add new deflate dictionary

GrapheneOS · Jun 28, 2023 · 9a6ca45 · 9a6ca45
1 parent 7f71bab
commit 9a6ca45
Show file tree

Hide file tree

Showing 15 changed files with 3 additions and 3 deletions.
diff --git a/app/src/main/java/app/attestation/auditor/AttestationProtocol.java b/app/src/main/java/app/attestation/auditor/AttestationProtocol.java
@@ -193,7 +193,7 @@ class AttestationProtocol {
  // the outer signature and the rest of the chain for pinning the expected chain. It enforces
  // downgrade protection for the OS version/patch (bootloader/TEE enforced) and app version (OS
  // enforced) by keeping them updated.
- private static final byte PROTOCOL_VERSION = 4;
+ private static final byte PROTOCOL_VERSION = 5;
  private static final byte PROTOCOL_VERSION_MINIMUM = 4;
  // can become longer in the future, but this is the minimum length
  static final byte CHALLENGE_MESSAGE_LENGTH = 1 + CHALLENGE_LENGTH * 2;
@@ -1287,7 +1287,7 @@ static VerificationResult verifySerialized(final Context context, final byte[] a
  deserializer.get(compressedChain);
 
  final Certificate[] certificates;
- final int dictionary = R.raw.deflate_dictionary_3;
+ final int dictionary = version < 5 ? R.raw.deflate_dictionary_3 : R.raw.deflate_dictionary_4;
  certificates = decodeChain(readRawResource(context, dictionary), compressedChain);
 
  final byte[] fingerprint = new byte[FINGERPRINT_LENGTH];
@@ -1555,7 +1555,7 @@ static AttestationResult generateSerialized(final Context context, final byte[]
  serializer.put(version);
 
  final byte[] compressed;
- final int dictionary = R.raw.deflate_dictionary_3;
+ final int dictionary = version < 5 ? R.raw.deflate_dictionary_3 : R.raw.deflate_dictionary_4;
  compressed = encodeChain(readRawResource(context, dictionary), attestationCertificates);
 
  if (compressed.length > Short.MAX_VALUE) {

diff --git a/app/src/main/res/raw/deflate_dictionary_4.bin b/app/src/main/res/raw/deflate_dictionary_4.bin
diff --git a/samples/4/0_cert-0.der.x509 b/samples/4/0_cert-0.der.x509
diff --git a/samples/4/0_cert-1.der.x509 b/samples/4/0_cert-1.der.x509
diff --git a/samples/4/0_cert-2.der.x509 b/samples/4/0_cert-2.der.x509
diff --git a/samples/4/0_cert-3.der.x509 b/samples/4/0_cert-3.der.x509
diff --git a/samples/4/1_cert-0.der.x509 b/samples/4/1_cert-0.der.x509
diff --git a/samples/4/1_cert-1.der.x509 b/samples/4/1_cert-1.der.x509
diff --git a/samples/4/1_cert-2.der.x509 b/samples/4/1_cert-2.der.x509
diff --git a/samples/4/1_cert-3.der.x509 b/samples/4/1_cert-3.der.x509
diff --git a/samples/4/1_cert-4.der.x509 b/samples/4/1_cert-4.der.x509
diff --git a/samples/4/2_google_root_0.der.x509 b/samples/4/2_google_root_0.der.x509
diff --git a/samples/4/2_google_root_1.der.x509 b/samples/4/2_google_root_1.der.x509
diff --git a/samples/4/2_google_root_2.der.x509 b/samples/4/2_google_root_2.der.x509
diff --git a/samples/4/2_google_root_3.der.x509 b/samples/4/2_google_root_3.der.x509