Skip to content

Commit

Permalink
add knox sakv2 root public key
Browse files Browse the repository at this point in the history
  • Loading branch information
vvb2060 committed Jan 22, 2024
1 parent c7b3e8f commit a92bc7a
Show file tree
Hide file tree
Showing 4 changed files with 22 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,8 @@ public class CertificateInfo {
public static final int KEY_UNKNOWN = 0;
public static final int KEY_AOSP = 1;
public static final int KEY_GOOGLE = 2;
public static final int KEY_OEM = 3;
public static final int KEY_KNOX = 3;
public static final int KEY_OEM = 4;

public static final int CERT_UNKNOWN = 0;
public static final int CERT_SIGN = 1;
Expand Down Expand Up @@ -63,9 +64,16 @@ public class CertificateInfo {
"MdsGUmX4RFlXYfC78hdLt0GAZMAoDo9Sd47b0ke2RekZyOmLw9vCkT/X11DEHTVm" +
"+Vfkl5YLCazOkjWFmwIDAQAB";

private static final String KNOX_SAKV2_ROOT_PUBLIC_KEY = "" +
"MIGbMBAGByqGSM49AgEGBSuBBAAjA4GGAAQBhbGuLrpql5I2WJmrE5kEVZOo+dgA" +
"46mKrVJf/sgzfzs2u7M9c1Y9ZkCEiiYkhTFE9vPbasmUfXybwgZ2EM30A1ABPd12" +
"4n3JbEDfsB/wnMH1AcgsJyJFPbETZiy42Fhwi+2BCA5bcHe7SrdkRIYSsdBRaKBo" +
"ZsapxB0gAOs0jSPRX5M=";

private static final byte[] googleKey = Base64.decode(GOOGLE_ROOT_PUBLIC_KEY, 0);
private static final byte[] aospEcKey = Base64.decode(AOSP_ROOT_EC_PUBLIC_KEY, 0);
private static final byte[] aospRsaKey = Base64.decode(AOSP_ROOT_RSA_PUBLIC_KEY, 0);
private static final byte[] knoxSakv2Key = Base64.decode(KNOX_SAKV2_ROOT_PUBLIC_KEY, 0);
private static final Set<PublicKey> oemKeys = getOemPublicKey();

private final X509Certificate cert;
Expand Down Expand Up @@ -117,6 +125,8 @@ private void checkIssuer() {
issuer = KEY_AOSP;
} else if (Arrays.equals(publicKey, aospRsaKey)) {
issuer = KEY_AOSP;
} else if (Arrays.equals(publicKey, knoxSakv2Key)) {
issuer = KEY_KNOX;
} else if (oemKeys != null) {
for (var key : oemKeys) {
if (Arrays.equals(publicKey, key.getEncoded())) {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,13 @@ class HomeAdapter(listener: Listener) : IdBasedRecyclerViewAdapter() {
R.drawable.ic_trustworthy_24,
rikka.material.R.attr.colorSafe), ID_CERT_STATUS)
}
CertificateInfo.KEY_KNOX -> {
addItem(HeaderViewHolder.CREATOR, HeaderData(
R.string.knox_root_cert,
R.string.knox_root_cert_summary,
R.drawable.ic_trustworthy_24,
rikka.material.R.attr.colorSafe), ID_CERT_STATUS)
}
CertificateInfo.KEY_OEM -> {
addItem(HeaderViewHolder.CREATOR, HeaderData(
R.string.oem_root_cert,
Expand Down
2 changes: 2 additions & 0 deletions app/src/main/res/values-zh-rCN/strings.xml
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@
<string name="aosp_root_cert_summary">认证密钥的私钥众所周知,证书链可以被篡改。</string>
<string name="google_root_cert">由 Google 硬件认证根证书签名</string>
<string name="google_root_cert_summary">兼容 GMS 的设备可以使用由 Google 签名的认证密钥。</string>
<string name="knox_root_cert">由三星 Knox 认证根证书签名</string>
<string name="knox_root_cert_summary">Knox 认证使用三星认证密钥(SAK)签名。</string>
<string name="oem_root_cert">由设备制造商的根证书签名</string>
<string name="oem_root_cert_summary">此设备信任该根证书,但它可能不被其它人信任。</string>

Expand Down
2 changes: 2 additions & 0 deletions app/src/main/res/values/strings.xml
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,8 @@
<string name="aosp_root_cert_summary">Private key of attest key is well known, the certificate chain can be tampered with.</string>
<string name="google_root_cert">Google hardware attestation root certificate</string>
<string name="google_root_cert_summary">GMS compatible devices can use attest keys signed by Google.</string>
<string name="knox_root_cert">Samsung Knox attestation root certificate</string>
<string name="knox_root_cert_summary">Knox attestation is signed using Samsung attestation key(SAK).</string>
<string name="oem_root_cert">OEM root certificate</string>
<string name="oem_root_cert_summary">This device trusts this root certificate, but it may not be trusted by others.</string>

Expand Down

0 comments on commit a92bc7a

Please sign in to comment.