tag, which uses a tag ID value of 704.

For more details, see the section describing the RootOfTrust data structure.

osVersion

Corresponds to the Tag::OS_VERSION authorization tag, which uses a tag ID value of 705.

The version of the Android operating system associated with the Keymaster, specified as a six-digit integer. For example, version 8.1.0 is represented as 080100.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

osPatchLevel

Corresponds to the Tag::OS_PATCHLEVEL authorization tag, which uses a tag ID value of 706.

The month and year associated with the security patch that is being used within KeyMint (previously Keymaster), specified as a six-digit integer. For example, the August 2018 patch is represented as 201808.

Prefer using this field over vendorPatchLevel or bootPatchLevel for checking whether a device has been recently patched.

Only Keymaster version 1.0 or higher includes this value in the authorization list.

attestationApplicationId

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_APPLICATION_ID authorization tag, which uses a tag ID value of 709.

For more details, see the section describing the AttestationApplicationId data structure.

attestationIdBrand

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_BRAND authorization tag, which uses a tag ID value of 710.

attestationIdDevice

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_DEVICE authorization tag, which uses a tag ID value of 711.

attestationIdProduct

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_PRODUCT authorization tag, which uses a tag ID value of 712.

attestationIdSerial

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_SERIAL authorization tag, which uses a tag ID value of 713.

attestationIdImei

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_IMEI authorization tag, which uses a tag ID value of 714.

attestationIdMeid

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MEID authorization tag, which uses a tag ID value of 715.

attestationIdManufacturer

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MANUFACTURER authorization tag, which uses a tag ID value of 716.

attestationIdModel

Present only in key attestation versions >= 2.

Corresponds to the Tag::ATTESTATION_ID_MODEL authorization tag, which uses a tag ID value of 717.

vendorPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::VENDOR_PATCHLEVEL authorization tag, which uses a tag ID value of 718.

Specifies the vendor image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the vendor's 2018-08-05 security patch installed, this value would be 20180805.

bootPatchLevel

Present only in key attestation versions >= 3.

Corresponds to the Tag::BOOT_PATCHLEVEL authorization tag, which uses a tag ID value of 719.

Specifies the kernel image security patch level that must be installed on the device for this key to be used. The value is the integer formed by taking the security patch level and removing the dashes. For example, if a key were generated on an Android device with the kernel's 2018-08-05 security patch installed, this value would be 20180805.

deviceUniqueAttestation

Present only in key attestation versions >= 4.

Corresponds to the Tag::DEVICE_UNIQUE_ATTESTATION authorization tag, which uses a tag ID value of 720.

attestationIdSecondImei

Present only in key attestation versions >= 300.

Corresponds to the Tag::ATTESTATION_ID_SECOND_IMEI authorization tag, which uses a tag ID value of 723.

moduleHash

Present only in key attestation versions >= 400.

Corresponds to the Tag::MODULE_HASH authorization tag, which uses a tag ID value of 724.

RootOfTrust fields

verifiedBootKey
A secure hash of the public key used to verify the integrity and authenticity of all code that executes during device boot up as part of Verified Boot . SHA-256 is recommended.
deviceLocked
Whether the device's bootloader is locked. true means that the device booted a signed image that was successfully verified by Verified Boot .
verifiedBootState
The device's Verified Boot state .
verifiedBootHash
A digest of all data protected by Verified Boot . For devices that use the Android Verified Boot reference implementation, this field contains the VBMeta digest .

VerifiedBootState values

ارزش Corresponding boot state Meaning
Verified GREEN A full chain of trust extends from a hardware-protected root of trust to the bootloader and all partitions verified by Verified Boot . In this state, the verifiedBootKey field contains the hash of the embedded root of trust , which is the certificate embedded in the device's ROM by the device manufacturer in the factory.
SelfSigned YELLOW Same as Verified , except that the verification was done using a root of trust configured by the user instead of the root of trust embedded by the manufacturer in the factory. In this state, the verifiedBootKey field contains the hash of the public key configured by the user.
Unverified ORANGE The device's bootloader is unlocked, so a chain of trust cannot be established. The device can be freely modified, so the device's integrity must be verified by the user out-of-band. In this state the verifiedBootKey field contains 32 bytes of zeroes.
Failed RED The device failed verification. In this state, there are no guarantees about the contents of the other RootOfTrust fields.

AttestationApplicationId

This field reflects the Android platform's belief as to which apps are allowed to use the secret key material under attestation. It can contain multiple packages if and only if multiple packages share the same UID. The AttestationApplicationId field in AuthorizationList is of type OCTET_STRING and is formatted according to the following ASN.1 schema: 

AttestationApplicationId ::= SEQUENCE {
    package_infos  SET OF AttestationPackageInfo,
    signature_digests  SET OF OCTET_STRING,
}

AttestationPackageInfo ::= SEQUENCE {
    package_name  OCTET_STRING,
    version  INTEGER,
}
package_infos
A set of AttestationPackageInfo objects, each providing a package's name and version number.
signature_digests

A set of SHA-256 digests of the app's signing certificates. An app can have multiple signing key certificate chains. For each, the "leaf" certificate is digested and placed in the signature_digests field. The field name is misleading, since the digested data is the app's signing certificates, not the app signatures, because it is named for the Signature class returned by a call to getPackageInfo() . The following code snippet shows an example set: 

{SHA256(PackageInfo.signature[0]), SHA256(PackageInfo.signature[1]), ...}

Provisioning information extension

The provisioning information extension has OID 1.3.6.1.4.1.11129.2.1.30 . The extension provides information that's known about the device by the provisioning server.

طرحواره

The extension value consists of Concise Binary Object Representation (CBOR) data that conforms to this Concise Data Definition Language (CDDL) schema: 

  {
        1 : int,       ; certificates issued
        4 : string,    ; validated attested entity (STRONG_BOX/TEE)
      ? 6 : bool,      ; is lost device
  }

The map is unversioned and new optional fields may be added.

certs_issued

An approximate number of certificates issued to the device in the last 30 days. This value can be used as a signal for potential abuse if the value is greater than average by some orders of magnitude.

validated_attested_entity

A string indicating the certified origin of the attested key, directly vouched for by the chipset manufacturer. For example, STRONG_BOX or TEE .

is_lost_device

A boolean indicating whether the device has been reported as lost. If present and true, the certificate was provisioned for a device currently marked as lost.

Attestation keys

Two keys, one RSA and one ECDSA, and the corresponding certificate chains, are securely provisioned into the device.

Android 12 introduces Remote Key Provisioning . This feature provides devices in the field with per-app ECDSA P-256 attestation certificates, which are shorter-lived than factory-provisioned certificates.

شناسه منحصر به فرد

The Unique ID is a 128-bit value that identifies the device, but only for a limited period of time. The value is computed with: 

HMAC_SHA256(T || C || R, HBK)

کجا:

  • T is the "temporal counter value", computed by dividing the value of Tag::CREATION_DATETIME by 2592000000, dropping any remainder. T changes every 30 days (2592000000 = 30 * 24 * 60 * 60 * 1000).
  • C is the value of Tag::APPLICATION_ID
  • R is 1 if Tag::RESET_SINCE_ID_ROTATION is present in the attest_params parameter to the attest_key call, or 0 if the tag is not present.
  • HBK is a unique hardware-bound secret known to the Trusted Execution Environment and never revealed by it. The secret contains at least 128 bits of entropy and is unique to the individual device (probabilistic uniqueness is acceptable given the 128 bits of entropy). HBK should be derived from fused key material via HMAC or AES_CMAC.

Truncate the HMAC_SHA256 output to 128 bits.

Multiple IMEIs

Android 14 adds support for multiple IMEIs in the Android Key Attestation record. OEMs can implement this feature by adding a KeyMint tag for a second IMEI. It is becoming increasingly common for devices to have multiple cellular radios and OEMs can now support devices with two IMEIs.

OEMs are required to have a secondary IMEI, if present on their devices, to be provisioned to the KeyMint implementation(s) so that those implementations can attest to it in the same way they attest to the first IMEI.

ID attestation

Android 8.0 includes optional support for ID attestation for devices with Keymaster 3. ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI. Although an optional feature, it is highly recommended that all Keymaster 3 implementations provide support for it because being able to prove the device's identity enables use cases such as true zero-touch remote configuration to be more secure (because the remote side can be certain it is talking to the right device, not a device spoofing its identity).

ID attestation works by creating copies of the device's hardware identifiers that only the TEE can access before the device leaves the factory. A user can unlock the device's bootloader and change the system software and the identifiers reported by the Android frameworks. The copies of the identifiers held by the TEE cannot be manipulated in this way, ensuring that device ID attestation only attests to the device's original hardware identifiers, thereby thwarting spoofing attempts.

The main API surface for ID attestation builds on top of the existing key attestation mechanism introduced with Keymaster 2. When requesting an attestation certificate for a key held by Keymaster, the caller can request that the device's hardware identifiers be included in the attestation certificate's metadata. If the key is held in the TEE, the certificate chains back to a known root of trust. The recipient of such a certificate can verify that the certificate and its contents, including the hardware identifiers, were written by the TEE. When asked to include hardware identifiers in the attestation certificate, the TEE attests only to the identifiers held in its storage, as populated on the factory floor.

Storage properties

The storage that holds the device's identifiers needs to have these properties:

  • The values derived from the device's original identifiers are copied to the storage before the device leaves the factory.
  • The destroyAttestationIds() method can permanently destroy this copy of the identifier-derived data. Permanent destruction means the data is completely removed so neither a factory reset nor any other procedure performed on the device can restore it. This is especially important for devices where a user has unlocked the bootloader and changed the system software and modified the identifiers returned by Android frameworks.
  • RMA facilities should have the ability to generate fresh copies of the hardware identifier-derived data. This way, a device that passes through RMA can perform ID attestation again. The mechanism used by RMA facilities must be protected so that users cannot invoke it themselves, as that would allow them to obtain attestations of spoofed IDs.
  • No code other than Keymaster trusted app in the TEE is able to read the identifier-derived data kept in the storage.
  • The storage is tamper-evident: If the content of the storage has been modified, the TEE treats it the same as if the copies of the content had been destroyed and refuses all ID attestation attempts. This is implemented by signing or MACing the storage as described below .
  • The storage does not hold the original identifiers. Because ID attestation involves a challenge, the caller always supplies the identifiers to be attested. The TEE only needs to verify that these match the values they originally had. Storing secure hashes of the original values rather than the values enables this verification.

ساخت و ساز

To create an implementation that has the properties listed above, store the ID-derived values in the following construction S. Do not store other copies of the ID values, excepting the normal places in the system, which a device owner can modify by rooting: 

S = D || HMAC(HBK, D)

کجا:

  • D = HMAC(HBK, ID 1 ) || HMAC(HBK, ID 2 ) || ... || HMAC(HBK, ID n )
  • HMAC is the HMAC construction with an appropriate secure hash (SHA-256 recommended)
  • HBK is a hardware-bound key not used for any other purpose
  • ID 1 ...ID n are the original ID values; association of a particular value to a particular index is implementation-dependent, as different devices have different numbers of identifiers
  • || represents concatenation

Because the HMAC outputs are fixed size, no headers or other structure are required to be able to find individual ID hashes, or the HMAC of D. In addition to checking provided values to perform attestation, implementations need to validate S by extracting D from S, computing HMAC(HBK, D) and comparing it to the value in S to verify that no individual IDs were modified/corrupted. Also, implementations must use constant-time comparisons for all individual ID elements and the validation of S. Comparison time must be constant regardless of the number of IDs provided and the correct matching of any part of the test.

Hardware identifiers

ID attestation supports the following hardware identifiers:

  1. Brand name, as returned by Build.BRAND in Android
  2. Device name, as returned by Build.DEVICE in Android
  3. Product name, as returned by Build.PRODUCT in Android
  4. Manufacturer name, as returned by Build.MANUFACTURER in Android
  5. Model name, as returned by Build.MODEL in Android
  6. شماره سریال
  7. IMEIs of all radios
  8. MEIDs of all radios

To support device ID attestation, a device attests to these identifiers. All devices running Android have the first six and they are necessary for this feature to work. If the device has any integrated cellular radios, the device must also support attestation for the IMEIs and/or MEIDs of the radios.

ID attestation is requested by performing a key attestation and including the device identifiers to attest in the request. The identifiers are tagged as:

  • ATTESTATION_ID_BRAND
  • ATTESTATION_ID_DEVICE
  • ATTESTATION_ID_PRODUCT
  • ATTESTATION_ID_MANUFACTURER
  • ATTESTATION_ID_MODEL
  • ATTESTATION_ID_SERIAL
  • ATTESTATION_ID_IMEI
  • ATTESTATION_ID_MEID

The identifier to attest is a UTF-8 encoded byte string. This format applies to numerical identifiers, as well. Each identifier to attest is expressed as a UTF-8 encoded string.

If the device does not support ID attestation (or destroyAttestationIds() was previously called and the device can no longer attest its IDs), any key attestation request that includes one or more of these tags fails with ErrorCode::CANNOT_ATTEST_IDS .

If the device supports ID attestation and one or more of the above tags have been included in a key attestation request, the TEE verifies the identifier supplied with each of the tags matches its copy of the hardware identifiers. If one or more identifiers do not match, the entire attestation fails with ErrorCode::CANNOT_ATTEST_IDS . It is valid for the same tag to be supplied multiple times. This can be useful, for example, when attesting IMEIs: A device can have multiple radios with multiple IMEIs. An attestation request is valid if the value supplied with each ATTESTATION_ID_IMEI matches one of the device's radios. The same applies to all other tags.

If attestation is successful, the attested IDs is added to the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) of the issued attestation certificate, using the schema from above . Changes from the Keymaster 2 attestation schema are bolded , with comments.

رابط برنامه‌نویسی جاوا

This section is informational only. Keymaster implementers neither implement nor use the Java API. This is provided to help implementers understand how the feature is used by apps. System components might use it differently, which is why it's crucial this section not be treated as normative.