End-to-end encryption

  • The Issuer hosts static endpoints for both the Issuer Identity Key and the Issuer Hybrid Encryption Key, with the option for Google to proxy these keys to devices to reduce the load on the issuer's system.

  • The Issuer Identity Key should be rotated annually, with both the old and new keys hosted during the transition, and the Issuer Hybrid Encryption Key should be rotated every three months, with a support for both old and new keys during the transition period for decryption.

  • Additional Associated Data (AAD) for mDL E2EE uses specific context values, such as "FrontOfLicense" for frontOfLicenseImage and "Barcode" for barcode, and also HPKE encryption parameters are set to KEM as DHKEM(P-256, HKDF-SHA256), KDF as HKDF-SHA256, and AEAD as AES-256-GCM.

  • End-to-end encryption (E2EE) flows are detailed for mDLs provisioned using Google's Digital Identity Provisioning API, and includes examples of encrypted requests between the Client and the Issuer, as well as examples for key derivation and signatures.

  • Test keys are available for implementation, which includes the Issuer Identity (Signature) Key, Issuer Encryption Key, Device Identity (Signature) key, and the Device Encryption key, along with public key certificates for each.

HPKE Overview

Hybrid Public Key Encryption (HPKE) is a cryptographic mechanism used to encrypt a payload to a public key. It is termed "hybrid" because the payload itself is encrypted with a symmetric key, and HPKE derives this symmetric key using a Diffie-Hellman key exchange.

HPKE Modes

  • Base: The most common mode.
  • Auth: Uses the sender’s private key for authentication.
  • PSK: Uses a pre-shared, high-entropy key for authentication.
  • AuthPSK: Combines the sender’s private key and a pre-shared, high-entropy key for authentication.

Base Mode Interaction (Device & Issuing Authority)

Here is a high level flow depicting a scenario where a device wants to send sensitive data to an Issuing Authority.

Step 1: Key Generation and Exchange

  • The Issuing Authority creates an Encryption Key Pair: IE₍ₚₖ, ₛₖ₎ where ₚₖ is the public key and ₛₖ is the private key.
  • The Issuing Authority sends and shares the public key (IEₚₖ) with the Device.

Step 2: Encrypt and Send

The device executes Hybrid-Encrypt(Data, IEₚₖ, Context).

  • The Device generates an Ephemeral Asymmetric key pair for Encryption: ₍Eₚₖ, Eₛₖ₎.
  • It derives a symmetric AES key, known as the shared secret (SS), using the formula: SS = ExtractAndExpand(Diffie-Hellman(IEₚₖ, Eₛₖ), _Context).
  • The device encrypts the data using this shared secret to produce encData.
  • It shares { encData, Eₚₖ } and sends it to the Issuing Authority.

Step 3: Decrypt

The Issuing Authority currently holds IE₍ₚₖ, ₛₖ₎ and the received { encData, Eₚₖ }. It executes Hybrid-Decrypt(encData, Eₚₖ, IEₛₖ, Context).

  • It derives the symmetric AES key (shared secret, SS) using the formula: SS = ExtractAndExpand(Diffie-Hellman(IEₛₖ, Eₚₖ), _Context).
  • It decrypts the encData using SS.

Terminology

Term Definition & Details
DIₚₖ Credential Key Certificate Chain (Device Identity Certs): An X.509 certificate chain for the CredentialKey that identifies the credential to the issuing authority.
  • Contains an Android Keystore attestation extension describing the key and its security hardware.
  • Used to prove ownership of the credential.
  • The issuer MUST carefully examine this certificate chain (e.g., verifying the root certificate is well-known, Tag::IDENTITY_CREDENTIAL_KEY presence, challenge presence, correct Tag::ATTESTATION_APPLICATION_ID, verified boot enabled, and signature/revocation status).
Aₚₖ Auth Keys: Dynamic X.509 authentication keys requiring certification, each signed by the CredentialKey.
  • The issuer generates static auth data for each key, sends it to the device, and the device stores it via storeStaticAuthenticationData.
  • This key is a payload that will be encrypted, not used directly for E2EE.
  • Non-optional X.509 fields include: version (INTEGER 2), serialNumber (INTEGER 1), signature (ECDSA), subject (CN set to "Android Identity Credential Authentication Key"), issuer (CN set to "Android Identity Credential Key"), validity (current time to 365 days in future), and subjectPublicKeyInfo (must contain attested public key).
IE₍ₛₖ,ₚₖ₎ Issuer Encryption Key Pair: An asymmetric key generated by the Issuer. The Device uses this key to perform Hybrid Encryption to the Issuer.
II₍ₛₖ,ₚₖ₎ Issuer Identity Key Pair: An asymmetric key generated by the Issuer. The Device uses this key to verify the Issuer's identity.
DE₍ₛₖ,ₚₖ₎ Device Encryption Key Pair: An ephemeral asymmetric key generated by the Device per request. The Issuer uses this key to perform Hybrid Encryption to the Device.
FE₍ₛₖ,ₚₖ₎ Field Encryption Key: An ephemeral asymmetric key generated per field during Hybrid Encryption.

E2EE in Google Digital Credential Provisioning API

Step 1: Get Issuer Identity Key & Encryption Key

  • API Endpoints: /getIdentityKey, /getHybridEncryptionKey.
  • Returns: IIₚₖ, IEₚₖ.

Step 2: Get Device Registration Nonce

  • Generate a Device Reference ID (deviceReferenceId).
  • API Endpoint: Call /getDeviceRegistrationNonce(deviceReferenceId).
  • Returns: nonce.

Step 3: Register Device

  • Setup the Android Identity Credential.
  • Call IC.getCredentialKeyCertificateChain(nonce) which returns a nonce-embedded DIₚₖ.
  • API Endpoint: Call /registerDevice(deviceReferenceId, DIₚₖ).
  • The Issuing Authority must carefully examine this certificate chain to ensure the root certificate is well-known, the challenge is present, the ATTESTATION_APPLICATION_ID matches the expected app, verified boot is enabled, and signatures or revocations are valid.
  • Returns: ack.

Step 4a: Send Proofing Request

  • For each field:
    • Execute Hybrid-Encrypt(Data, IEₚₖ, Context=FieldName) to generate encData and FEₚₖ.
    • Call IC.proveOwnership(SHA-256(Data + IEₚₖ)) to obtain sigData (a COSE_Sign1 data structure signed by CredentialKey, with payload set to ProofofOwnership).
  • API Endpoint: Call /proofUser([encData, sigData, FEₚₖ]).
  • The Issuing Authority verifies sigData using DIₚₖ.
  • The Issuing Authority executes Hybrid-Decrypt(encData, FEₚₖ, IEₛₖ, Context=FieldName) to generate Data.
  • Returns: ack.

Step 4b: Proofing Status Update

  • Notify Google of a Proofing status update using deviceReferenceId and proofingId.
  • API Endpoint: Call /notifyProofingStatusUpdateAvailable(...).
  • Google Servers fetch the proofing status from the issuer by calling /getProofingStatus(deviceReferenceId, proofingId).

Step 5: Provision Credential

  • Call IC.proveOwnership(SHA-256(DEₚₖ)) to get sigDEₚₖ (COSE_Sign1 structure signed by CredentialKey/DIₛₖ with payload ProofofOwnership).
  • API Endpoint: Send deviceReferenceId, proofingId, credentialId, and sigDEₚₖ to the Issuer via /provisionCredential(dRId, pId, cId, DEₚₖ, sigDEₚₖ).
  • Issuer Side:
    • Verify sigDEₚₖ with DIₚₖ.
    • Encrypt the Credential (PersonalizationData + AccessControlProfiles).
    • Execute Hybrid-Encrypt(Cred, DEₚₖ, Context=FieldName) to generate encCred and FEₚₖ.
    • Create sigCred by signing COSE_Sign1 SHA-256(Cred + DEₚₖ) with IIₛₖ.
    • Return encCred, sigCred, FEₚₖ.
  • Device Side:
    • Verify sigCred using IIₚₖ.
    • Execute Hybrid-Decrypt(encCred, FEₚₖ, DEₛₖ, Context=FieldName) to extract Cred.
    • Call WC.personalize(Cred) to get sigCredReceipt (COSE_Sign1 signed by CredentialKey, payload ProofOfProvisioning).
    • Execute Hybrid-Encrypt(sigCredReceipt, DEₛₖ, Context=FieldName) generating encReceipt and FE1ₚₖ.
    • Call IC.proveOwnership(SHA-256(encReceipt + IEₚₖ)) to get sigReceipt (COSE_Sign1 signed by CredentialKey, payload ProofofOwnership).
    • Generate Auth Keys [Aₚₖ].

Step 6: Generate MSO & StaticAuthData

  • Device Side:
    • For each Auth Key: Execute Hybrid-Encrypt(AuthKey, IEₚₖ, Context=FieldName) to generate encAuthKey and FEₚₖ.
    • Call IC.proveOwnership(SHA-256(AuthKey + IEₚₖ)) to get sigAuthKey.
    • API Endpoint: Call /provisionMSOs(.., encReceipt, sigReceipt, [encAuthKey, sigAuthKey, FEₚₖ], DEₚₖ, sigDEₚₖ).
  • Issuer Side:
    • Verify sigReceipt and sigDEₚₖ against DIₚₖ to verify the receipt.
    • For each [encAuthKey, sigAuthKey, FEₚₖ]: Execute Hybrid-Decrypt(encAuthKey, FEₚₖ, IEₛₖ, Context=FieldName) to extract the AuthKey.
    • Generate the MSO (including the AuthKey) and generate staticAuthData (SAD), including the digestIdMapping and issuerAuth.
    • Execute Hybrid-Encrypt(SAD, DEₚₖ, Context=FieldName) to generate encSAD and FEₚₖ.
    • Sign using COSE_Sign1 SHA-256(SAD + DEₚₖ) with IIₛₖ to produce sigSAD.
    • Return [encSAD, sigSAD, FEₚₖ].
  • Device Side (Final):
    • For each encSAD, sigSAD, FEₚₖ returned: Verify sigSAD with IIₚₖ.
    • Execute Hybrid-Decrypt(encSAD, FEₚₖ, DEₛₖ, Context=FieldName) to extract SAD.
    • Call storeStaticAuthenticationData with SAD to finish the process.

Rotation Requirements

The Issuer Identity Key should rotated once every year. During the rotation period, the issuer should host the old and the new key, and the device will trust both of those keys. Once the Issuer has completely swapped over to using the new Issuer Identity Key, the Issuer should stop hosting the old key and the device will no longer trust it.

The Issuer Hybrid Encryption Key should be rotated once every 3 months. During the rotation period, the issuer should begin hosting only the new key, and the device will start encrypting to the new key. The issuer must support decrypting using both the old and new key for a reasonable period of time, to avoid downtime.

AAD Values

Use the following context values for AAD.

Fields Context Values
preAuthorizationCode PreAuthorizationCode

For AAD values of other evidence types, reach out to your Google representative.

Test vectors for Digital Credentials End-to-End Encryption

Test vectors for Digital ID End-to-End Encryption are a set of predefined messages and their encrypted versions that are used to test the correctness of the encryption algorithm.

HPKE encryption parameters:

  KEM = DHKEM(P-256, HKDF-SHA256), id = 0x0010
  KDF = HKDF-SHA256, id = 0x0001
  AEAD = AES-256-GCM, id = 0x0002
  • Additional Associate Data (AAD) is an input to HPKE CtxInfo, AAD for AES (symmetric) encryption is NULL (empty).
  • Binary data in JSON structures are Base64 encoded, intermediate values in this document are Hex encoded.
  • Signature format in this documentation:
    • Device → Issuer, Issuer → Device: COSE_Sign1

Client → Issuer, Issuer → Client

Sample for communication in both directions.

Sample Encrypted Request Field

Plaintext = "Hello, world!", associated-data = "field1"

{
  "field1": {
    "encryptedValue": "yGFWT9MkgV6/IZfYUZjqGEf3k2M/HQhz9XnKWyI\u003d",
    "encapsulatedKey": "BOpBC2LGh1RWk99iIm6ISsaPbtrNnu9hIgHeby5khXY6PG+ZmDOYmorEUne7uzhDmD6JCVYyME1+A8ueJ0CZvAI\u003d",
    "signature": "hEOhASagWE+EcFByb29mT2ZPd25lcnNoaXB4GG9yZy5pc28uMTgwMTMtNS4yMDE5Lm1kbFggTOsHXzsgDgh/2chekltve8rJsFFb6DTtBjY98H58gjb0WEBUnwNT3gvbavE8QoaAKaELqF7JKqh0+ivPisQg6RerTmx8Zsk/tCjW/y1cxhGKatl2EjASemns67r1/lZumEqZ",
    "recipientKeyId": "4D7E5D8B9460810A"
  }
}

Deep-dive: 

>> plaintext = "Hello, world!"
48656C6C6F2C20776F726C6421

>> associated-data = "field1"
6669656C6431

## AES key = 
2831F07355FEAB3A8654EADEEC2E2D497B9FD3C76CB8B5E776DB03583F302332

## AES initialization vector = 
64620929032C85B352156528

## AES associated data (empty) = 

>> encrypted-value = HPKE(plaintext, associated-data)
C861564FD324815EBF2197D85198EA1847F793633F1D0873F579CA5B22

>> encapsulated-key (ephemeral) =
04EA410B62C687545693DF62226E884AC68F6EDACD9EEF612201DE6F2E648576
3A3C6F999833989A8AC45277BBBB3843983E89095632304D7E03CB9E274099BC
02

>> tbs-data = plaintext || issuer-encryption-key
48656C6C6F2C20776F726C6421044F1FC726AFFFC32EAA1275B5B49D67018ADE
7D8599DE53FE049996C0EC45D26EA3375BF467B631CF8AB0F284E4B628E287C8
99107465529DCA93DCF5F7A7EA5F

>> sha-256(tbs-data)
4CEB075F3B200E087FD9C85E925B6F7BCAC9B0515BE834ED06363DF07E7C8236

>> proof-of-ownership (cbor array)
847050726F6F664F664F776E65727368697078186F72672E69736F2E31383031
332D352E323031392E6D646C58204CEB075F3B200E087FD9C85E925B6F7BCAC9
B0515BE834ED06363DF07E7C8236F4

>> signature (cose_sign1)
8443A10126A0584F847050726F6F664F664F776E65727368697078186F72672E
69736F2E31383031332D352E323031392E6D646C58204CEB075F3B200E087FD9
C85E925B6F7BCAC9B0515BE834ED06363DF07E7C8236F45840549F0353DE0BDB
6AF13C42868029A10BA85EC92AA874FA2BCF8AC420E917AB4E6C7C66C93FB428
D6FF2D5CC6118A6AD9761230127A69ECEBBAF5FE566E984A99

Sample Issuer or Device Encryption Key

{
  "deviceEncryptionKey": {
    "publicKey": "BP5vgzZ+UTozzb6cmaZ8tkof2nh2Q2oHVAsggvc8V8SR6C9wWU6W9JEq0AmsGbou3jYw4BLftJP2XQeCB3uD/to\u003d",
    "signature": "hEOhASagWE+EcFByb29mT2ZPd25lcnNoaXB4GG9yZy5pc28uMTgwMTMtNS4yMDE5Lm1kbFgg7641tE2UhuT5Tw9p1u9yEDpyYzDf1Jf9m//mIQfd4Kf0WEBB7PvHbfWozCYlFUqMJ6x+QWzoUU/OT10F1J1zoB8MTELPqfC9acF6IX5oMmsgLn2RtPS7QfylRqEAfG0FyYli",
    "keyIdentifier": "F29BA6298BC93156D2D50EA7E2233FC4"
  }
}

Deep-dive: 

>> ec-point
04FE6F83367E513A33CDBE9C99A67CB64A1FDA7876436A07540B2082F73C57C4
91E82F70594E96F4912AD009AC19BA2EDE3630E012DFB493F65D0782077B83FE
DA

>> sha-256(ec-point)
EFAE35B44D9486E4F94F0F69D6EF72103A726330DFD497FD9BFFE62107DDE0A7

>> proof-of-ownership (cbor array)
847050726F6F664F664F776E65727368697078186F72672E69736F2E31383031
332D352E323031392E6D646C5820EFAE35B44D9486E4F94F0F69D6EF72103A72
6330DFD497FD9BFFE62107DDE0A7F4

>> signature (cose_sign1)
8443A10126A0584F847050726F6F664F664F776E65727368697078186F72672E
69736F2E31383031332D352E323031392E6D646C5820EFAE35B44D9486E4F94F
0F69D6EF72103A726330DFD497FD9BFFE62107DDE0A7F4584041ECFBC76DF5A8
CC2625154A8C27AC7E416CE8514FCE4F5D05D49D73A01F0C4C42CFA9F0BD69C1
7A217E68326B202E7D91B4F4BB41FCA546A1007C6D05C98962

Test Keys and Certificates

You can refer to the following test keys during implementation.

Test Issuer Identity (Signature) Key

  • Private Key 

    -----BEGIN PRIVATE KEY-----
MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCBSDJqogkjkqD7O8mX5
FcUvwOxFp0CxPOGnMD8BfSbcyw==
-----END PRIVATE KEY-----

  • Public Key Certificate 

    -----BEGIN CERTIFICATE-----
MIIBkDCCATegAwIBAgIIIi7oI6UIMEYwCgYIKoZIzj0EAwIwNzE1MDMGA1UEAxMs
Ly9leHBlcmltZW50YWwvdXNlcnMvaWdhcmlldi9jcnlwdG86U2lnbkNlcnQwHhcN
MjIxMjEyMjAyNDA0WhcNMjMxMjEyMjAyNDA0WjBSMQ8wDQYDVQQLEwZXYWxsZXQx
DzANBgNVBAoTBkdvb2dsZTEuMCwGA1UEAxMlVEVTVCBEQVRBIElzc3VlciBJZGVu
dGl0eSAoU2lnbmF0dXJlKTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABHV9uYlT
wGV3UB+SM62fXcW6QzFfSoxq2gU34xG+XVMjxk9JDP9UTE34zX72WIfZ9nqRN9y/
SsbSxw5WrSQdGY2jEjAQMA4GA1UdDwEB/wQEAwIHgDAKBggqhkjOPQQDAgNHADBE
AiBnMgsyJhdfelqpOFvT4H63dWSrNPxyrKEdxTwbYMfCKQIgOh2n2gCETH07tjxR
l9HQfUcb6vqQY4EoPz2O0wNs6yc=
-----END CERTIFICATE-----

Test Issuer Encryption Key

  • Private Key 

    -----BEGIN PRIVATE KEY-----
MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCDZMUnwmygUdKXSujXS
ye7YbVnk1Zy/qwnQtzlZs3pQFQ==
-----END PRIVATE KEY-----

  • Public Key Certificate 

    -----BEGIN CERTIFICATE-----
MIIBpjCCAUygAwIBAgIIIVwLEOrrzm0wCgYIKoZIzj0EAwIwNzE1MDMGA1UEAxMs
Ly9leHBlcmltZW50YWwvdXNlcnMvaWdhcmlldi9jcnlwdG86U2lnbkNlcnQwHhcN
MjIxMjIyMjA1NzIzWhcNMjMxMjIyMjA1NzIzWjBIMQ8wDQYDVQQLEwZXYWxsZXQx
DzANBgNVBAoTBkdvb2dsZTEkMCIGA1UEAxMbVEVTVCBEQVRBIElzc3VlciBFbmNy
eXB0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETx/HJq//wy6qEnW1tJ1n
AYrefYWZ3lP+BJmWwOxF0m6jN1v0Z7Yxz4qw8oTktijih8iZEHRlUp3Kk9z196fq
X6MxMC8wDgYDVR0PAQH/BAQDAgMYMB0GA1UdDgQWBBQKFb7K4eZjtp70DLoCHWe7
v/toXzAKBggqhkjOPQQDAgNIADBFAiEAwN1gOwiSx3999Zxc980eKv3p2H8kA4J6
9aWH6jiVaGMCIA7lLkebHFhD0fItGqXv1f5fwiMBV0605KZFh5+RBj/W
-----END CERTIFICATE-----

Device Identity (Signature) key, a.k.a. Credential Key

  • Public Key Certificate Chain (X.509) 
    MIICujCCAmCgAwIBAgIBATAKBggqhkjOPQQDAjA5MQwwCgYDVQQKEwNURUUxKTAnBgNVBAMTIDFjOTJhYjA1MzI0OWFjNDE0ZWFmMTg5NTY2Njg2NmFmMB4XDTcwMDEwMTAwMDAwMFoXDTQ4MDEwMTAwMDAwMFowHzEdMBsGA1UEAxMUQW5kcm9pZCBLZXlzdG9yZSBLZXkwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARLTpfw/CcG1/+nXnMP9QRBm5JjaNJBhNg77tmzk4F7L7uXnNGWIoToq9KHyX2iUDn6Ubv/mwiMlMSm5nM88RGdo4IBcTCCAW0wDgYDVR0PAQH/BAQDAgeAMIIBWQYKKwYBBAHWeQIBEQSCAUkwggFFAgIAyAoBAQICAMgKAQEEEDYjEBLEZTpwr93t4ptmsuoEADB3v4U9CAIGAYhT/hkxv4VFZwRlMGMxPTAbBBZjb20uZ29vZ2xlLmFuZHJvaWQuZ3NmAgEhMB4EFmNvbS5nb29nbGUuYW5kcm9pZC5nbXMCBA3XF2wxIgQgGXWy8XF3vIml3/MfnmSmyuKBpT3B0dWbHRR/4cgq+gAwgaehCDEGAgECAgEDogMCAQOjBAICAQClCDEGAgEEAgEGqgMCAQG/g3cCBQC/hT4DAgEAv4VATDBKBCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBAAoBAgQghzYolDg9mxJKvBXCPbyAefMb/019dGERKGxClYvGYri/hUEFAgMB+9C/hUIFAgMDFkK/hU4GAgQBNLHNv4VPBgIEATSxzTAKBggqhkjOPQQDAgNIADBFAiEAxDZmUvasdVI9TYmxCH00xlss++qNbxziuwu3GcP+YeQCIGVa5yuWtAc4dOHjUVXHwPJCW7NVQ12z42+PHR4wnne6
MIIBwjCCAWmgAwIBAgIQHJKrBTJJrEFOrxiVZmhmrzAKBggqhkjOPQQDAjApMRMwEQYDVQQKEwpHb29nbGUgTExDMRIwEAYDVQQDEwlEcm9pZCBDQTMwHhcNMjMwNDI2MTgwMTIxWhcNMjMwNTI2MTgwMTIxWjA5MQwwCgYDVQQKEwNURUUxKTAnBgNVBAMTIDFjOTJhYjA1MzI0OWFjNDE0ZWFmMTg5NTY2Njg2NmFmMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEaZUxql/Q7FOtJy8UBFCAdnJ2mVB5RTe0b73Mr24fdqEi/92BDTnEe6cU7OD313G+KiCWrj21KnFLVCXhsKNJiKNjMGEwHQYDVR0OBBYEFNIlTq1EOm+XCcucFptH3inlTMEyMB8GA1UdIwQYMBaAFMNOzZHngCQ1SXStZ0KE/5Jr4WPIMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMAoGCCqGSM49BAMCA0cAMEQCIGnOBO9oVZL51EUXJPk0IU2BT1Za9RbOM585CEm/KEkyAiBGuxsUVp+OaqV0HorqI930jbKqEG6oMpjWWdurmF//JQ==
MIIB2DCCAV2gAwIBAgIUAMpPi14T/VLTtDvuZpzGh7aT4cgwCgYIKoZIzj0EAwMwKTETMBEGA1UEChMKR29vZ2xlIExMQzESMBAGA1UEAxMJRHJvaWQgQ0EyMB4XDTIzMDQyODE1MDIwOVoXDTIzMDYwMjE1MDIwOFowKTETMBEGA1UEChMKR29vZ2xlIExMQzESMBAGA1UEAxMJRHJvaWQgQ0EzMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+rRR6wzN3SA8Ub8lGFGnHjgTV2j6nxB7h+QiVQo2cGc2eJOwTG+VhZiTEtMEbRHwTpa8J8o1HPjiFCpcfe3GB6NjMGEwDgYDVR0PAQH/BAQDAgIEMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFMNOzZHngCQ1SXStZ0KE/5Jr4WPIMB8GA1UdIwQYMBaAFDmYBwY6MxKe9RQGOoBBDHGAzhqtMAoGCCqGSM49BAMDA2kAMGYCMQDt8fk0uaYvpsXXCvppEbjBBGOC5CNL9x515k85nMKhzePXVpWqZSVzxdmLQaATmc4CMQDn/B4Xlzliu1RWrhacos2fZXvMxhhOW1w2waoFnTS8mExHwzKuTbfMVPHYdj3KhtI=
MIIDgDCCAWigAwIBAgIKA4gmZ2BliZaGDzANBgkqhkiG9w0BAQsFADAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MB4XDTIyMDEyNjIyNTAyMFoXDTM3MDEyMjIyNTAyMFowKTETMBEGA1UEChMKR29vZ2xlIExMQzESMBAGA1UEAxMJRHJvaWQgQ0EyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE/t+4AI454D8pM32ZUEpuaS0ewLjFP9EBOnCF4Kkz2jqcDECp0fjy34AaTCgJnpGdCLIU3u/WXBs3pEECgMuS9RVSKqj584wdbpcxiJahZWSzHqPK1Nn5LZYdQIpLJ9cUo2YwZDAdBgNVHQ4EFgQUOZgHBjozEp71FAY6gEEMcYDOGq0wHwYDVR0jBBgwFoAUNmHhAHyIBQlRi0RsR/8aTMnqTxIwEgYDVR0TAQH/BAgwBgEB/wIBAjAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAD0FO58gwWQb6ROp4c7hkOwQiWiCTG2Ud9Nww5cKlsMU8YlZOk8nXn5OwAfuFT01Kgcbau1CNDECX7qA1vJyQ9HBsoqa7fmi0cf1j/RRBvvAuGvg3zRy0+OckwI2832399l/81FMShS+GczTWfhLJY/ObkVBFkanRCpDhE/SxNHL/5nJzYaH8OdjAKufnD9mcFyYvzjixbcPEO5melGwk7KfCx9miSpVuB6mN1NdoCsSi96ZYQGBlZsE8oLdazckCygTvp2s77GtIswywOHf3HEa39OQm8B8g2cHcy4u5kKoFeSPI9zo6jx+WDb1Er8gKZT1u7lrwCW+JUQquYbGHLzSDIsRfGh0sTjoRH/s4pD371OYAkkPMHVguBZE8iv5uv0j4IBwN/eLyoQb1jmBv/dEUU9ceXd/s8b5+8k7PYhYcDMA0oyFQcvrhLoWbqy7BrY25iWEY5xH6EsHFre5vp1su17Rdmxby3nt7mXz1NxBQdA3rM+kcZlfcK9sHTNVTI290Wy9IS+8/xalrtalo4PA6EwofyXy18XI9AddNs754KPf8/yAMbVc/2aClm1RF7/7vB0fx3eQmLE4WS01SsqsWnCsHCSbyjdIaIyKBFQhABtIIxLNYLFw+0nnA7DBU/M1e9gWBLh8dz1xHFo+Tn5edYaY1bYyhlGBKUKG4M8l
MIIFHDCCAwSgAwIBAgIJANUP8luj8tazMA0GCSqGSIb3DQEBCwUAMBsxGTAXBgNVBAUTEGY5MjAwOWU4NTNiNmIwNDUwHhcNMTkxMTIyMjAzNzU4WhcNMzQxMTE4MjAzNzU4WjAbMRkwFwYDVQQFExBmOTIwMDllODUzYjZiMDQ1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xUFmOr75gvMsd/dTEDDJdSSxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5jlRfdnJLmN0pTy/4lj4/7tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y//0rb+T+W8a9nsNL/ggjnar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73XpXyTqRxB/M0n1n/W9nGqC4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYImQQcHtGl/m00QLVWutHQoVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB+TxywElgS70vE0XmLD+OJtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7quvmag8jfPioyKvxnK/EgsTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgpZrt3i5MIlCaY504LzSRiigHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7gLiMm0jhO2B6tUXHI/+MRPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82ixPvZtXQpUpuL12ab+9EaDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+NpUFgNPN9PvQi8WEg5UmAGMCAwEAAaNjMGEwHQYDVR0OBBYEFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMB8GA1UdIwQYMBaAFDZh4QB8iAUJUYtEbEf/GkzJ6k8SMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgIEMA0GCSqGSIb3DQEBCwUAA4ICAQBOMaBc8oumXb2voc7XCWnuXKhBBK3e2KMGz39t7lA3XXRe2ZLLAkLM5y3J7tURkf5a1SutfdOyXAmeE6SRo83Uh6WszodmMkxK5GM4JGrnt4pBisu5igXEydaW7qq2CdC6DOGjG+mEkN8/TA6p3cnoL/sPyz6evdjLlSeJ8rFBH6xWyIZCbrcpYEJzXaUOEaxxXxgYz5/cTiVKN2M1G2okQBUIYSY6bjEL4aUN5cfo7ogP3UvliEo3Eo0YgwuzR2v0KR6C1cZqZJSTnghIC/vAD32KdNQ+c3N+vl2OTsUVMC1GiWkngNx1OO1+kXW+YTnnTUOtOIswUP/Vqd5SYgAImMAfY8U9/iIgkQj6T2W6FsScy94IN9fFhE1UtzmLoBIuUFsVXJMTz+Jucth+IqoWFua9v1R93/k98p41pjtFX+H8DslVgfP097vju4KDlqN64xV1grw3ZLl4CiOe/A91oeLm2UHOq6wn3esB4r2EIQKb6jTVGu5sYCcdWpXr0AUVqcABPdgL+H7qJguBw09ojm6xNIrw2OocrDKsudk/okr/AwqEyPKw9WnMlQgLIKw1rODG2NvU9oR3GVGdMkUBZutL8VuFkERQGt6vQ2OCw0sV47VMkuYbacK/xyZFiRcrPJPb41zgbQj9XAEyLKCHex0SdDrx+tWUDqG8At2JHA==

Refer to Android's Key Attestation documentation for more details.

Device Encryption Key

  • Private Key 

    -----BEGIN PRIVATE KEY-----
MEECAQAwEwYHKoZIzj0CAQYIKoZIzj0DAQcEJzAlAgEBBCBJY8n7A1v+thMM63np
m0wr+rAoMFEYmMZ+mWzBIj2CiQ==
-----END PRIVATE KEY-----

  • Public Key Certificate 

    -----BEGIN CERTIFICATE-----
MIIBhzCCAS2gAwIBAgIIAyJ+NkzueMUwCgYIKoZIzj0EAwIwNzE1MDMGA1UEAxMs
Ly9leHBlcmltZW50YWwvdXNlcnMvaWdhcmlldi9jcnlwdG86U2lnbkNlcnQwHhcN
MjMwMTA5MjMwOTIwWhcNMjQwMTA5MjMwOTIwWjBIMQ8wDQYDVQQLEwZXYWxsZXQx
DzANBgNVBAoTBkdvb2dsZTEkMCIGA1UEAxMbVEVTVCBEQVRBIERldmljZSBFbmNy
eXB0aW9uMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE/m+DNn5ROjPNvpyZpny2
Sh/aeHZDagdUCyCC9zxXxJHoL3BZTpb0kSrQCawZui7eNjDgEt+0k/ZdB4IHe4P+
2qMSMBAwDgYDVR0PAQH/BAQDAgMYMAoGCCqGSM49BAMCA0gAMEUCIQD9syewRhvK
KcyaM7fLwuuCidpiIVd/CZxFCLOo9adCPAIgNd3FMcT710KtYptJBZQ/i7N+C7G5
pLbHmAUoFwNuB2E=
-----END CERTIFICATE-----