Tutorial

Installation

This app is available through the Play Store with the app.attestation.auditor.play app id. Play Store releases go through review and it usually takes around 1 to 3 days before the Play Store pushes out the update to users. Play Store releases use Play Signing, so we use a separate app id from the releases we publish ourselves to avoid conflicts and to distinguish between them.

Releases of the app signed by GrapheneOS with the app.attestation.auditor app id are published in the GrapheneOS app repository and on GitHub. These releases are also bundled as part of GrapheneOS. You can use the GrapheneOS app repository client on Android 12 or later for automatic updates.

Releases are initially pushed out through the Alpha channel channel for both the Play Store and our app repository, then get moved to the Beta channel and finally the Stable channel.

Local verification

The device being verified (Auditee) must be one of the supported devices. Android developer previews aren't supported since the hardware verified version is set to a placeholder value. The device performing verification (Auditor) just needs to be any Android 10 or higher device with a camera.

  1. press Auditor on the device that will be verifying the Auditee
  2. press Auditee on the device that's going to be verified
  3. point the camera of the Auditee at the QR code on the Auditor to read the challenge
  4. tap the QR code on the Auditor to advance ahead (if you do this too early, you can press back)
  5. point the camera of the Auditor at the QR code on the Auditee to read the attestation
  6. view verification of the attestation results

An Auditor can verify any number of different Auditee devices. It shows a fingerprint and the first / last verification time in successful paired attestation results. An Auditee can be verified by any number of Auditors but there will be a different fingerprint for each unique pairing rather than the same fingerprint shown on each Auditor for the same Auditee.

Scheduled remote verification

To set up regularly scheduled remote verification via the remote attestation service:

  1. create an account on https://attestation.app/ from a separate device
  2. press the 'Enable remote verification' button in the app
  3. scan the account QR code displayed on https://attestation.app/
  4. configure an alert email address to receive alerts if the device fails to provide valid attestations in time
  5. refresh https://attestation.app/ to view the initial attestation result

Expanding device support

Support for verifying a device needs to be added to the app based on at least one valid key attestation sample from the stock OS with the bootloader locked. The Auditor app can theoretically support verifying any Android devices launched with Android 8 or later. An upgrade to Android 8 isn't enough since hardware key attestation support is required and the minimum requirements only became mandatory with Android 8.

To submit a sample, open the menu from the action bar and select 'Submit sample data'. This will submit a sample attestation and device information, enabling the development of support for the device. It may take a few weeks before support is shipped in a new version of the app.