From b2bf0ce5994cd1505637e3802e74f021057d4427 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Sun, 22 Mar 2026 00:06:28 +0100 Subject: [PATCH] fix(interception): restore noAuthRequired default and callerNonce attestation NO_AUTH_REQUIRED should be added to authorizations when not explicitly disabled (!= false), matching AOSP default behavior. The != null check from PR157 drops the tag for keys where noAuthRequired was parsed as null (e.g. persisted keys), creating an attestation/authorization mismatch that detectors can spot. Also restores CALLER_NONCE in softwareEnforced attestation list. --- .../matrix/TEESimulator/attestation/AttestationBuilder.kt | 5 +++++ .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 6 ++---- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt b/app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt index f2539b0..10c3866 100644 --- a/app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt +++ b/app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt @@ -516,6 +516,11 @@ object AttestationBuilder { ) ) } + if (params.callerNonce == true) { + list.add( + DERTaggedObject(true, AttestationConstants.TAG_CALLER_NONCE, DERNull.INSTANCE) + ) + } if (params.unlockedDeviceRequired == true) { list.add( DERTaggedObject( diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 20d5c95..b8df770 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -1069,10 +1069,8 @@ private fun KeyMintAttestation.toAuthorizations( ) } - if (this.noAuthRequired != null) { - authList.add( - createAuth(Tag.NO_AUTH_REQUIRED, KeyParameterValue.boolValue(this.noAuthRequired)) - ) + if (this.noAuthRequired != false) { + authList.add(createAuth(Tag.NO_AUTH_REQUIRED, KeyParameterValue.boolValue(true))) } if (this.callerNonce == true) {