From 4d5e94f83532f952dbe19bacc5e705e18efdda44 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Thu, 19 Mar 2026 09:48:08 +0100 Subject: [PATCH] fix(interception): make NO_AUTH_REQUIRED conditional in KeyMetadata authorizations Upstream removed the unconditional NO_AUTH_REQUIRED from toAuthorizations. A key generated with auth requirements would incorrectly report NO_AUTH_REQUIRED in metadata, creating a detectable inconsistency with the attestation extension. --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 959287c..63e3f92 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -985,7 +985,9 @@ private fun KeyMintAttestation.toAuthorizations( authList.add(createAuth(Tag.MAX_BOOT_LEVEL, KeyParameterValue.integer(this.maxBootLevel))) } - authList.add(createAuth(Tag.NO_AUTH_REQUIRED, KeyParameterValue.boolValue(true))) + if (this.noAuthRequired != false) { + authList.add(createAuth(Tag.NO_AUTH_REQUIRED, KeyParameterValue.boolValue(true))) + } authList.add(createAuth(Tag.ORIGIN, KeyParameterValue.origin(this.origin ?: KeyOrigin.GENERATED))) authList.add(createAuth(Tag.OS_VERSION, KeyParameterValue.integer(AndroidDeviceUtils.osVersion)))