From 37e9d007debaa49e487162a2812b35ceecb9af6a Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Thu, 4 Jun 2026 13:00:38 +0100 Subject: [PATCH] feat(pki): log keybox attestation cert serials Emit each loaded keybox's certificate-chain serials (lowercase hex) at parse time. A revoked or leaked keybox is then visible from logcat alone, since Google's CRL and Duck Detector's "mass abuse" check both match by certificate serial. Diagnostic aid for the revoked-keybox danger in #28; the actual fix is rotating to a non-revoked keybox. --- .../java/org/matrix/TEESimulator/pki/KeyBoxManager.kt | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt b/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt index c001b69..8ea3e48 100644 --- a/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt +++ b/app/src/main/java/org/matrix/TEESimulator/pki/KeyBoxManager.kt @@ -3,6 +3,7 @@ package org.matrix.TEESimulator.pki import android.security.keystore.KeyProperties import java.io.File import java.io.StringReader +import java.security.cert.X509Certificate import java.security.interfaces.ECPrivateKey import java.security.interfaces.RSAPrivateKey import java.util.concurrent.ConcurrentHashMap @@ -232,6 +233,15 @@ object KeyBoxManager { eventType = parser.next() } SystemLogger.info("Finished parsing, found ${foundKeys.size} valid keys.") + // Surface attestation cert serials so a revoked/leaked keybox is obvious from + // logcat alone -- Google's CRL and Duck's "mass abuse" check both match by serial. + foundKeys.forEach { (alg, keyBox) -> + val serials = + keyBox.certificates.joinToString(", ") { cert -> + (cert as? X509Certificate)?.serialNumber?.toString(16) ?: "?" + } + SystemLogger.info("$alg keybox attestation cert serials (hex): $serials") + } return foundKeys } }