From 7e8776649308f1c30acc4a46ae03d33caa70e3fe Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Tue, 17 Mar 2026 00:05:56 +0100
Subject: [PATCH] fix(certgen): derive signing algorithm from attestation key
 and allow device ID tags

signerAlgorithm was derived from params.algorithm (the generated key)
instead of the signing key, causing BouncyCastle to throw when signing
RSA keys with an EC attestation key. Now reads signingKeyPair.private.algorithm.

Device ID tags (serial/imei/meid/secondImei) were blanket-rejected
instead of flowing through to software cert gen like AOSP does.
Narrowed rejection to DEVICE_UNIQUE_ATTESTATION only.
---
 .../keystore/shim/KeyMintSecurityLevelInterceptor.kt      | 6 ++----
 .../org/matrix/TEESimulator/pki/CertificateGenerator.kt   | 8 ++++----
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
index b1b491a..cb4990a 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
@@ -260,10 +260,8 @@ class KeyMintSecurityLevelInterceptor(
                     return InterceptorUtils.createErrorReply(RESPONSE_INVALID_ARGUMENT)
                 }
 
-                if (parsedParams.serial != null || parsedParams.imei != null ||
-                    parsedParams.meid != null || parsedParams.secondImei != null ||
-                    params.any { it.tag == Tag.DEVICE_UNIQUE_ATTESTATION }) {
-                    SystemLogger.warning("[TX_ID: $txId] Rejecting device ID attestation for uid=$callingUid")
+                if (params.any { it.tag == Tag.DEVICE_UNIQUE_ATTESTATION }) {
+                    SystemLogger.warning("[TX_ID: $txId] Rejecting DEVICE_UNIQUE_ATTESTATION for uid=$callingUid")
                     return InterceptorUtils.createErrorReply(KEYMINT_CANNOT_ATTEST_IDS)
                 }
 
diff --git a/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt b/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt
index 63c4c70..6e8f2d3 100644
--- a/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt
@@ -239,10 +239,10 @@ object CertificateGenerator {
         )
 
         val signerAlgorithm =
-            when (params.algorithm) {
-                Algorithm.EC -> "SHA256withECDSA"
-                Algorithm.RSA -> "SHA256withRSA"
-                else -> throw IllegalArgumentException("Unsupported algorithm: ${params.algorithm}")
+            when (signingKeyPair.private.algorithm) {
+                "EC" -> "SHA256withECDSA"
+                "RSA" -> "SHA256withRSA"
+                else -> throw IllegalArgumentException("Unsupported signing key: ${signingKeyPair.private.algorithm}")
             }
         val contentSigner =
             JcaContentSignerBuilder(signerAlgorithm)