Plot Phone Attestation For Free

Remote attestation is a method by which a host (client) authenticates it's hardware and software configuration to a remote host (server). The goal of remote attestation is to enable a remote system (challenger) to determine the level of trust in the integrity of platform of another system (attestator).

Android's hardware attestation API provides a much stronger form of attestation than the Play Integrity API with the ability to whitelist the keys of alternate operating systems. It also avoids an unnecessary dependency on Google Play services and Google's Play Integrity servers.

A software attestation is a trust mechanism that allows a verifier (i.e., a customer) to independently validate the integrity of something asserted by the provider (i.e., the vendor). For example, an attestation can verify that an application is not compromised by malicious code.

Definitions: The process of providing a digital signature for a set of measurements securely stored in hardware, and then having the requester validate the signature and the set of measurements.

Setting SafetyNet attestation Log into the Admin Portal. Go to Policies & Configs > Policies. Select a security policy and click Edit. Alternatively, create a new security policy by clicking Add New > Security. Scroll down to the Android section. Select ?Require Google SafetyNet Attestation?.

The SafetyNet Attestation API provides a cryptographically-signed attestation, assessing the device's integrity. In order to create the attestation, the API examines the device's software and hardware environment, looking for integrity issues, and comparing it with the reference data for approved Android devices.

This attestation provides assurance that the properties of the device (for example, the serial number) are legitimate (as attested to by the device's Secure Enclave and verified by Apple's servers) and not spoofed.

Key Attestation gives you more confidence that the keys you use in your app are stored in a device's hardware-backed keystore. The following sections describe how to verify the properties of hardware-backed keys and how to interpret the attestation certificate's extension data.