google / android-key-attestation Goto Github PK

Android Key Attestation validation library

License: Apache License 2.0

Java 96.71% Starlark 3.29%

android-key-attestation's Introduction

Android Key Attestation Library

This library uses the Bouncy Castle ASN.1 parser to extract information from an Android attestation data structure to verify that a key pair has been generated in a hardware-protected environment of an Android device. It is maintained in tandem with Android's key attestation capabilities and is meant for production use.

This repository contains a server sample code that shows how to validate an Android attestation certificate chain outside the Android framework. This is the recommended best practice, since if the Android device is rooted or otherwise compromised, on-device validation of the attestation may be inaccurate.

The entry point into the library itself is com.google.android.attestation.ParsedAttestationRecord.createParsedAttestationRecord.

For more details, see the documentation and the guide at https://developer.android.com/training/articles/security-key-attestation.html .

Getting Started

See the server sample for details.

Support

Stack Overflow: http://stackoverflow.com/questions/tagged/android

If you've found an error in this sample, please file an issue: https://github.com/google/android-key-attestation

Patches are encouraged, and may be submitted by forking this project and submitting a pull request through GitHub. Please see CONTRIBUTING.md for more details.

License

Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

android-key-attestation's People

Contributors

Stargazers

Watchers

20:11:35.636: Caused by: java.lang.NullPointerException
20:11:35.636: 	at com.google.android.attestation.AttestationApplicationId.<init>(AttestationApplicationId.java:50)
20:11:35.636: 	at com.google.android.attestation.AttestationApplicationId.createAttestationApplicationId(AttestationApplicationId.java:79)
20:11:35.636: 	at com.google.android.attestation.AuthorizationList.<init>(AuthorizationList.java:186)
20:11:35.636: 	at com.google.android.attestation.AuthorizationList.createAuthorizationList(AuthorizationList.java:221)
20:11:35.636: 	at com.google.android.attestation.ParsedAttestationRecord.<init>(ParsedAttestationRecord.java:66)
20:11:35.636: 	at com.google.android.attestation.ParsedAttestationRecord.createParsedAttestationRecord(ParsedAttestationRecord.java:78)

Build is broken with the latest Bazel

$ bazel test //src/test/...
INFO: Analyzed 4 targets (0 packages loaded, 0 targets configured).
INFO: Found 4 test targets...
INFO: Elapsed time: 1.165s, Critical Path: 1.06s
INFO: 5 processes: 1 internal, 4 darwin-sandbox.
INFO: Build completed successfully, 5 total actions
//src/test/java/com/google/android/attestation:AttestationApplicationIdTest PASSED in 0.8s
//src/test/java/com/google/android/attestation:AuthorizationListTest     PASSED in 0.7s
//src/test/java/com/google/android/attestation:ParsedAttestationRecordTest PASSED in 1.0s
//src/test/java/com/google/android/attestation:RootOfTrustTest           PASSED in 0.8s

Executed 4 out of 4 tests: 4 tests pass.
There were tests whose specified size is too big. Use the --test_verbose_timeout_warnings command line option to see which ones these are.
bweeks-macbookpro3:android-key-attestation bweeks$ git stash
Saved working directory and index state WIP on master: 61d8232 Make value classes immutable
bweeks-macbookpro3:android-key-attestation bweeks$ bazel test //...
ERROR: /Users/bweeks/Code/android-key-attestation/server/bin/test/com/google/android/attestation/BUILD:42:10: in java_test rule //server/bin/test/com/google/android/attestation:RootOfTrustTest: 
Traceback (most recent call last):
	File "/virtual_builtins_bzl/bazel/java/bazel_java_binary.bzl", line 28, column 35, in _bazel_java_test_impl
	File "/virtual_builtins_bzl/bazel/java/bazel_java_binary.bzl", line 72, column 17, in _bazel_base_binary_impl
Error in fail: cannot determine test class. You might want to rename the  rule or add a 'test_class' attribute.
ERROR: /Users/bweeks/Code/android-key-attestation/server/bin/test/com/google/android/attestation/BUILD:42:10: Analysis of target '//server/bin/test/com/google/android/attestation:RootOfTrustTest' failed
Use --verbose_failures to see the command lines of failed build steps.
ERROR: Analysis of target '//server/bin/test/com/google/android/attestation:RootOfTrustTest' failed; build aborted
INFO: Elapsed time: 3.226s, Critical Path: 0.00s
INFO: 1 process: 1 internal.
ERROR: Build did NOT complete successfully
ERROR: No test targets were found, yet testing was requested

Where to retrieve and store the GOOGLE_ROOT_CA_PUB_KEY?

Do we need to consider key rotation for this key, should we just hardcode the key in our implementation? Is there a way to retrieve the public key through a public URI?

google / android-key-attestation Goto Github PK

android-key-attestation's Introduction

Android Key Attestation Library

Getting Started

Support

License

android-key-attestation's People

Contributors

Stargazers

Watchers

Forkers

android-key-attestation's Issues

Consider publishing this package to Maven

Google/A!

Handle a missing Attestation Application ID properly

Build is broken with the latest Bazel

Where to retrieve and store the GOOGLE_ROOT_CA_PUB_KEY?

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent