From ea37792653be2efd24a059ab4572a047b634e157 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 19 May 2026 17:00:04 +0100 Subject: [PATCH] fix(util): drop StrongBox attest version hardcode StrongBox was pinned to attest/keymaster v300 regardless of SDK, which mismatches devices shipping KeyMint v400 on Android 16. Fall through to the same SDK_INT->version map used by the TEE path so StrongBox reports the device-correct tier. --- .../matrix/TEESimulator/util/AndroidDeviceUtils.kt | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/util/AndroidDeviceUtils.kt b/app/src/main/java/org/matrix/TEESimulator/util/AndroidDeviceUtils.kt index 17ec99a..f6883a3 100644 --- a/app/src/main/java/org/matrix/TEESimulator/util/AndroidDeviceUtils.kt +++ b/app/src/main/java/org/matrix/TEESimulator/util/AndroidDeviceUtils.kt @@ -1,6 +1,5 @@ package org.matrix.TEESimulator.util -import android.hardware.security.keymint.SecurityLevel import android.os.Build import android.os.SystemProperties import java.io.ByteArrayOutputStream @@ -396,17 +395,15 @@ object AndroidDeviceUtils { ) /** - * Retrieves the attestation version based on security level and OS version. StrongBox (level 2) - * requires version 300. + * Retrieves the attestation version for the given security level. The value follows the device + * OS: cached attestation data wins, then attestVersionMap[SDK_INT], then 400 as last resort. + * A static StrongBox=300 floor would force a major-version mismatch with the TEE chain on + * Android 16 devices that report keymaster 400 across both security levels. * * @param securityLevel The security level of the attestation (1 for TEE, 2 for StrongBox). * @return The appropriate attestation version number. */ fun getAttestVersion(securityLevel: Int): Int { - // StrongBox security level requires an attestation version of at least 300. - if (securityLevel == SecurityLevel.STRONGBOX) { - return 300 - } val cached = DeviceAttestationService.CachedAttestationData?.attestVersion val version = cached ?: attestVersionMap[Build.VERSION.SDK_INT]