From 08b49e7c034341901ab289be422806bb8f82c67e Mon Sep 17 00:00:00 2001 From: Brian Lee Date: Wed, 30 Sep 2026 14:33:49 -0400 Subject: [PATCH] Fall back to JWT proof when Android KeyStore attestation fails In OpenId4VCI.createKeyProofs(), generating an AndroidKeyStore key pair with an attestation challenge can throw a ProviderException on devices or emulators without provisioned hardware attestation keys (e.g., KeyStoreException: -10003). Wrap createAndroidAttestationProofJwt() in a try/catch block so that if hardware key attestation fails, execution falls through and uses a software JWT proof (createProofJwt()) when the issuer also supports the "jwt" proof type. --- .../credman/cmwallet/openid4vci/OpenId4VCI.kt | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/app/src/main/java/com/credman/cmwallet/openid4vci/OpenId4VCI.kt b/app/src/main/java/com/credman/cmwallet/openid4vci/OpenId4VCI.kt index 07dd0ba..877a765 100644 --- a/app/src/main/java/com/credman/cmwallet/openid4vci/OpenId4VCI.kt +++ b/app/src/main/java/com/credman/cmwallet/openid4vci/OpenId4VCI.kt @@ -452,13 +452,17 @@ class OpenId4VCI(val credentialOfferJson: String) { suspend fun createKeyProofs(credentialConfigurationId: String): ProofCreationResult { val proofTypesSupported = credentialOffer.issuerMetadata.credentialConfigurationsSupported[credentialConfigurationId]?.proofTypesSupported!! - return if (proofTypesSupported.containsKey("android_keystore_attestation")) { - createAndroidAttestationProofJwt() - } else if (proofTypesSupported.containsKey("jwt")) { - createProofJwt() - } else { - throw UnsupportedOperationException("Can handle proof types $proofTypesSupported") + if (proofTypesSupported.containsKey("android_keystore_attestation")) { + try { + return createAndroidAttestationProofJwt() + } catch (e: Exception) { + Log.w(TAG, "Failed to create Android KeyStore attestation proof", e) + } + } + if (proofTypesSupported.containsKey("jwt")) { + return createProofJwt() } + throw UnsupportedOperationException("Could not create key proof. Cannot handle proof types $proofTypesSupported") } private suspend fun createAndroidAttestationProofJwt(): ProofCreationResult {