Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "docs: Added note about limited support for hardware key attestation" into nyc-dev

Browse Source
This commit is contained in:
Kevin Hufnagle
2016-07-15 18:44:09 +00:00
committed by Android (Google) Code Review
parent 8432d4328d 0da25a69f3
commit 68b98bc608
2 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/html/preview/api-overview.jd
View File

@@ -755,6 +755,20 @@ For more information, see <a href="{@docRoot}preview/features/direct-boot.html">
on the device. on the device.
</p> </p>
<p class="note">
<strong>Note: </strong>Only a small number of devices running Android N
support hardware-level key attestation; all other devices running Android N
use software-level key attestation instead. Before you verify the properties
of a device's hardware-backed keys in a production-level environment, you
should make sure that the device supports hardware-level key attestation. To
do so, you should check that the attestation certificate chain contains a root
certificate that is signed by the Google attestation root key and that the
<code>attestationSecurityLevel</code> element within the <a
href="{@docRoot}preview/features/key-attestation.html#certificate_schema_keydescription">key
description</a> data structure is set to the TrustedEnvironment security
level.
</p>
<p> <p>
For more information, see the For more information, see the
<a href="{@docRoot}preview/features/key-attestation.html">Key Attestation</a> <a href="{@docRoot}preview/features/key-attestation.html">Key Attestation</a>

17
docs/html/preview/features/key-attestation.jd
View File

@@ -21,6 +21,19 @@ page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "ce
interpret the schema of the attestation certificate's extension data. interpret the schema of the attestation certificate's extension data.
</p> </p>
<p class="note">
<strong>Note: </strong>Only a small number of devices running Android N
support hardware-level key attestation; all other devices running Android N
use software-level key attestation instead. Before you verify the properties
of a device's hardware-backed keys in a production-level environment, you
should make sure that the device supports hardware-level key attestation. To
do so, you should check that the attestation certificate chain contains a root
certificate that is signed by the Google attestation root key and that the
<code>attestationSecurityLevel</code> element within the <a
href="#certificate_schema_keydescription">key description</a> data structure
is set to the TrustedEnvironment security level.
</p>
<h2 id="verifying"> <h2 id="verifying">
Retrieving and Verifying a Hardware-backed Key Pair Retrieving and Verifying a Hardware-backed Key Pair
</h2> </h2>
@@ -227,8 +240,8 @@ VerifiedBootState ::= ENUMERATED {
level</a> of the attestation. level</a> of the attestation.
</p> </p>
<p class="note"> <p class="caution">
<strong>Note:</strong> Although it is possible to attest keys that are <strong>Warning:</strong> Although it is possible to attest keys that are
stored in the Android system&mdash;that is, if the stored in the Android system&mdash;that is, if the
<code>attestationSecurity</code> value is set to Software&mdash;you <code>attestationSecurity</code> value is set to Software&mdash;you
cannot trust these attestations if the Android system becomes compromised. cannot trust these attestations if the Android system becomes compromised.