From c946f9d1037b1545c9935e9e616cad5bc3ab8c32 Mon Sep 17 00:00:00 2001 From: Kevin Hufnagle Date: Wed, 20 Jul 2016 14:14:55 -0700 Subject: [PATCH] docs: Migrated "key attestation" page to a new location (for N OTA). Updated page location, TOC entry, and URL redirect in preparation for Android Nougat OTA release. Bug: 28851641 Change-Id: I8be252d79b0b5ad3c7d814175e6bfbfb98e95daf --- docs/html/_redirects.yaml | 5 ++ docs/html/training/_book.yaml | 5 ++ .../articles/security-key-attestation.jd} | 51 ++++++++++--------- 3 files changed, 37 insertions(+), 24 deletions(-) rename docs/html/{preview/features/key-attestation.jd => training/articles/security-key-attestation.jd} (92%) diff --git a/docs/html/_redirects.yaml b/docs/html/_redirects.yaml index 4cfe8087a1ef9..87ae71391c135 100644 --- a/docs/html/_redirects.yaml +++ b/docs/html/_redirects.yaml @@ -1201,3 +1201,8 @@ redirects: to: /studio/intro/index.html?utm_medium=android-studio - from: /r/studio-ui/menu-start.html to: /training/index.html?utm_medium=android-studio + +# N Preview redirects + +- from: /preview/features/key-attestation.html + to: /training/articles/security-key-attestation.html diff --git a/docs/html/training/_book.yaml b/docs/html/training/_book.yaml index 00f9295b05f73..d6561bb79388b 100644 --- a/docs/html/training/_book.yaml +++ b/docs/html/training/_book.yaml @@ -1373,6 +1373,11 @@ toc: path_attributes: - name: description value: How to use the SafetyNet service to analyze a device where your app is running and get information about its compatibility with your app. + - title: Verifying Hardware-backed Key Pairs with Key Attestation + path: /training/articles/security-key-attestation.html + path_attributes: + - name: description + value: How to retrieve and verify the properties of a device's hardware-backed key pair. - title: Enhancing Security with Device Management Policies path: /work/device-management-policy.html path_attributes: diff --git a/docs/html/preview/features/key-attestation.jd b/docs/html/training/articles/security-key-attestation.jd similarity index 92% rename from docs/html/preview/features/key-attestation.jd rename to docs/html/training/articles/security-key-attestation.jd index 5be6dfa370633..9145d308f1405 100644 --- a/docs/html/preview/features/key-attestation.jd +++ b/docs/html/training/articles/security-key-attestation.jd @@ -1,11 +1,11 @@ page.title=Key Attestation -page.metaDescription=New support in Android N for verifying security properties of hardware-backed keys. -page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "certificate", "key attestation" +page.metaDescription=A tool for verifying security properties of hardware-backed key pairs. +page.keywords="security", "TEE", "hardware-backed", "keystore", "certificate", "key attestation" @jd:body -
-
+
+

In this document

  1. Retrieving and Verifying a Hardware-backed Key Pair
    2. @@ -22,14 +22,14 @@ page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "ce

    - Note: Only a small number of devices running Android N - support hardware-level key attestation; all other devices running Android N - use software-level key attestation instead. Before you verify the properties - of a device's hardware-backed keys in a production-level environment, you - should make sure that the device supports hardware-level key attestation. To - do so, you should check that the attestation certificate chain contains a root - certificate that is signed by the Google attestation root key and that the - attestationSecurityLevel element within the Note: Only a small number of devices running Android 7.0 (API + level 24) support hardware-level key attestation; all other devices running + Android 7.0 use software-level key attestation instead. Before you verify the + properties of a device's hardware-backed keys in a production-level + environment, you should make sure that the device supports hardware-level key + attestation. To do so, you should check that the attestation certificate chain + contains a root certificate that is signed by the Google attestation root key + and that the attestationSecurityLevel element within the key description data structure is set to the TrustedEnvironment security level.

    @@ -45,15 +45,17 @@ page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "ce

    - The root certificate within this chain is signed using an attestation key, - which the device manufacturer injects into the device’s hardware-backed - keystore at the factory. + If the device supports hardware-level key attestation, the root certificate + within this chain is signed using an attestation root key, which the device + manufacturer injects into the device’s hardware-backed keystore at the + factory.

    - Note: On devices that ship with Android N and Google Play - services, the root certificate is issued by Google. You should verify that - this root certificate appears within Google’s list of root certificates. + Note: On devices that ship with hardware-level key + attestation, Android 7.0 (API level 24), and Google Play services, the root + certificate is signed by the Google attestation root key. You should verify + that this root certificate appears within Google’s list of root certificates.

    @@ -231,7 +233,7 @@ VerifiedBootState ::= ENUMERATED {

    - attestationSecurity + attestationSecurityLevel
    @@ -242,8 +244,8 @@ VerifiedBootState ::= ENUMERATED {

    Warning: Although it is possible to attest keys that are - stored in the Android system—that is, if the - attestationSecurity value is set to Software—you + stored in the Android system—that is, if the value of + attestationSecurityLevel is set to Software—you cannot trust these attestations if the Android system becomes compromised.

    @@ -259,7 +261,7 @@ VerifiedBootState ::= ENUMERATED {
    - keymasterSecurity + keymasterSecurityLevel
    @@ -357,7 +359,8 @@ VerifiedBootState ::= ENUMERATED {

    Each field name corresponds to a similarly-named Keymaster tag. For example, the keySize field in an authorization list corresponds to the - KM_TAG_KEY_SIZE Keymaster tag. + + KM_TAG_KEY_SIZE Keymaster tag.

    @@ -780,7 +783,7 @@ VerifiedBootState ::= ENUMERATED {

    The month and year associated with the security patch that is currently installed on the device, specified as a six-digit integer. For example, the - June 2016 patch is represented as 201606. + August 2016 patch is represented as 201608.