Post not yet marked as solved
According to the App Check Firebase Documentation, it is said to add the App Attest capability to your app. However, I am not able to find any such capability in XCode. Any insights on this?
Note: We have enabled capability in the provision profiles
Documentation Link: https://firebase.google.com/docs/app-check/ios/app-attest-provider#install-sdk
Post not yet marked as solved
Hello,
I am sending valid base64 receipt data to Apple on the https://data-development.appattest.apple.com/v1/attestationData endpoint and am getting 400 bad request. I have a valid JWT that I currently use successfully for other DeviceCheck endpoints such as persistent bits.
Any help debugging would be useful.
Thanks
Post not yet marked as solved
I'm testing with a simulator and isSupported is returning True..
Post not yet marked as solved
In the WWDC 2021 session Mitigate fraud with App Attest and DeviceCheck it is said that:
App Attest is supported on devices that have a Secure Enclave, but there are cases, such as app extensions, where isSupported will still return false.
The documentation shows that the following Macs have a Secure Enclave:
MacBook Pro computers with Touch Bar (2016 and 2017) that contain the Apple T1 Chip
Intel-based Mac computers that contain the Apple T2 Security Chip
Mac computers with Apple silicon
I'm using a 2018 15" MacBook Pro containing a T2 Security Chip for testing, however, DCAppAttestService.shared.isSupported always returns false in native macOS or Catalyst apps. DCDevice.current.isSupported also returns false.
The documentation for DCAppAttestService shows availability on "macOS 11.0+" and "Mac Catalyst 14.0+". It appears to have been added in the macOS 11.3 SDK included in Xcode 12.5. DCDevice shows availability on "macOS 10.15+" and "Mac Catalyst 13.0+". Although both APIs are available on the listed OSes, I only ever see isSupported == false.
Are App Attest or DeviceCheck functional on any Macs? If so:
Are there more specific Macs that support the feature (e.g., Apple Silicon Macs only)?
Are there any additional steps that need to be taken to use them (e.g., changes to entitlements, provisioning profiles or distribution through the Mac App Store)?
In native macOS apps, it doesn't actually appear to be possible to add the App Attest capability in Xcode under "Signing & Capabilities".
If not, I think it would be good to update the documentation with this limitation since I'd expect them to work based on the availability being "macOS 10.15+" or "macOS 11.0+" for DeviceCheck and App Attest, respectively. I imagine most others would make the same assumptions.
Post not yet marked as solved
I'm looking at a development attestation for an app we're developing in-house, and there's a couple of undocumented PEN's being used:
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 1631564652467 (0x17be0d4dfb3)
Signature Algorithm: ecdsa-with-SHA256
Issuer: CN = Apple App Attestation CA 1, O = Apple Inc., ST = California
Validity
Not Before: Sep 12 20:24:12 2021 GMT
Not After : Sep 15 20:24:12 2021 GMT
Subject: CN = a203e1588ab36ae2ffc362491c2948df5d03f3ed048d0c58a59c9e085724353c, OU = AAA Certification, O = Apple Inc., ST = California
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:09:1a:ae:9f:d2:0b:89:e6:6b:ab:68:3e:70:e1:
6d:0f:b1:2f:8b:4b:bd:c9:d2:54:ec:15:2c:b4:fc:
4c:8d:fb:e1:49:0d:90:34:80:10:82:08:6c:49:58:
7e:2c:5b:90:2b:80:2d:1f:f3:e9:36:59:51:d2:3e:
1d:d2:f8:75:e3
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Key Usage: critical
Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
1.2.840.113635.100.8.5:
0:d=0 hl=2 l= 111 cons: SEQUENCE
2:d=1 hl=2 l= 3 cons: cont [ 4 ]
4:d=2 hl=2 l= 1 prim: INTEGER :0A
7:d=1 hl=4 l= 3 cons: cont [ 1200 ]
11:d=2 hl=2 l= 1 prim: INTEGER :01
14:d=1 hl=4 l= 3 cons: cont [ 1201 ]
18:d=2 hl=2 l= 1 prim: INTEGER :00
21:d=1 hl=4 l= 3 cons: cont [ 1202 ]
25:d=2 hl=2 l= 1 prim: INTEGER :01
28:d=1 hl=4 l= 3 cons: cont [ 1203 ]
32:d=2 hl=2 l= 1 prim: INTEGER :01
35:d=1 hl=4 l= 38 cons: cont [ 1204 ]
39:d=2 hl=2 l= 36 prim: OCTET STRING :XKXEK7P8ZU.com.truepic.appattestdemo
77:d=1 hl=2 l= 6 cons: cont [ 5 ]
79:d=2 hl=2 l= 4 prim: OCTET STRING :sks
85:d=1 hl=4 l= 3 cons: cont [ 1206 ]
89:d=2 hl=2 l= 1 prim: INTEGER :05
92:d=1 hl=4 l= 3 cons: cont [ 1207 ]
96:d=2 hl=2 l= 1 prim: INTEGER :00
99:d=1 hl=4 l= 3 cons: cont [ 1209 ]
103:d=2 hl=2 l= 1 prim: INTEGER :00
106:d=1 hl=4 l= 3 cons: cont [ 1210 ]
110:d=2 hl=2 l= 1 prim: INTEGER :00
1.2.840.113635.100.8.7:
0:d=0 hl=2 l= 6 cons: SEQUENCE
2:d=1 hl=4 l= 2 cons: cont [ 1400 ]
6:d=2 hl=2 l= 0 prim: OCTET STRING
1.2.840.113635.100.8.2:
0:d=0 hl=2 l= 36 cons: SEQUENCE
2:d=1 hl=2 l= 34 cons: cont [ 1 ]
4:d=2 hl=2 l= 32 prim: OCTET STRING
0000 - 52 93 c9 c6 69 4e 74 3c-63 13 4b d0 0a 92 12 87 R...iNt<c.K.....
0010 - 36 64 cf c3 3d 8d c0 5b-3b 26 72 5a a4 5a ab 71 6d..=..[;&rZ.Z.q
Signature Algorithm: ecdsa-with-SHA256
30:65:02:31:00:d0:40:c9:18:68:10:c7:0d:2a:04:31:9a:38:
74:7a:ee:1e:a3:da:a3:58:05:0f:15:ae:86:9e:19:07:b8:d3:
67:fc:c1:3f:e4:c2:eb:1b:37:d5:b1:c3:6f:df:52:da:c0:02:
30:5b:8e:d8:67:9e:5d:59:64:68:bf:85:a8:a7:ae:e8:a8:e4:
06:f0:df:75:c5:e8:7e:0a:d4:24:64:e8:6c:c3:2d:ac:31:bf:
3f:d1:78:a7:00:ff:11:31:1b:28:08:27:5d
.2 I get. It's documented in Validating Apps That Connect to Your Server.
Some GitHub gists suggest that .7 is supposed to be an Octet String containing the iOS version number, but it's empty in our case. Unclear why.
No idea what .5 is supposed to be.
Does anyone have any insight into these last two?
Also, how does one determine the particular that's generating the attestation? Android SafetyNet attestation generates a unique hash (as the list of SHA256's in apkCertificateDigestSha256); it seems to me that we might want to further fine-tune the handling of sensitive operations based on the specifics of the version.
Lastly, the above cited documentation states, in the "Store the Public Key and Receipt" section:
Store the verified public key from credCert on your server and associate it with the user for the specific device. You use this key to check assertions later.
But iOS (and iPadOS) doesn't support multiple accounts per device. So I'm interpreting this to not refer to an associated AppleID, but rather credentials in some app-specific space defined by the app developer. Is that correct?
Thanks
Post not yet marked as solved
I am trying to generate DeviceCheck token with DCDevice.current.generateToken. There was no problem at first, but after a few days, it started to give the error below:The operation couldn’t be completed. (com.apple.devicecheck.error error 0.)Interesting point is that, the problem starts and ends at the same time on all devices, at random time periods of the day. My question are;* What "Error 0" means?* I thought generateToken method generates the token in the device offline, but it seems not (by starting to give error on generateToken simultaneously on all devices), can you give some details on how generateToken works?* Do you have any comments on starting to get "Error 0" on all devices at the same time?Thanks.
Post not yet marked as solved
Hello guys,
Me and my team are developing an application which uses some data from an API and we need to verify that we can recognize a single user ID of the iOS phone to establish a univocal trust relation to share keys that would help us encrypt the communications.
I tried some pieces on code that I found on internet, but I do not know if this is enough.
print("ID Vendor...\(String(describing: uiDevice.identifierForVendor))")
print("iCloud token...\(String(describing: FileManager.default.ubiquityIdentityToken?.description))")
And also I was trying to work with DeviceCheck framework and to get that token.
print("Generate token")
DCDevice.current.generateToken {
(data, error) in
guard let data = data else {
return
}
let token = data.base64EncodedString()
print("Token...\(token)")
What I want to do is to verify the user identity something like the Apple ID or some personal data, not the device information.
Is there a way of retrieving some personal data from the owner of the iPhone that I can use to check if he is who said that it is?
Thank you so much!
Have a good day!
prakruth-yml8.
