[android-security-discuss] SafetyNet Attestation on emulator (with Play Services installed) results in internal_error

[Øyvind Robertsen]

Hi!

I'm having some trouble getting SafetyNet Attestation to work on the
Android emulator. I have verified that the image I am using is running
Google Play Services and I've updated to the latest GPS version.
My implementation looks something like the following:
private void getAttestation(byte[] nonce, Promise promise) {
Context ctx = getReactApplicationContext();
if
(GoogleApiAvailability.getInstance().isGooglePlayServicesAvailable(ctx)
== ConnectionResult.SUCCESS) {
SafetyNet.getClient(ctx)
.attest(nonce, BuildConfig.SafetynetAttestationApiKey)
.addOnSuccessListener(attestationResponse ->
promise.resolve(attestationResponse.getJwsResult()))
.addOnFailureListener(e -> {
promise.reject(new RuntimeException("Attestation
request failed with error code: "
+
CommonStatusCodes.getStatusCodeString(((ApiException) e).getStatusCode()),
e));
});
} else {
promise.reject(new RuntimeException("Google Play Services not
available or incompatible"));
}
}


My dependencies:
implementation "com.google.android.gms:play-services-base:16.0.1"
implementation "com.google.android.gms:play-services-safetynet:16.0.0"

When testing this on an emulator with Android API level 27 and Google Play
Services 14.3.67 installed, the attesttation call succeeds, but the JWS
payload only contains the following:

{
"apkCertificateDigestSha256": [],
"error": "internal_error"
}


When testing on a physical device, I get a complete attestation payload.
I've tried looking through emulator logs for anything that looks related,
to no avail.
Any help would be greatly appreciated.

Best Regards,
Øyvind Robertsen

['William' via Android Security Discussions]

Thanks for reporting this issue. It should be resolved in a few hours. Note
that because you're running the API on an emulator the result will come
back as ctsProfileMatch: false and basicIntegrity: false.

Thanks,
William

Post by Øyvind Robertsen
Hi!
I'm having some trouble getting SafetyNet Attestation to work on the
Android emulator. I have verified that the image I am using is running
Google Play Services and I've updated to the latest GPS version.
private void getAttestation(byte[] nonce, Promise promise) {
Context ctx = getReactApplicationContext();
if
(GoogleApiAvailability.getInstance().isGooglePlayServicesAvailable(ctx)
== ConnectionResult.SUCCESS) {
SafetyNet.getClient(ctx)
.attest(nonce, BuildConfig.SafetynetAttestationApiKey)
.addOnSuccessListener(attestationResponse ->
promise.resolve(attestationResponse.getJwsResult()))
.addOnFailureListener(e -> {
promise.reject(new RuntimeException("Attestation
request failed with error code: "
+
CommonStatusCodes.getStatusCodeString(((ApiException) e).getStatusCode()),
e));
});
} else {
promise.reject(new RuntimeException("Google Play Services not
available or incompatible"));
}
}
implementation "com.google.android.gms:play-services-base:16.0.1"
implementation "com.google.android.gms:play-services-safetynet:16.0.0"
When testing this on an emulator with Android API level 27 and Google Play
Services 14.3.67 installed, the attesttation call succeeds, but the JWS
{
"apkCertificateDigestSha256": [],
"error": "internal_error"
}
When testing on a physical device, I get a complete attestation payload.
I've tried looking through emulator logs for anything that looks related,
to no avail.
Any help would be greatly appreciated.
Best Regards,
Øyvind Robertsen