Server-Side Mobile Client Attestation Library/at.asitplus.attestation/DefaultAttestationService

DefaultAttestationService

class DefaultAttestationService(androidAttestationConfiguration: AndroidAttestationConfiguration, iosAttestationConfiguration: IOSAttestationConfiguration, clock: Clock = Clock.System, verificationTimeOffset: Duration = Duration.ZERO) : AttestationService

Default, functional Android Key Attestation and Apple App Attestation in all its glory.

Once configured, this class provides a streamlined interface for mobile client attestation

Parameters

androidAttestationConfiguration

Configuration for Android key attestation. See AndroidAttestationConfiguration for details

iosAttestationConfiguration

IOS AppAttest configuration. See IOSAttestationConfiguration for details.

clock

a clock to set the time of verification (used for certificate validity checks)

verificationTimeOffset

allows for fine-grained clock drift compensation (this duration is added to the certificate validity checks; can be negative.

Constructors

DefaultAttestationService

@JvmOverloads

constructor(androidAttestationConfigurationJ: AndroidAttestationConfiguration, iosAttestationConfigurationJ: IOSAttestationConfiguration, verificationTimeOffsetJ: Duration = java.time.Duration.ZERO, javaClock: Clock = java.time.Clock.systemUTC())

Java-friendly constructor with java.time types

constructor(androidAttestationConfiguration: AndroidAttestationConfiguration, iosAttestationConfiguration: IOSAttestationConfiguration, clock: Clock = Clock.System, verificationTimeOffset: Duration = Duration.ZERO)

Properties

android

open override val android: AttestationService.Android

ios

open override val ios: AttestationService.IOS

Groups ios-specific API to reduce toplevel clutter.

Functions

verifyAttestation

open override fun verifyAttestation(attestationProof: List<ByteArray>, challenge: ByteArray, clientData: ByteArray?): AttestationResult

Convenience method to verifies both Android Key Attestation or Apple App Attestation structures of the client (in attestationProof) if the device can be verified and challenge matches the attestation challenge. On Android, this is simply the certificate chain from the attestation certificate (i.e. the certificate corresponding to the key to be attested) up to one of the Google hardware attestation root certificates. on iOS this contains at least the AppAttest attestation statement. Calls verifyAttestationAndroid or verifyAttestationApple depending on the kind of attestation proof prpvoded.

verifyKeyAttestation

open fun <T : PublicKey> verifyKeyAttestation(attestationProof: List<ByteArray>, expectedChallenge: ByteArray, keyToBeAttested: T): KeyAttestation<T>

Verifies key attestation for both Android and Apple devices.