From ca226bd7dea77f19d4764aa083e192ab72ac7660 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Wed, 17 Jun 2026 20:28:28 +0100 Subject: [PATCH] chore(pki): log attest-sign signer vs leaf algo At the attest-key signing instant, log signer key algorithm, served leaf algorithm, chain depth, and issuer (debug, targeted uid) so an EC attest-key run pins the mismatched edge of the two-root chain. Bucket a16-ec-attestkey-red, task T01. --- .../org/matrix/TEESimulator/pki/CertificateGenerator.kt | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt b/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt index 1411c75..ac7f4cc 100644 --- a/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt +++ b/app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt @@ -218,6 +218,15 @@ object CertificateGenerator { val certChain = CertificateHelper.getCertificateChain(keyInfo.response) if (!certChain.isNullOrEmpty()) { val issuer = X509CertificateHolder(certChain[0].encoded).subject + // The leaf is signed by keyInfo.keyPair, but the caller verifies it against the + // public key of the chain getCertChain(attestKeyAlias) serves. A two-rooted EC chain + // (DATA_TOO_LARGE_FOR_MODULUS) is exactly those two disagreeing on algorithm; log + // both at the signing instant so an EC attest-key run pins the mismatched edge. + SystemLogger.uidLog(uid, null, "attest-sign") { + "alias=$attestKeyAlias signerKey=${keyInfo.keyPair?.public?.algorithm} " + + "servedLeafKey=${certChain[0].publicKey.algorithm} " + + "depth=${certChain.size} issuer=$issuer" + } Pair(keyInfo.keyPair, issuer) } else { null