Device Attestation:
Securing Mobile Apps 🛡️

Picture this: You're running an online ticket platform for concerts. Someone tries to buy tickets, but how do you know it's not a bot trying to scalp thousands of tickets in seconds? 🤔

Device attestation is like asking for a "birth certificate" from the device itself. It's a cryptographic process where your app asks the device's operating system: "Hey OS, can you prove this is a genuine iPhone/Android running my real app, not some hacked emulator?"

Without device attestation, attackers can exploit your mobile app in countless ways. Here's where it gets scary! 😱

Common Attacks Device Attestation Prevents:

Here's the magic behind the scenes. Both iOS and Android use similar approaches with different names:

• iOS: App Attest (iOS 14+) and DeviceCheck
• Android: Play Integrity API (replaces SafetyNet)

The High-Level Flow:

Sounds complex? Let's see it in code! Here's where it gets interesting! 🎯

iOS provides the DCAppAttestService API. Let's implement it step by step.

Step 1: Check if Device Supports App Attest

import DeviceCheck

func isAppAttestSupported() -> Bool {
    if #available(iOS 14.0, *) {
        return DCAppAttestService.shared.isSupported
    }
    return false
}

Step 2: Generate an Attestation Key

func generateKey(completion: @escaping (String?, Error?) -> Void) {
    guard #available(iOS 14.0, *) else {
        completion(nil, NSError(domain: "Unsupported", code: 0))
        return
    }

    DCAppAttestService.shared.generateKey { keyId, error in
        if let error = error {
            completion(nil, error)
            return
        }

        // 🔑 Store this keyId securely (UserDefaults or Keychain)
        UserDefaults.standard.set(keyId, forKey: "AppAttestKeyID")
        completion(keyId, nil)
    }
}

Step 3: Attest the Key with Your Server

func attestKey(keyId: String, challenge: Data, completion: @escaping (Data?, Error?) -> Void) {
    guard #available(iOS 14.0, *) else { return }

    DCAppAttestService.shared.attestKey(keyId, clientDataHash: challenge) { attestation, error in
        if let error = error {
            print("❌ Attestation failed: \(error)")
            completion(nil, error)
            return
        }

        // ✅ Send this attestation object to your server
        completion(attestation, nil)
    }
}

Step 4: Generate Assertions for API Requests

After the initial attestation, use assertions for subsequent API calls (cheaper than full attestation):

func generateAssertion(keyId: String, requestData: Data, completion: @escaping (Data?) -> Void) {
    guard #available(iOS 14.0, *) else { return }

    // Hash the request data (e.g., JSON payload)
    let hash = SHA256.hash(data: requestData)
    let clientDataHash = Data(hash)

    DCAppAttestService.shared.generateAssertion(keyId, clientDataHash: clientDataHash) { assertion, error in
        if let error = error {
            print("❌ Assertion failed: \(error)")
            completion(nil)
            return
        }

        // ✅ Attach this assertion to your API request header
        completion(assertion)
    }
}

Android uses the Play Integrity API (successor to SafetyNet). Let's implement it!

Step 1: Add Dependencies

dependencies {
    implementation 'com.google.android.play:integrity:1.3.0'
}

Step 2: Initialize Integrity Manager

import com.google.android.play.core.integrity.IntegrityManager
import com.google.android.play.core.integrity.IntegrityManagerFactory

class DeviceAttestationHelper(context: Context) {
    private val integrityManager: IntegrityManager =
        IntegrityManagerFactory.create(context)
}

Step 3: Request Integrity Token

fun requestIntegrityToken(
    nonce: String, // Challenge from your server
    cloudProjectNumber: Long, // Your Google Cloud project number
    callback: (String?) -> Unit
) {
    // Build the integrity token request
    val tokenRequest = IntegrityTokenRequest.builder()
        .setNonce(nonce)
        .setCloudProjectNumber(cloudProjectNumber)
        .build()

    integrityManager
        .requestIntegrityToken(tokenRequest)
        .addOnSuccessListener { response ->
            val token = response.token()
            println("✅ Got integrity token: $token")
            callback(token)
        }
        .addOnFailureListener { exception ->
            println("❌ Integrity request failed: $exception")
            callback(null)
        }
}

Step 4: Send Token to Your Server

fun makeSecureApiCall(integrityToken: String) {
    val request = Request.Builder()
        .url("https://yourapi.com/secure-endpoint")
        .addHeader("X-Integrity-Token", integrityToken)
        .post(requestBody)
        .build()

    // Your server will validate this token!
    client.newCall(request).enqueue(...)
}

Now let's bridge this native code to React Native! We'll create a unified JavaScript API. 🚀

Create a Native Module

import { NativeModules, Platform } from 'react-native';

const { RNDeviceAttestation } = NativeModules;

class DeviceAttestation {
  // Generate and attest a key (iOS) or request token (Android)
  static async attest(challenge) {
    try {
      if (Platform.OS === 'ios') {
        // iOS: Generate key, then attest it
        const keyId = await RNDeviceAttestation.generateKey();
        const attestation = await RNDeviceAttestation.attestKey(keyId, challenge);
        return { keyId, attestation };
      } else {
        // Android: Request integrity token
        const token = await RNDeviceAttestation.requestIntegrityToken(challenge);
        return { token };
      }
    } catch (error) {
      console.error('❌ Attestation failed:', error);
      throw error;
    }
  }

  // Generate assertion for API calls (iOS only)
  static async generateAssertion(keyId, requestData) {
    if (Platform.OS !== 'ios') {
      throw new Error('Assertions only available on iOS');
    }
    return RNDeviceAttestation.generateAssertion(keyId, requestData);
  }

  // Check if attestation is supported
  static async isSupported() {
    return RNDeviceAttestation.isSupported();
  }
}

export default DeviceAttestation;

Using It in Your App

import DeviceAttestation from './DeviceAttestation';

async function handleLogin(username, password) {
  try {
    // 1. Get challenge from your server
    const challengeResponse = await fetch('https://api.example.com/auth/challenge');
    const { challenge } = await challengeResponse.json();

    // 2. Perform device attestation
    const attestationData = await DeviceAttestation.attest(challenge);

    // 3. Send login + attestation to server
    const loginResponse = await fetch('https://api.example.com/auth/login', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        username,
        password,
        attestation: attestationData, // 🔐 Server validates this!
      }),
    });

    if (loginResponse.ok) {
      console.log('✅ Login successful with verified device!');
    } else {
      console.error('❌ Login failed or device unverified');
    }
  } catch (error) {
    console.error('Error during attestation:', error);
  }
}

The real magic happens on your server. Let's validate the attestation! 🪄

iOS App Attest Validation

const crypto = require('crypto');
const cbor = require('cbor'); // For decoding attestation

async function validateIOSAttestation(attestationBase64, keyId, challenge) {
  try {
    // 1. Decode the attestation object
    const attestation = Buffer.from(attestationBase64, 'base64');
    const decoded = cbor.decodeFirstSync(attestation);

    // 2. Verify the signature chain (uses Apple's root certificate)
    const cert = decoded.attStmt.x5c[0];
    const isValidCert = await verifyAppleCertificate(cert);
    if (!isValidCert) {
      return { valid: false, reason: 'Invalid certificate' };
    }

    // 3. Verify the challenge matches
    const authData = decoded.authData;
    const clientDataHash = crypto.createHash('sha256').update(challenge).digest();
    const isValidChallenge = clientDataHash.equals(decoded.clientDataHash);

    if (!isValidChallenge) {
      return { valid: false, reason: 'Challenge mismatch' };
    }

    // 4. Extract and store the public key for future assertions
    const publicKey = decoded.attStmt.x5c[0]; // Simplified
    await storePublicKey(keyId, publicKey);

    return { valid: true, publicKey };
  } catch (error) {
    console.error('Validation error:', error);
    return { valid: false, reason: error.message };
  }
}

Android Play Integrity Validation

const axios = require('axios');

async function validateAndroidIntegrity(token) {
  try {
    // Call Google's Play Integrity API to decode the token
    const response = await axios.post(
      `https://playintegrity.googleapis.com/v1/your-package-name:decodeIntegrityToken`,
      { integrityToken: token },
      {
        headers: {
          'Authorization': `Bearer ${YOUR_GOOGLE_CLOUD_API_KEY}`,
        },
      }
    );

    const verdict = response.data.tokenPayloadExternal;

    // Check device integrity
    const deviceIntegrity = verdict.deviceIntegrity.deviceRecognitionVerdict;
    if (!deviceIntegrity.includes('MEETS_DEVICE_INTEGRITY')) {
      return { valid: false, reason: 'Device compromised' };
    }

    // Check app integrity (not sideloaded or tampered)
    const appIntegrity = verdict.appIntegrity.appRecognitionVerdict;
    if (appIntegrity !== 'PLAY_RECOGNIZED') {
      return { valid: false, reason: 'App not from Play Store' };
    }

    // ✅ All checks passed!
    return { valid: true, verdict };
  } catch (error) {
    console.error('Android validation error:', error);
    return { valid: false, reason: error.message };
  }
}

You've learned how to implement device attestation! Now let's make sure you use it effectively. 💪

🎯 Key Takeaways

📚 Resources & Next Steps

• Apple: Validating Apps That Connect to Your Server
• Google: Play Integrity API Overview
• Duo Labs: App Attest Server Library
• OWASP Mobile Top 10

Found this helpful? Share it! 🚀