Missing TRUSTED_CONFIRMATION_REQUIRED (508) in KeyMintTag

[lukakilic]

I'm hitting ExtensionParsingException: unknown tag number: 508 when verifying attestation certs generated with setUserConfirmationRequired(true) in KeyGenParameterSpec.Builder.

Looking at Extension.kt, the KeyMintTag enum has 507 and 509, but 508 seems to be missing between them.

Is this intentional, or a gap that's worth fixing?

[sethmoo]

That's a miss on our part. It's not a commonly-used tag, so we simply didn't have it in our test data.

#88 adds the missing tag and also includes a test cert chain.

[lukakilic]

Thanks for the quick response! I was playing around with KeyGenParameterSpec.Builder and noticed the same for setMaxUsageCount(), which caused unknown tag number: 405.

So while I'm at it, these are all missing tags I noticed. I guess most of them are barely relevant, but for the sake of compliance they could be added 🤷‍♂️

7 (callerNonce), 8 (minMacLength), 303 (rollbackResistance), 305 (earlyBootOnly), 405 (usageCountLimit), 502 (userSecureId), 508 (trustedConfirmationReq), 720 (deviceUniqueAttestation)

Extension.kt sets ROLLBACK_RESISTANT(703), while it is defined as 303. (703 is unused).

[sethmoo]

Thanks for looking!

Some background on why we don't support various tags:

• 7 (callerNonce) -- symmetric ciphers only
• 8 (minMacLength) -- symmetric ciphers only
• 303 (rollbackResistance) -- not usable by 3p apps (framework API is hidden)
• 305 (earlyBootOnly) -- not usable by 3p apps
• 502 (userSecureId) -- not usable by 3p apps (framework API is hidden)
• 720 (deviceUniqueAttestation) -- this one's weird, and I'm not sure it's used anywhere

But "405 (usageCountLimit)" is a valid use case, though I believe it's rarely used. Might as well add that.