Attestation (Android+ iOS): Best Practises, Know, Tests, Demos by Diolor · Pull Request #3756 · OWASP/mastg

Diolor · 2026-04-02T22:27:03Z

This PR closes #3505 and #3767

Description

Adds info regarding key attestation:

One generic KNOWs
Two separate KNOWs for device and app attestation, respectively for more granular information
The best practice of it

Bonus: Added a Tests + Demos for attestation

TODO:

Allocate IDs before merge

AI Tool Disclosure

[x ] This contribution includes AI-generated content.
AI tools used: Claude 4.6 for grammar, feedback and reading cohesion

Copilot

Pull request overview

This PR adds Android-focused guidance around Key Attestation by introducing new Knowledge pages (generic Key Attestation plus device/app-attestation-focused pages) and a new Best Practice that recommends using server-verified, hardware-backed attestation for integrity decisions.

Changes:

Moves/reworks the existing Key Attestation Knowledge content into MASVS-RESILIENCE and expands it with certificate-chain and field interpretation details.
Adds two new Knowledge pages for device attestation (rootOfTrust) and application attestation (attestationApplicationId).
Adds a new Android Best Practice describing a server-driven attestation flow and verification checks; updates related Storage Knowledge pages to reference the new Key Attestation KNOW.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
knowledge/android/MASVS-STORAGE/MASTG-KNOW-0047.md	Updates wording around using Key Attestation to verify keys are hardware-backed.
knowledge/android/MASVS-STORAGE/MASTG-KNOW-0045.md	Adds an explicit cross-reference to the Key Attestation Knowledge page.
knowledge/android/MASVS-STORAGE/MASTG-KNOW-0044.md	Removes the old Storage-category Key Attestation Knowledge page content (relocated).
knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0044.md	Adds the new Resilience-category Key Attestation Knowledge page with updated structure and references.
knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-01kw.md	Adds a new Knowledge page focused on device attestation fields (root of trust).
knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-02kw.md	Adds a new Knowledge page focused on application attestation fields (application ID).
best-practices/MASTG-BEST-00be.md	Adds a new Best Practice recommending hardware-backed key attestation for device/app integrity.

Copilot · 2026-04-08T11:40:17Z

+For a reference implementation, see [Dionysis Lorentzos' Android-Security sample](https://github.com/Diolor/Android-Security/blob/main/app/src/main/java/dio/security/crypto/KeyManager.kt#L45-L70).
+
+## Reading the X.509 Certificate
+
+The returned [X509Certificate](https://developer.android.com/reference/kotlin/java/security/cert/X509Certificate) chain from [`KeyStore.getCertificateChain(alias)`](https://developer.android.com/reference/kotlin/java/security/KeyStore#getcertificatechain) can be inspected to determine the key properties. X.509 certificates are described by [ASN.1 format](https://source.android.com/docs/security/features/keystore/attestation#tbscertificate-sequence) and the Android-specific extensions (certificate's payload) can be requested with OID `1.3.6.1.4.1.11129.2.1.17`. This attestation extension content is described by the [ASN.1 schema KeyDescription](https://source.android.com/docs/security/features/keystore/attestation#schema).
+
+For a sample decoding functionality of X.509 certificate's payload, you may consult [Dionysis Lorentzos' - Simple attestation converter](https://github.com/Diolor/Android-Security/blob/main/app/src/main/java/dio/security/crypto/attestation/Attestation.kt#L34-L64).


This Knowledge page links to non-official, personal GitHub repositories as “reference implementations”. Knowledge pages are expected to rely on official documentation/standards; consider replacing these with official sources (Android docs, AOSP, or Google-maintained samples) or move third-party samples to DEMO/tooling content.

I could copy the sample code here however the reader might lose context

…code examples

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Diolor · 2026-05-20T21:43:28Z

@@ -0,0 +1,73 @@
+---
+title: Mitigate the Risk of API Keys Hardcoded in the App Package


This is a best for MASWE-0005. Attestation is a critical component of it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Move attestation-focused TEST-0x01 here from the file-integrity branch. Pairs with existing MASTG-KNOW-0x02 (DeviceCheck) and MASTG-KNOW-0x03 (App Attest). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Rename Android key-attestation test MASTG-TEST-0342 -> MASTG-TEST-0x01 (resolves duplicate ID with iOS NETWORK MASTG-TEST-0342) and update MASTG-DEMO-0x01 to reference it. - Rename iOS App Attest test MASTG-TEST-0x01 -> MASTG-TEST-0x02. Android (original) attestation under 0x01, iOS (new) under 0x02. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Placeholder demo md only (no r2 or sample files), paired with MASTG-TEST-0x02. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Diolor marked this pull request as ready for review April 2, 2026 22:35

Diolor added MASVS-RESILIENCE knowledge best practices labels Apr 3, 2026

Diolor self-assigned this Apr 3, 2026

cpholguera requested a review from Copilot April 8, 2026 11:36

Copilot started reviewing on behalf of cpholguera April 8, 2026 11:36 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Diolor mentioned this pull request May 12, 2026

0x05d Refactor - Remove Info already available Online #1841

Closed

cpholguera reviewed May 13, 2026

View reviewed changes

Comment thread knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0044.md

Diolor force-pushed the key-attestation-best-practice branch from 39b2e27 to 7d8ccdb Compare May 14, 2026 17:39

Diolor and others added 17 commits May 14, 2026 19:43

Move MASTG-KNOW-0044 from MASVS-STORAGE to MASVS-RESILIENCE

d31306f

Clean BE/KW regarding attestation

dd0cc30

Clean BE/KW regarding attestation

d37cdac

Enhance key attestation documentation with detailed explanations and …

4b197af

…code examples

WIP attestation

19c80a6

Enhance Android Key Attestation

a165a22

Enhance Android Key Attestation

87a920e

Enhance Android Key Attestation

057773b

Make descriptive content

b2d567b

grammar

02ac39a

Fix irelevant info

bb98920

Add pointer

b58d198

Indents

02e6af6

Lint + fix prescriptive

544ea58

Move Integrity Signals to BEST

6007387

Update knowledge/android/MASVS-STORAGE/MASTG-KNOW-0045.md

76546c3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Use existing placeholders

aed967d

Diolor force-pushed the key-attestation-best-practice branch from 7d8ccdb to aed967d Compare May 14, 2026 17:49

Add tests

0ef2111

Diolor added 10 commits May 17, 2026 23:06

Rename tests

bdbf5ce

Update best practices for Android Key Attestation and Play Integrity API

3f99519

Create the test

a62be1d

Add demo

d3364c4

Minor changes on demo

c428782

Cleanup Google Integrity API

5801a63

Add App Check and App/Device Attest for iOS

f983501

Rename BP

8881bcc

Lint

591fdb7

Add best practice guidelines for mitigating risks of hardcoded API keys

597ce89

Diolor commented May 20, 2026

View reviewed changes

cpholguera added the Android label Jun 2, 2026

cpholguera changed the title ~~Key attestation best practice~~ Key attestation best practice (Android) Jun 2, 2026

Diolor changed the title ~~Key attestation best practice (Android)~~ Key attestation (Android) Jun 14, 2026

Diolor and others added 12 commits June 14, 2026 23:39

Use placeholder names

efeddb7

Merge branch 'master' into key-attestation-best-practice

54a0075

Revert placeholder

51ba825

Revert placeholder

7a4504c

Use KNOW-0044

ad572c5

Fix temp ids

b6578de

Merge branch 'master' into key-attestation-best-practice

989879e

Revert

efcb468

Restore fix_ids.py OWASP#3869 logic accidentally over-reverted

bcc6696

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Add iOS App Attest test (MASTG-TEST-0x01)

9ba815c

Move attestation-focused TEST-0x01 here from the file-integrity branch. Pairs with existing MASTG-KNOW-0x02 (DeviceCheck) and MASTG-KNOW-0x03 (App Attest). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Add placeholder iOS App Attest demo (MASTG-DEMO-0x02)

e954d30

Placeholder demo md only (no r2 or sample files), paired with MASTG-TEST-0x02. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Diolor changed the title ~~Key attestation (Android)~~ Attestation (Android+ iOS): Best Practises, Know, Tests, Demos Jun 20, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Attestation (Android+ iOS): Best Practises, Know, Tests, Demos#3756

Attestation (Android+ iOS): Best Practises, Know, Tests, Demos#3756
Diolor wants to merge 40 commits into
OWASP:masterfrom
Diolor:key-attestation-best-practice

Diolor commented Apr 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Diolor Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Diolor May 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,73 @@
		---
		title: Mitigate the Risk of API Keys Hardcoded in the App Package

Uh oh!

Uh oh!

Conversation

Diolor commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

AI Tool Disclosure

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Diolor Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Diolor May 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Diolor commented Apr 2, 2026 •

edited

Loading