add new deflate dictionary

GrapheneOS · Jun 28, 2023 · 9a6ca45 · 9a6ca45
1 parent 7f71bab
commit 9a6ca45
Show file tree

Hide file tree

Showing 15 changed files with 3 additions and 3 deletions.
diff --git a/app/src/main/java/app/attestation/auditor/AttestationProtocol.java b/app/src/main/java/app/attestation/auditor/AttestationProtocol.java
@@ -193,7 +193,7 @@ class AttestationProtocol {
     // the outer signature and the rest of the chain for pinning the expected chain. It enforces
     // downgrade protection for the OS version/patch (bootloader/TEE enforced) and app version (OS
     // enforced) by keeping them updated.
-    private static final byte PROTOCOL_VERSION = 4;
+    private static final byte PROTOCOL_VERSION = 5;
     private static final byte PROTOCOL_VERSION_MINIMUM = 4;
     // can become longer in the future, but this is the minimum length
     static final byte CHALLENGE_MESSAGE_LENGTH = 1 + CHALLENGE_LENGTH * 2;
@@ -1287,7 +1287,7 @@ static VerificationResult verifySerialized(final Context context, final byte[] a
         deserializer.get(compressedChain);
 
         final Certificate[] certificates;
-        final int dictionary = R.raw.deflate_dictionary_3;
+        final int dictionary = version < 5 ? R.raw.deflate_dictionary_3 : R.raw.deflate_dictionary_4;
         certificates = decodeChain(readRawResource(context, dictionary), compressedChain);
 
         final byte[] fingerprint = new byte[FINGERPRINT_LENGTH];
@@ -1555,7 +1555,7 @@ static AttestationResult generateSerialized(final Context context, final byte[]
             serializer.put(version);
 
             final byte[] compressed;
-            final int dictionary = R.raw.deflate_dictionary_3;
+            final int dictionary = version < 5 ? R.raw.deflate_dictionary_3 : R.raw.deflate_dictionary_4;
             compressed = encodeChain(readRawResource(context, dictionary), attestationCertificates);
 
             if (compressed.length > Short.MAX_VALUE) {

diff --git a/app/src/main/res/raw/deflate_dictionary_4.bin b/app/src/main/res/raw/deflate_dictionary_4.bin
diff --git a/samples/4/0_cert-0.der.x509 b/samples/4/0_cert-0.der.x509
diff --git a/samples/4/0_cert-1.der.x509 b/samples/4/0_cert-1.der.x509
diff --git a/samples/4/0_cert-2.der.x509 b/samples/4/0_cert-2.der.x509
diff --git a/samples/4/0_cert-3.der.x509 b/samples/4/0_cert-3.der.x509
diff --git a/samples/4/1_cert-0.der.x509 b/samples/4/1_cert-0.der.x509
diff --git a/samples/4/1_cert-1.der.x509 b/samples/4/1_cert-1.der.x509
diff --git a/samples/4/1_cert-2.der.x509 b/samples/4/1_cert-2.der.x509
diff --git a/samples/4/1_cert-3.der.x509 b/samples/4/1_cert-3.der.x509
diff --git a/samples/4/1_cert-4.der.x509 b/samples/4/1_cert-4.der.x509
diff --git a/samples/4/2_google_root_0.der.x509 b/samples/4/2_google_root_0.der.x509
diff --git a/samples/4/2_google_root_1.der.x509 b/samples/4/2_google_root_1.der.x509
diff --git a/samples/4/2_google_root_2.der.x509 b/samples/4/2_google_root_2.der.x509
diff --git a/samples/4/2_google_root_3.der.x509 b/samples/4/2_google_root_3.der.x509