Android Key Attestation Library/at.asitplus.attestation.android/AndroidAttestationConfiguration/AndroidAttestationConfiguration

AndroidAttestationConfiguration

@JvmOverloads
constructor(packageName: String, signatureDigests: List<ByteArray>, appVersion: Int? = null, androidVersion: Int? = null, patchLevel: PatchLevel? = null, requireStrongBox: Boolean = false, bootloaderUnlockAllowed: Boolean = false, requireRollbackResistance: Boolean = false, ignoreLeafValidity: Boolean = false, trustAnchors: List<PublicKey> = listOf( KeyFactory.getInstance("RSA") .generatePublic(X509EncodedKeySpec(Base64.getDecoder().decode(GOOGLE_ROOT_CA_PUB_KEY))) ), verificationSecondsOffset: Int = 0)

Parameters

packageName

Android app package name (e.g. at.asitplus.demo)

signatureDigests

SHA-256 digests of signature certificates used to sign the APK. This is a Google cloud signing certificate for production play store releases. Being able to specify multiple digests makes it easy to use development builds and production builds in parallel.

appVersion

optional parameter. If set, attestation enforces application version to be greater or equal to this parameter

patchLevel

optional parameter. If set, attestation enforces Security patch level to be greater or equal to this parameter

requireStrongBox

Set to true if StrongBox security level should be required

bootloaderUnlockAllowed

Set to true if unlocked bootloaders should be allowed. Attention: Allowing unlocked bootloaders in production effectively defeats the purpose of Key Attestation. Useful for debugging/testing

requireRollbackResistance

Unsupported by most devices. See Official Documentation

ignoreLeafValidity

Whether to ignore the timely validity of the leaf certificate (looking at you, Samsung!)

trustAnchors

Manually specify the trust anchor for HW-attested certificate chains. Defaults to google HW attestation key. Overriding this list is useful for automated end-to-end tests, for example.