INNER CODE UNIT · Java

root

GrapheneOS/AttestationServer · src/main/java/app/attestation/server/AttestationProtocol.java:454

        final byte[] root = certificates[certificates.length - 1].getEncoded();
        if (!Arrays.stream(validRoots).anyMatch(v -> Arrays.equals(v, root))) {
            throw new GeneralSecurityException("root certificate is not a valid key attestation root");
        }

        final ParsedAttestationRecord attestation;
        try {
            attestation = ParsedAttestationRecord.createParsedAttestationRecord(
                    List.of((X509Certificate) certificates[0]));
        } catch (final IOException | ParsedAttestationRecord.KeyDescriptionMissingException e) {
            throw new GeneralSecurityException(e);
        }

        final ParsedAttestationRecord.SecurityLevel attestationSecurityLevelEnum = attestation.attestationSecurityLevel;

        // enforce hardware-based attestation
        if (attestationSecurityLevelEnum != ParsedAttestationRecord.SecurityLevel.TRUSTED_ENVIRONMENT &&
                attestationSecurityLevelEnum != ParsedAttestationRecord.SecurityLevel.STRONG_BOX) {

View source record →