Skip to content

v4.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Mar 12:08
v4.2
40b08cd

Fixes 6 detection vectors flagged by attestation validator apps.

Attestation Policy Enforcement

Replicate AOSP keystore2's add_required_parameters() validation that our software keygen path was bypassing:

  • CREATION_DATETIME — Reject caller-provided input with INVALID_ARGUMENT (20), matching security_level.rs:424. Our cert gen still adds its own timestamp, same as real keystore2.
  • Device ID attestation — Reject ATTESTATION_ID_SERIAL, IMEI, MEID, SECOND_IMEI, and DEVICE_UNIQUE_ATTESTATION with CANNOT_ATTEST_IDS (-66). No consumer app has READ_PRIVILEGED_PHONE_STATE.
  • Error reply format — Fixed AIDL ServiceSpecificException parcel write order (was errorCode→message, now message→errorCode).

Certificate Fix

Leaf certificate Subject CN corrected from "Android KeyStore Key" to "Android Keystore Key" (lowercase s), matching AOSP KeyGenParameterSpec.java:282. Both Kotlin and Rust paths.

Binder Timing

Skip interception for system transaction codes (PING, INTERFACE, DUMP) above LAST_CALL_TRANSACTION. Eliminates the JNI round-trip that inflated binder ping ratio to 3.85x (detector threshold: 3.0x).

Assets 4
Loading