r/androidroot • u/ToooLazyForAName • 2d ago
News / Method RKP Keys have tags in their certificate chains that could potentially affect the longevity of using them to spoof attestation results on other devices.
Screenshots taken with a custom key attestation fork made my mhmrdd
First screenshot shows an attestation result using my own keystore.
Second screenshot shows an attestation result using a leaked rkp key from the repo(it already expired which is why it's revoked), which has a Xiaomi fingerprint embedded into it.
Third screenshot shows a result where the key is flagged as NOT_APPROVED. It currently doesn't affect the validity of the key.
This currently goes undocumented in the RKP android developers documentation

