Skip to content

Create new Android BEST practice: device, app attestation with hardware backed keys #3505

Open
#3953
Open
Create new Android BEST practice: device, app attestation with hardware backed keys#3505
#3953
Assignees
Diolor
Labels
AndroidMASVS-RESILIENCEbest practices

Description

@Diolor
Diolor
opened on Nov 1, 2025

The whole device, app integrity attestation with a server challenge with a hardware-backed key generation, is a best practice. The issues should be covered in the respective WEs and TESTS. However, we should combine all those aspects into a best practice.

Topics:

  • Hardware-backed cryptographic keys (most likely asymmetric)
  • App attestation
  • Device attestation
  • Attestation challenge

Activity

  1. Diolor
    added
    MASVS-RESILIENCE
    best practices
    on Nov 1, 2025

  2. cpholguera commented on Nov 2, 2025

    @cpholguera
    cpholguera
    on Nov 2, 2025
    Collaborator

    Perfect, thanks. Please assign it to yourself if you'd like to work on it.

  3. Diolor
    self-assigned this
    on Nov 2, 2025

  4. cpholguera commented on Feb 9, 2026

    @cpholguera
    cpholguera
    on Feb 9, 2026
    Collaborator

    Please consider: https://mas.owasp.org/MASVS/11-MASVS-RESILIENCE/

  5. Diolor
    added a commit that references this issue on Feb 19, 2026

    Add placeholders for key/device attestation knowledge. Those would be…

    79cf119
  6. Diolor
    added
    Android
    on Apr 11, 2026
  7. Diolor
    changed the title [-]Create new BEST practice: device, app attestation with hardware backed keys[/-] [+]Create new Android BEST practice: device, app attestation with hardware backed keys[/+] on Apr 11, 2026
  8. Diolor
    marked this as blocking 2 issues on Apr 11, 2026
  9. cpholguera
    added a commit that references this issue on May 9, 2026

    Port MASTG-TEST-0050: Testing Runtime Integrity Checks (android) (#3692)

    b118a12
  10. Diolor
    added a commit that references this issue on May 14, 2026

    Port MASTG-TEST-0050: Testing Runtime Integrity Checks (android) (OWA…

    6beb004
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

AndroidMASVS-RESILIENCEbest practices

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions