AOSP keystore2 attestation lists KEY_SIZE only when there is no authoritative key-shape tag. For EC keys the curve already pins the key size, so emitting both KEY_SIZE and EC_CURVE is a forgery fingerprint. Guard the createAuth call accordingly.
AOSP keystore2 attestation lists KEY_SIZE only when there is no authoritative key-shape tag. For EC keys the curve already pins the key size, so emitting both KEY_SIZE and EC_CURVE is a forgery fingerprint. Guard the createAuth call accordingly.