Display in UI whenever generic device info was used for attestation

GrapheneOS · Dec 26, 2023 · 3737daa · 3737daa
1 parent 07de61d
commit 3737daa
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/app/src/main/java/app/attestation/auditor/AttestationProtocol.java b/app/src/main/java/app/attestation/auditor/AttestationProtocol.java
@@ -239,6 +239,7 @@ class AttestationProtocol {
 
     private static final int AUDITOR_APP_MINIMUM_VERSION = 47;
     private static final int OS_VERSION_MINIMUM = 100000;
+    private static final int OS_VERSION_MINIMUM_WITH_DEVICE_INFO_ATTESTATION_SUPPORT = 120000;
     private static final int OS_PATCH_LEVEL_MINIMUM = 201909;
     private static final int VENDOR_PATCH_LEVEL_MINIMUM = 20190905;
     private static final int BOOT_PATCH_LEVEL_MINIMUM = 20190905;
@@ -1053,6 +1054,22 @@ private static void appendVerifiedInformation(final Context context,
         builder.append(context.getString(R.string.security_level, securityLevel));
 
         builder.append(context.getString(R.string.device, verified.device));
+
+        final String deviceInfoAttestation;
+        if (verified.osName == R.string.generic_device_os_stock) {
+            deviceInfoAttestation = context.getString(R.string.generic_device_info_attestation_supported);
+        } else if (context.getString(R.string.generic_device_name_unknown).equals(verified.device)) {
+            if (verified.osVersion >= OS_VERSION_MINIMUM_WITH_DEVICE_INFO_ATTESTATION_SUPPORT) {
+                deviceInfoAttestation = context.getString(R.string.generic_device_info_attestation_unsupported_error);
+            } else {
+                deviceInfoAttestation = context.getString(R.string.generic_device_info_attestation_unsupported_os_version);
+            }
+        } else {
+            deviceInfoAttestation = context.getString(R.string.generic_device_info_attestation_support_unknown);
+        }
+
+        builder.append(context.getString(R.string.pinned_generic_device_info_attestation, deviceInfoAttestation));
+
         builder.append(context.getString(R.string.os, context.getString(verified.osName)));
 
         final String osVersion = String.format(Locale.US, "%06d", verified.osVersion);

diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
@@ -179,4 +179,9 @@
 
     <string name="generic_device_name_unknown">Unknown non-Pixel device</string>
     <string name="generic_device_os_stock">Stock (Generic)</string>
+    <string name="pinned_generic_device_info_attestation">Pinned generic device info attestation: %s\n</string>
+    <string name="generic_device_info_attestation_supported">Supported</string>
+    <string name="generic_device_info_attestation_unsupported_os_version">Unsupported by older OS version</string>
+    <string name="generic_device_info_attestation_unsupported_error">Unsupported by attestation error</string>
+    <string name="generic_device_info_attestation_support_unknown">Unknown, device info attested by pinned verified boot key hash</string>
 </resources>