1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
KeyDescription ::= SEQUENCE {
attestationVersion INTEGER, # KM2 value is 1. KM3 value is 2. KM4 value is 3.
attestationSecurityLevel SecurityLevel,
keymasterVersion INTEGER,
keymasterSecurityLevel SecurityLevel,
attestationChallenge OCTET_STRING,
uniqueId OCTET_STRING,
softwareEnforced AuthorizationList,
teeEnforced AuthorizationList,
}
SecurityLevel ::= ENUMERATED {
Software (0),
TrustedEnvironment (1),
StrongBox (2),
}
AuthorizationList ::= SEQUENCE {
purpose [1] EXPLICIT SET OF INTEGER OPTIONAL,
algorithm [2] EXPLICIT INTEGER OPTIONAL,
keySize [3] EXPLICIT INTEGER OPTIONAL.
digest [5] EXPLICIT SET OF INTEGER OPTIONAL,
padding [6] EXPLICIT SET OF INTEGER OPTIONAL,
ecCurve [10] EXPLICIT INTEGER OPTIONAL,
rsaPublicExponent [200] EXPLICIT INTEGER OPTIONAL,
rollbackResistance [303] EXPLICIT NULL OPTIONAL, # KM4
activeDateTime [400] EXPLICIT INTEGER OPTIONAL
originationExpireDateTime [401] EXPLICIT INTEGER OPTIONAL
usageExpireDateTime [402] EXPLICIT INTEGER OPTIONAL
noAuthRequired [503] EXPLICIT NULL OPTIONAL,
userAuthType [504] EXPLICIT INTEGER OPTIONAL,
authTimeout [505] EXPLICIT INTEGER OPTIONAL,
allowWhileOnBody [506] EXPLICIT NULL OPTIONAL,
trustedUserPresenceRequired [507] EXPLICIT NULL OPTIONAL, # KM4
trustedConfirmationRequired [508] EXPLICIT NULL OPTIONAL, # KM4
unlockedDeviceRequired [509] EXPLICIT NULL OPTIONAL, # KM4
allApplications [600] EXPLICIT NULL OPTIONAL,
applicationId [601] EXPLICIT OCTET_STRING OPTIONAL,
creationDateTime [701] EXPLICIT INTEGER OPTIONAL,
origin [702] EXPLICIT INTEGER OPTIONAL,
rollbackResistant [703] EXPLICIT NULL OPTIONAL, # KM2 and KM3 only.
rootOfTrust [704] EXPLICIT RootOfTrust OPTIONAL,
osVersion [705] EXPLICIT INTEGER OPTIONAL,
osPatchLevel [706] EXPLICIT INTEGER OPTIONAL,
attestationApplicationId [709] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdBrand [710] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdDevice [711] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdProduct [712] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdSerial [713] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdImei [714] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdMeid [715] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdManufacturer [716] EXPLICIT OCTET_STRING OPTIONAL, # KM3
attestationIdModel [717] EXPLICIT OCTET_STRING OPTIONAL, # KM3
vendorPatchLevel [718] EXPLICIT INTEGER OPTIONAL, # KM4
bootPatchLevel [719] EXPLICIT INTEGER OPTIONAL, # KM4
}
RootOfTrust ::= SEQUENCE {
verifiedBootKey OCTET_STRING,
deviceLocked BOOLEAN,
verifiedBootState VerifiedBootState,
verifiedBootHash OCTET_STRING, # KM4
}
VerifiedBootState ::= ENUMERATED {
Verified (0),
SelfSigned (1),
Unverified (2),
Failed (3),
}
|
