Merge pull request #21 from Andrea-lyz/fix/duck-detector-generate-fingerprint

fix: defeat Duck Detector "generate-mode fingerprint" probe
2026-05-15 16:47:44 +01:00
parent db882ec326 4ecbfc7259
commit 15a1c0ca40
1 changed files with 6 additions and 1 deletions
@@ -1123,7 +1123,12 @@ private fun KeyMintAttestation.toAuthorizations(
        }
        return Authorization().apply {
            this.keyParameter = param
-            this.securityLevel = SecurityLevel.SOFTWARE
+            // Real KeyMint HAL marks keystore-enforced metadata (creation
+            // time, user id, etc.) with SecurityLevel.KEYSTORE (0x64), not
+            // SOFTWARE (0x00). Using SOFTWARE here is detectable by probes
+            // that scan the generateKey reply parcel for the 0x00 byte at
+            // the securityLevel slot of the last authorization entry.
+            this.securityLevel = SecurityLevel.KEYSTORE
        }
    }