From 29b2a85e9ffdf0b93476a2ce6b3a605e8377160c Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 19 May 2026 03:23:10 +0100 Subject: [PATCH] fix(interception): omit KEY_SIZE for EC keys with ecCurve AOSP keystore2 attestation lists KEY_SIZE only when there is no authoritative key-shape tag. For EC keys the curve already pins the key size, so emitting both KEY_SIZE and EC_CURVE is a forgery fingerprint. Guard the createAuth call accordingly. --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index a1117f3..8f4d266 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -1068,7 +1068,9 @@ private fun KeyMintAttestation.toAuthorizations( this.blockMode.forEach { authList.add(createAuth(Tag.BLOCK_MODE, KeyParameterValue.blockMode(it))) } this.digest.forEach { authList.add(createAuth(Tag.DIGEST, KeyParameterValue.digest(it))) } this.padding.forEach { authList.add(createAuth(Tag.PADDING, KeyParameterValue.paddingMode(it))) } - authList.add(createAuth(Tag.KEY_SIZE, KeyParameterValue.integer(this.keySize))) + if (this.algorithm != Algorithm.EC || this.ecCurve == null) { + authList.add(createAuth(Tag.KEY_SIZE, KeyParameterValue.integer(this.keySize))) + } if (this.rsaPublicExponent != null) { authList.add(createAuth(Tag.RSA_PUBLIC_EXPONENT, KeyParameterValue.longInteger(this.rsaPublicExponent.toLong()))) }