From 7e477d6320cd2c16720875066e9fdc4046278099 Mon Sep 17 00:00:00 2001 From: Max Bires Date: Fri, 3 Jun 2022 03:47:00 -0700 Subject: [PATCH] Fix comment in docs about ID attestation. ID attestation will not work if the device identifiers are altered in the system image. This is because KeyMint checks the device identifiers that are provided in a generateKey call against the device identifiers that were provisioned in the factory. If there is a mismatch, the key request is rejected. The documentation on getSerial() has been fixed to clarify this. Test: The new documentation is semantically digestible by a SWE Change-Id: Ie300cd167bb82b44e38fb3e091b90abe02a7c197 --- core/java/android/os/Build.java | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/java/android/os/Build.java b/core/java/android/os/Build.java index 141b1412424a7..9c3a5983f8b7d 100755 --- a/core/java/android/os/Build.java +++ b/core/java/android/os/Build.java @@ -165,9 +165,11 @@ public class Build { * Gets the hardware serial number, if available. * *

Note: Root access may allow you to modify device identifiers, such as - * the hardware serial number. If you change these identifiers, you can use + * the hardware serial number. If you change these identifiers, you can not use * key attestation to obtain - * proof of the device's original identifiers. + * proof of the device's original identifiers. KeyMint will reject an ID attestation request + * if the identifiers provided by the frameworks do not match the identifiers it was + * provisioned with. * *

Starting with API level 29, persistent device identifiers are guarded behind additional * restrictions, and apps are recommended to use resettable identifiers (see