verifyAttestation

Convenience method to verifies both Android Key Attestation or Apple App Attestation structures of the client (in attestationProof) if the device can be verified and challenge matches the attestation challenge. On Android, this is simply the certificate chain from the attestation certificate (i.e. the certificate corresponding to the key to be attested) up to one of the Google hardware attestation root certificates. on iOS this contains at least the AppAttest attestation statement. Calls verifyAttestationAndroid or verifyAttestationApple depending on the kind of attestation proof prpvoded.

For iOS clients it is optionally possible to pass clientData. In this case attestationProof must also contain an assertion at index 1, which, by default, is verified to match clientData. The signature counter in the attestation must be 0 and the signature counter in the assertion must be 1.

Passing a public key created in the same app on the iDevice's secure hardware as clientData effectively emulates Android's key attestation: Attesting such a secondary key through an assertion, proves that it was also created within the same app, on the same device, resulting in an attested key, which can then be used for general-purpose crypto. BEWARE if you pass the public key on iOS to be signed as is. iOS uses the ANSI X9.63 format represent public keys, so conversion is needed

See also