Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d5933f1 authored by Tom Chan's avatar Tom Chan
Browse files

Do not check revocation status of leaf certificate 

The leaf certificate is generated at runtime and contains attestation
attributes specific to this attestation operation instance, including
the one-time challenge. This certificate is ephemeral and will not be
revoked.

Test: manually
Bug: 389088384
Flag: EXEMPT bug fix
Change-Id: I614f0ed18fe1154b089f6ecdada6c458fd545e53
parent b04e0f11

services/core/java/com/android/server/security/AttestationVerificationPeerDeviceVerifier.java

+5 −1
Original line number Diff line number Diff line
@@ -303,7 +303,11 @@ class AttestationVerificationPeerDeviceVerifier { 
        if (mRevocationEnabled) {

            // Checks Revocation Status List based on

            // https://developer.android.com/training/articles/security-key-attestation#certificate_status

            mCertificateRevocationStatusManager.checkRevocationStatus(certificates);

            // The first certificate is the leaf, which is generated at runtime with the attestation

            // attributes such as the challenge. It is specific to this attestation instance and

            // does not need to be checked for revocation.

            mCertificateRevocationStatusManager.checkRevocationStatus(

                    new ArrayList<>(certificates.subList(1, certificates.size())));

        }

    }