@@ -23,6 +23,7 @@ import (
2323
2424 "github.com/google/certificate-transparency-go/asn1"
2525 "github.com/google/certificate-transparency-go/x509"
26+ "github.com/fxamacker/cbor/v2"
2627)
2728
2829// OIDExtensionAndroidAttestation is the OID value for an X.509 extension that holds
@@ -68,6 +69,23 @@ type AndroidVmComponent struct {
6869 AuthorityHash []byte
6970}
7071
72+ // RkpProvisioningInfo describes remotely provisioned key information
73+ type RkpProvisioningInfo struct {
74+ CertsSigned30Days int64 `cbor:"1,keyasint"`
75+ VerifiedFirmware * bool `cbor:"2,keyasint,omitempty"`
76+ SocVendorCertified * bool `cbor:"3,keyasint,omitempty"`
77+ DeviceProperties * RkpDeviceProperties `cbor:"4,keyasint,omitempty"`
78+ }
79+
80+ // RkpDeviceProperties describes the device receiving an RKP key.
81+ type RkpDeviceProperties struct {
82+ Brand * string `cbor:"1,keyasint,omitempty"`
83+ Device * string `cbor:"2,keyasint,omitempty"`
84+ Manufacturer * string `cbor:"3,keyasint,omitempty"`
85+ Model * string `cbor:"4,keyasint,omitempty"`
86+ Product * string `cbor:"5,keyasint,omitempty"`
87+ }
88+
7189func securityLevelToString (lvl asn1.Enumerated ) string {
7290 switch lvl {
7391 case 0 :
@@ -189,6 +207,22 @@ func VmInfoFromCert(cert *x509.Certificate) (*AndroidVmAttestationInfo, error) {
189207 return nil , errors .New ("no Android VM Attestation extension found" )
190208}
191209
210+ // RkpInfoFromCert retrieves and parses an Android VM attestation information extension
211+ // from a certificate, if present.
212+ func RkpInfoFromCert (cert * x509.Certificate ) (* RkpProvisioningInfo , error ) {
213+ for _ , ext := range cert .Extensions {
214+ if ext .Id .Equal (OIDExtensionAndroidRkpInfo ) {
215+ var rkpInfo RkpProvisioningInfo
216+ err := cbor .Unmarshal (ext .Value , & rkpInfo )
217+ if err != nil {
218+ return nil , fmt .Errorf ("failed to unmarshal RKP CBOR info: %v" , err )
219+ }
220+ return & rkpInfo , nil
221+ }
222+ }
223+ return nil , errors .New ("no Android RKP Attestation extension found" )
224+ }
225+
192226func showAndroidVmAttestation (result * bytes.Buffer , cert * x509.Certificate ) {
193227 count , critical := OIDInExtensions (OIDExtensionAndroidVmAttestation , cert .Extensions )
194228 if count == 0 {
@@ -214,12 +248,39 @@ func showAndroidVmAttestation(result *bytes.Buffer, cert *x509.Certificate) {
214248}
215249
216250func showAndroidRkpInfo (result * bytes.Buffer , cert * x509.Certificate ) {
217- for _ , ext := range cert .Extensions {
218- if ext .Id .Equal (OIDExtensionAndroidRkpInfo ) {
219- result .WriteString (fmt .Sprintf (" Android RKP Information:" ))
220- showCritical (result , ext .Critical )
221- appendHexData (result , ext .Value , 16 , " " )
222- result .WriteString ("\n " )
251+ count , critical := OIDInExtensions (OIDExtensionAndroidRkpInfo , cert .Extensions )
252+ if count == 0 {
253+ return
254+ }
255+ result .WriteString (fmt .Sprintf (" Android RKP Information:" ))
256+ showCritical (result , critical )
257+ rkpInfo , err := RkpInfoFromCert (cert )
258+ if err != nil {
259+ result .WriteString (fmt .Sprintf (" Failed to CBOR-decode RKP info: (%s)\n " , err ))
260+ return
261+ }
262+ result .WriteString (fmt .Sprintf (" Certs Signed Last 30d: %d\n " , rkpInfo .CertsSigned30Days ))
263+ if rkpInfo .VerifiedFirmware != nil {
264+ result .WriteString (fmt .Sprintf (" Verified Firmware: %t\n " , * rkpInfo .VerifiedFirmware ))
265+ }
266+ if rkpInfo .SocVendorCertified != nil {
267+ result .WriteString (fmt .Sprintf (" Verified Firmware: %t\n " , * rkpInfo .SocVendorCertified ))
268+ }
269+ if rkpInfo .DeviceProperties != nil {
270+ if rkpInfo .DeviceProperties .Brand != nil {
271+ result .WriteString (fmt .Sprintf (" Brand: %s\n " , * rkpInfo .DeviceProperties .Brand ))
272+ }
273+ if rkpInfo .DeviceProperties .Device != nil {
274+ result .WriteString (fmt .Sprintf (" Device: %s\n " , * rkpInfo .DeviceProperties .Device ))
275+ }
276+ if rkpInfo .DeviceProperties .Manufacturer != nil {
277+ result .WriteString (fmt .Sprintf (" Manufacturer: %s\n " , * rkpInfo .DeviceProperties .Manufacturer ))
278+ }
279+ if rkpInfo .DeviceProperties .Model != nil {
280+ result .WriteString (fmt .Sprintf (" Model: %s\n " , * rkpInfo .DeviceProperties .Model ))
281+ }
282+ if rkpInfo .DeviceProperties .Product != nil {
283+ result .WriteString (fmt .Sprintf (" Product: %s\n " , * rkpInfo .DeviceProperties .Product ))
223284 }
224285 }
225286}
0 commit comments