Compose Required Field Attestation For Free

According to topjohnwu, hardware-backed attestation means that Google Play Services now sends an unmodified keystore certificate to SafetyNet servers, verifies its legitimacy, and checks certificate extension data to know whether your device has verified boot enabled (bootloader status). Since the private

Google mandates SafetyNet Attestation during Android Enterprise enrollment (DO and PO) to ensure that the devices pass Google's compatibility and integrity checks. Any device that fails attestation during the enrollment will not be able to complete provisioning.

It uses a remote attestation approach, where the running app must prove itself to be genuine through a sequence of integrity measurements. These results are then sent to the Approov cloud service using a patented challenge-response protocol, immune from replay attacks.

Setting SafetyNet attestation Log into the Admin Portal. Go to Policies & Configs > Policies. Select a security policy and click Edit. Alternatively, create a new security policy by clicking Add New > Security. Scroll down to the Android section. Select Require Google SafetyNet Attestation.

Key Attestation is a feature which allows developers to analyze the security of the cryptographic material managed by Android Keystore.

The SafetyNet Attestation API is an anti-abuse API that allows app developers to assess the Android device their app is running on. The API should be used as a part of your abuse detection system to help determine whether your servers are interacting with your genuine app running on a genuine Android device.

Force BASIC key attestation. Google now enforces the use of hardware backed key attestation on devices that has the necessary hardware (all devices that shipped with Android 8+ and even some older devices).