From 17c63120f5a907328b940a65d2a4b7c559916d41 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 19 May 2026 13:32:54 +0100 Subject: [PATCH] fix(shim): resolve attest key by nspace The probe in duck-detector's TimingSideChannelProbe chain calls generateSigningKey with a KEY_ID-domain attestation key reference where alias is null. KMSLI.kt:498 fed that null alias into the non-null String param of KeyIdentifier, triggering an NPE that the outer runCatching wraps into a ServiceSpecificException(-49). Any SSE crossing the binder boundary carries the Parcel.read/ createException(OrNull) stack frames, which the detector's TeeReportReducer at line 2635-2641 matches verbatim to emit "Captured private binder exception during timing skip". Branch on the alias before constructing KeyIdentifier: when alias is present, retain the existing isAttestationKey lookup; when null (Domain::KEY_ID), scan attestationKeys for a matching uid + nspace via generatedKeys. Mirrors AOSP keystore2's own dispatch in database.rs (Domain::APP by alias, Domain::KEY_ID by key id). --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 6a9ea1c..ee3f06e 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -495,7 +495,8 @@ class KeyMintSecurityLevelInterceptor( ConfigurationManager.shouldGenerate(callingUid) || (ConfigurationManager.shouldPatch(callingUid) && isAttestKeyRequest) || (attestationKey != null && - isAttestationKey(KeyIdentifier(callingUid, attestationKey.alias))) + (attestationKey.alias?.let { isAttestationKey(KeyIdentifier(callingUid, it)) } + ?: attestationKeys.any { kid -> kid.uid == callingUid && generatedKeys[kid]?.nspace == attestationKey.nspace })) val isAuto = ConfigurationManager.isAutoMode(callingUid)