Integrated key and app attestation suite for generating mobile attestation statements, server-side verification, CSR-based transport, nonce-based freshness, and debugging/record-and-replay tooling.
[!TIP] Need help tailored to your needs? See our 💎 Services.
Warden Supreme is a fully integrated key and app attestation suite consisting of:
Put differently, Warden Supreme is the evolution of the battle-tested WARDEN server-side key and app attestation library, augmented by Signum's Supreme KMP crypto provider for a consistent UX across Android and iOS.
The original server-side-only key and app attestation library is still available and actively maintained, as it is one of the pillars supporting Warden Supreme. It now lives on as Warden makoto and continues to be published to Maven Central.
[!WARNING] Warden Supreme changed some defaults compared to previous WARDEN / WARDEN-roboto
Most prominently, there is no Nougat hybrid attestation any more and trust anchor management was completely revamped.
Do check out the full migration guide.Ignoring these changes can result in a total security failure if you do not ensure freshness by feeding random cryptographic nonces into attestation statement creation and properly checking them.
This README provides only a brief overview. Warden Supreme's extensive documentation hub is a comprehensive one-stop shop covering all topics regarding key and app attestation.
The documentation hub explains the basic concepts, how to apply them, and provides a detailed write-up on how Android and iOS implement them. The full documentation also lays out a foundation for risk analysis for anyone considering attestation as part of a more comprehensive security model. Finally, it lists lessons learned from deploying and relying on Warden in production, attesting millions of clients, including hiccups, glitches, and outright failures due to non-compliant vendor implementations—and how to cope with them.
The remainder of this document assumes familiarity with all topics covered by the full documentation, and serves as a quick-start guide to integrate Warden Supreme to remotely establish trust in mobile clients.
Full API docs are available here.
Warden Supreme targets Android and iOS clients and JVM-based back-ends.
verifier dependency:
implementation("at.asitplus.warden:supreme-verifier:$version")
client dependency:
implementation("at.asitplus.warden:supreme-client:$version")
[!TIP] Check out Warden Supreme's integration guide for a step-by-step integration tutorial and a minimum working example. The guide includes code samples and minimum and exhaustive configuration examples.
Warden Supreme currently supports only HTTP as its communication protocol and relies on Ktor on mobile clients. The back-end, however, can also use Spring, for example.
An attestation flow works as follows:
Figure 1 illustrates this process.
Figure 1: Remotely establishing trust in mobile clients
As shown in Figure 1, the back-end needs to be configured before it can assert a client’s trustworthiness. While the API is unified across Android and iOS (for both attestation statement creation on clients and verification on the server), configuration must still handle each platform separately.
Whenever the attestation check fails (i.e., whenever onAttestationError() is called), a ready-made
WardenDebugAttestationStatement is created and passed to this function.
This gives you two inputs to aid debugging:
WardenDebugAttestationStatement can be serialized to JSON by invoking .serialize() (or serializeCompact()) on it.
It can later be deserialized by calling deserialize() (or deserializeCompact()) on its companion.
Finally, call replay() on the deserialized debug object to replay the full attestation verification process.
Attaching a debugger allows step-by-step inspection of any attestation errors encountered. For the most straightforward debugging experience:
Be sure to add a single argument pointing to a file as described in Diag.kt.
A similar utility exists for printing the contents of an Android attestation statement, located in /utils/roboto-diag. More specifically, it pretty-prints the contents of the leaf certificate's Android attestation extension and expects either:
-f path/to/leaf/certificate.pemIt then serializes a certificate to JSON, giving insight into the attestable properties.
This project is structured into four groups:
/supreme contains the Supreme integrated key and app attestation suite, building upon group 2/serverside contains the server-side foundations with all low-level logic to verify attestations/utils contains unpublished utilities for investigating attestation errors; these are intended to be used inside an IDE with a debugger attached/dependencies contains external dependencies that are not published to Maven Central (or anywhere else) and are thus compiled into group 2 or used for testing/supreme/serversideThe modules located here can be used on their own, in case the Supreme integrated attestation suite is not desired.
/utilsThis group houses the debugging/examination utilities mentioned in Section 2.
/dependenciesTeams at Google released reference Android attestation parsers (not full attestation checkers to remotely establish trust in Android devices) and PKIX certificate path validators to complement parsing. They did not, however, publish these artifacts to Maven Central. Hence, Warden Supreme integrates them as git submodules and compiles them into Warden roboto.
In addition, an HTTP proxy is included to facilitate testing. It is not, however, shipped with any artifact.
External contributions are greatly appreciated. Please observe the contribution guidelines (see CONTRIBUTING.md).
This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 959072.
The Apache License does not apply to the logos (including the A-SIT logo) and the project/module name(s), as these are the sole property of A-SIT/A-SIT Plus GmbH and may not be used in derivative works without explicit permission!
| Name | Info |
|---|
 | Supreme verifier to be integrated into back-ends that want to remotely establish trust in mobile clients through key and app attestation. |
 | Supreme client to be integrated into mobile apps that need to prove their integrity and trustworthiness towards back-end services. |
 | Commons containing shared client and verifier logic, data classes, etc. |
 |  |
|---|
| Android-only server-side key and app attestation library developed by A-SIT Plus. Used to be a separate project, now integrated here as a module. | Unified server-side Android and iOS key and app attestation library providing a common API to remotely establish trust in Android and iOS devices. Depends on Warden roboto and Vincent Haupert's excellent DeviceCheck/AppAttest library. |
Location: /serverside/roboto | Location: /serverside/makoto |
Maven coordinates: at.asitplus.warden:roboto | Maven coordinates: at.asitplus.warden:makoto |
Surfaced from shared tags and platforms — no rankings paid for.