Attestation & Hardcoded Secrets (Android+ iOS): Best Practises, Know, Tests, Demos by Diolor · Pull Request #3756 · OWASP/mastg

Diolor · 2026-04-02T22:27:03Z

This PR closes #3505 and #3767

Description

A backend cannot trust anything a mobile client claims about itself. Attestation is how it gets cryptographic evidence instead, and it is the precondition for every other client-side control: certificate pinning and RASP only mean something once the app binary and the device are known to be genuine.

MASTG had the pieces but not the guidance. Key attestation was a single storage-oriented KNOW, device and app attestation were placeholders, App Attest and DeviceCheck were conflated in a platform overview, and nothing said what a server should actually verify. Hardcoded API keys — the most common reason a client holds a secret it cannot protect — had no test at all, and the honest mitigation for them is attestation, so the two belong in one PR.

What

Best practices — server-side verification for Android Key Attestation (BEST-0x01) and iOS App Attest (BEST-0x03), plus mitigations for keys that must ship in the package (BEST-0x02).
Knowledge — Key Attestation reworked and moved to MASVS-RESILIENCE; device and app attestation placeholders filled in; new Firebase App Check, App Attest and DeviceCheck entries.
Tests — app attestation (TEST-0x01/0x02), device attestation (TEST-0x05, first coverage of MASWE-0054), hardcoded secrets (TEST-0x03/0x04).
Demos — seven, each with a semgrep or r2 script and generated output. Android demos were run on an emulator; the decompiled Java matches a real build.
Deduplication — App Attest and DeviceCheck prose removed from the iOS platform overview and KNOW-0135, now pointing at the new knowledge entries.

Known gap

No best practice covers the Play Integrity API itself. BEST-0x01 recommends it as the starting point but only documents the manual Key Attestation path, and the nonce guidance that used to live in KNOW-0035 was removed with the rewrite. Worth a follow-up.

TODO:

Allocate IDs before merge

AI Tool Disclosure

This contribution includes AI-generated content.
AI tools used: Claude Code
Models and versions: Claude Opus 5
Prompt summary: Grammar, feedback and reading cohesion throughout. Later used to review the branch for gaps and broken cross-references, to draft TEST-0x05 and the device-attestation demo, and to build and verify the demos against a local emulator and simulator.

Copilot

Pull request overview

This PR adds Android-focused guidance around Key Attestation by introducing new Knowledge pages (generic Key Attestation plus device/app-attestation-focused pages) and a new Best Practice that recommends using server-verified, hardware-backed attestation for integrity decisions.

Changes:

Moves/reworks the existing Key Attestation Knowledge content into MASVS-RESILIENCE and expands it with certificate-chain and field interpretation details.
Adds two new Knowledge pages for device attestation (rootOfTrust) and application attestation (attestationApplicationId).
Adds a new Android Best Practice describing a server-driven attestation flow and verification checks; updates related Storage Knowledge pages to reference the new Key Attestation KNOW.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
knowledge/android/MASVS-STORAGE/MASTG-KNOW-0047.md	Updates wording around using Key Attestation to verify keys are hardware-backed.
knowledge/android/MASVS-STORAGE/MASTG-KNOW-0045.md	Adds an explicit cross-reference to the Key Attestation Knowledge page.
knowledge/android/MASVS-STORAGE/MASTG-KNOW-0044.md	Removes the old Storage-category Key Attestation Knowledge page content (relocated).
knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0044.md	Adds the new Resilience-category Key Attestation Knowledge page with updated structure and references.
knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-01kw.md	Adds a new Knowledge page focused on device attestation fields (root of trust).
knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-02kw.md	Adds a new Knowledge page focused on application attestation fields (application ID).
best-practices/MASTG-BEST-00be.md	Adds a new Best Practice recommending hardware-backed key attestation for device/app integrity.

Copilot · 2026-04-08T11:40:17Z

+For a reference implementation, see [Dionysis Lorentzos' Android-Security sample](https://github.com/Diolor/Android-Security/blob/main/app/src/main/java/dio/security/crypto/KeyManager.kt#L45-L70).
+
+## Reading the X.509 Certificate
+
+The returned [X509Certificate](https://developer.android.com/reference/kotlin/java/security/cert/X509Certificate) chain from [`KeyStore.getCertificateChain(alias)`](https://developer.android.com/reference/kotlin/java/security/KeyStore#getcertificatechain) can be inspected to determine the key properties. X.509 certificates are described by [ASN.1 format](https://source.android.com/docs/security/features/keystore/attestation#tbscertificate-sequence) and the Android-specific extensions (certificate's payload) can be requested with OID `1.3.6.1.4.1.11129.2.1.17`. This attestation extension content is described by the [ASN.1 schema KeyDescription](https://source.android.com/docs/security/features/keystore/attestation#schema).
+
+For a sample decoding functionality of X.509 certificate's payload, you may consult [Dionysis Lorentzos' - Simple attestation converter](https://github.com/Diolor/Android-Security/blob/main/app/src/main/java/dio/security/crypto/attestation/Attestation.kt#L34-L64).


This Knowledge page links to non-official, personal GitHub repositories as “reference implementations”. Knowledge pages are expected to rely on official documentation/standards; consider replacing these with official sources (Android docs, AOSP, or Google-maintained samples) or move third-party samples to DEMO/tooling content.

I could copy the sample code here however the reader might lose context

…code examples

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Move attestation-focused TEST-0x01 here from the file-integrity branch. Pairs with existing MASTG-KNOW-0x02 (DeviceCheck) and MASTG-KNOW-0x03 (App Attest). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

- Rename Android key-attestation test MASTG-TEST-0342 -> MASTG-TEST-0x01 (resolves duplicate ID with iOS NETWORK MASTG-TEST-0342) and update MASTG-DEMO-0x01 to reference it. - Rename iOS App Attest test MASTG-TEST-0x01 -> MASTG-TEST-0x02. Android (original) attestation under 0x01, iOS (new) under 0x02. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Placeholder demo md only (no r2 or sample files), paired with MASTG-TEST-0x02. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…MASWE-0056

Diolor · 2026-08-16T16:18:46Z

@@ -0,0 +1,74 @@
+---
+title: Use Hardware-Backed Key Attestation for Device and App Integrity


After merge MASWE-0006 should reference this

Diolor · 2026-08-16T16:18:50Z

@@ -0,0 +1,73 @@
+---
+title: Mitigate the Risk of API Keys Hardcoded in the App Package


After merge MASWE-0006 should reference this

…device attestation in MASTG-BEST-0x02 and MASTG-KNOW-0044, and clarify DeviceCheck and App Attest functionalities in related documents.

…n MASTG-BEST-0x01 and mark MASTG-DEMO-0x01 as a failing test case

…MASTG-BEST-0x01

…ficate verification, including updates on root certificate management, revocation checks, and validity period enforcement. Add new section on attestation key provisioning methods and their implications.

… detection rules and test case

…pp attestation APIs and their integrity verification processes

…ation

…raction steps and evaluation criteria

…Challenge, emphasizing the importance of certificate chain retrieval for attestation. Update documentation to reflect manual correlation of key generation and certificate chain retrieval.

… for readability.

…ted scripts

…2.md

Diolor marked this pull request as ready for review April 2, 2026 22:35

Diolor added MASVS-RESILIENCE knowledge best practices labels Apr 3, 2026

Diolor self-assigned this Apr 3, 2026

cpholguera requested a review from Copilot April 8, 2026 11:36

Copilot started reviewing on behalf of cpholguera April 8, 2026 11:36 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Diolor mentioned this pull request May 12, 2026

0x05d Refactor - Remove Info already available Online #1841

Closed

cpholguera reviewed May 13, 2026

View reviewed changes

Comment thread knowledge/android/MASVS-RESILIENCE/MASTG-KNOW-0044.md

Diolor force-pushed the key-attestation-best-practice branch from 39b2e27 to 7d8ccdb Compare May 14, 2026 17:39

Diolor and others added 17 commits May 14, 2026 19:43

Move MASTG-KNOW-0044 from MASVS-STORAGE to MASVS-RESILIENCE

d31306f

Clean BE/KW regarding attestation

dd0cc30

Clean BE/KW regarding attestation

d37cdac

Enhance key attestation documentation with detailed explanations and …

4b197af

…code examples

WIP attestation

19c80a6

Enhance Android Key Attestation

a165a22

Enhance Android Key Attestation

87a920e

Enhance Android Key Attestation

057773b

Make descriptive content

b2d567b

grammar

02ac39a

Fix irelevant info

bb98920

Add pointer

b58d198

Indents

02e6af6

Lint + fix prescriptive

544ea58

Move Integrity Signals to BEST

6007387

Update knowledge/android/MASVS-STORAGE/MASTG-KNOW-0045.md

76546c3

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Use existing placeholders

aed967d

Diolor force-pushed the key-attestation-best-practice branch from 7d8ccdb to aed967d Compare May 14, 2026 17:49

Add tests

0ef2111

Diolor and others added 5 commits June 14, 2026 23:53

Revert

efcb468

Restore fix_ids.py OWASP#3869 logic accidentally over-reverted

bcc6696

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Add iOS App Attest test (MASTG-TEST-0x01)

9ba815c

Move attestation-focused TEST-0x01 here from the file-integrity branch. Pairs with existing MASTG-KNOW-0x02 (DeviceCheck) and MASTG-KNOW-0x03 (App Attest). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Add placeholder iOS App Attest demo (MASTG-DEMO-0x02)

e954d30

Placeholder demo md only (no r2 or sample files), paired with MASTG-TEST-0x02. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Diolor changed the title ~~Key attestation (Android)~~ Attestation (Android+ iOS): Best Practises, Know, Tests, Demos Jun 20, 2026

Diolor added iOS demos labels Aug 15, 2026

Diolor added 2 commits August 16, 2026 17:57

Merge branch 'master' into key-attestation-best-practice

0b03289

Update weakness references in MASTG-TEST-0x01 and MASTG-TEST-0x02 to …

684f40b

…MASWE-0056

Diolor commented Aug 16, 2026

View reviewed changes

Diolor added 17 commits August 16, 2026 18:33

Update references to MASTG-BEST-0x01 and MASTG-BEST-0x03 for app and …

228e29d

…device attestation in MASTG-BEST-0x02 and MASTG-KNOW-0044, and clarify DeviceCheck and App Attest functionalities in related documents.

Remove placeholder status from MASTG-TEST-0x01

cad1078

Remove placeholder status from MASTG-TEST-0x01

1c68f96

Clarify implications of attestationSecurityLevel being Software i…

195d5d8

…n MASTG-BEST-0x01 and mark MASTG-DEMO-0x01 as a failing test case

Add demo for key attestation with server-issued challenge and update …

74a8127

…MASTG-BEST-0x01

Enhance MASTG-BEST-0x01 with detailed guidelines on attestation certi…

fa8007d

…ficate verification, including updates on root certificate management, revocation checks, and validity period enforcement. Add new section on attestation key provisioning methods and their implications.

Add demo for hardcoded API keys and secrets in Android app, including…

184f46c

… detection rules and test case

Update MASTG-TEST-0x01 and MASTG-TEST-0x02 to clarify references to a…

16a557a

…pp attestation APIs and their integrity verification processes

Add demo for App Attest using hardcoded challenge and update document…

e1d70ec

…ation

Add demo for hardcoded API keys and secrets in iOS app, including ext…

c5db358

…raction steps and evaluation criteria

Clarify detection rule for KeyGenParameterSpec without setAttestation…

70658fe

…Challenge, emphasizing the importance of certificate chain retrieval for attestation. Update documentation to reflect manual correlation of key generation and certificate chain retrieval.

Correct formatting of quota limit in MASTG-KNOW-0035.md to use commas…

4103005

… for readability.

Remove placeholder status in MASTG-TEST-0x02.md to reflect current state

ea8c8bf

Add test for device attestation API references in MASTG-TEST-0x05.md

5b7f210

Add demo for App Attest using server-issued challenge and update rela…

126d180

…ted scripts

Add demo for retrieving device integrity signals via key attestation

781aa25

Add note about App Attest limitations on simulators in MASTG-DEMO-0x0…

840a413

…2.md

Diolor changed the title ~~Attestation (Android+ iOS): Best Practises, Know, Tests, Demos~~ Attestation & Hardcoded Secrets (Android+ iOS): Best Practises, Know, Tests, Demos Aug 16, 2026

Navigation Menu

Uh oh!

Uh oh!

Attestation & Hardcoded Secrets (Android+ iOS): Best Practises, Know, Tests, Demos - #3756

Attestation & Hardcoded Secrets (Android+ iOS): Best Practises, Know, Tests, Demos#3756
Diolor wants to merge 59 commits into
OWASP:masterfrom
Diolor:key-attestation-best-practice

Diolor commented Apr 2, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Diolor Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Diolor Aug 16, 2026

Uh oh!

Diolor Aug 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		@@ -0,0 +1,74 @@
		---
		title: Use Hardware-Backed Key Attestation for Device and App Integrity

		@@ -0,0 +1,73 @@
		---
		title: Mitigate the Risk of API Keys Hardcoded in the App Package

Uh oh!

Uh oh!

Conversation

Diolor commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What

Known gap

AI Tool Disclosure

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Diolor Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Diolor Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

Diolor Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Diolor commented Apr 2, 2026 •

edited

Loading