Categoría: Security

    print("=== STEP 2: Reading Data from Files ===")
    print("Please save the Key ID in a file named 'key_id.b64'")
    print("and the Attestation Object (Base64) in a file named 'attestation.b64'")
    print("inside this same folder, and press ENTER to continue...")
    input()
    
    try:
        with open("key_id.b64", "r") as f:
            key_id_input = f.read().strip()
            
        with open("attestation.b64", "r") as f:
            attestation_base64_input = f.read().strip().replace("\n", "").replace(" ", "")
            
    except FileNotFoundError as e:
        print(f"❌ One of the required files was not found: {e}")
        return

    try:
        key_id_bytes = base64.b64decode(key_id_input)
        attestation_bytes = base64.b64decode(attestation_base64_input)
    except Exception as e:
        print(f"❌ Error decoding Base64 (check that there are no extra line breaks or spaces): {e}")
        return

    print("\n=== STEP 3: Validating Apple Attestation Object ===")
    
    try:
        attestation_object = loads(attestation_bytes)
    except Exception as e:
        print(f"❌ Error decoding CBOR: {e}")
        return

    fmt = attestation_object.get('fmt')
    if fmt != 'apple-appattest':
        print(f"❌ Invalid attestation format: {fmt}")
        return
    
    auth_data = attestation_object['authData']
    att_stmt = attestation_object['attStmt']
    x5c = att_stmt['x5c']
    
    if not x5c or len(x5c) < 1:
        print("❌ No certificates found in the x5c chain.")
        return

    cred_cert_bytes = x5c[0]
    cred_cert = x509.load_der_x509_certificate(cred_cert_bytes)

    aaguid = auth_data[37:53]
    expected_aaguid = b'appattestdev\x00\x00\x00\x00' if ENVIRONMENT == "development" else b'appattest\x00\x00\x00\x00\x00\x00\x00'
    
    if aaguid != expected_aaguid:
        print(f"⚠️️ Warning: AAGUID does not match the expected environment. Received: {aaguid}")
    else:
        print("✅ AAGUID verified successfully.")

    app_id = f"{TEAM_ID}.{BUNDLE_ID}"
    expected_rp_id_hash = hashlib.sha256(app_id.encode('utf-8')).digest()
    rp_id_hash_from_auth = auth_data[0:32]
    
    if rp_id_hash_from_auth != expected_rp_id_hash:
        print("❌ RP ID Hash does not match your Team ID and Bundle ID.")
        return
    print("✅ RP ID Hash verified successfully.")

    client_data_hash = hashlib.sha256(challenge_bytes).digest()
    nonce = hashlib.sha256(auth_data + client_data_hash).digest()

    nonce_extracted = None
    for extension in cred_cert.extensions:
        if extension.oid.dotted_string == "1.2.840.113635.100.8.2":
            ext_value = extension.value.value
            try:
                idx = ext_value.find(b'\x04\x20')
                if idx != -1:
                    nonce_extracted = ext_value[idx+2 : idx+2+32]
            except Exception:
                pass

    if nonce_extracted == nonce:
        print("✅ Nonce verified successfully (The device signed the current challenge).")
    else:
        print("❌ Nonce does not match! The attestation might be fake or replayed.")
        return

    public_key = cred_cert.public_key()
    pub_key_bytes = public_key.public_bytes(
        encoding=serialization.Encoding.X962,
        format=serialization.PublicFormat.UncompressedPoint
    )
    pub_key_hash = hashlib.sha256(pub_key_bytes).digest()

    if pub_key_hash == key_id_bytes:
        print("✅ Key ID and Public Key linked successfully.")
    else:
        print("❌ Key ID does not match the public key in the certificate.")
        return

    print("\n🎉 ATTESTATION SUCCESSFULLY VALIDATED! The device is genuine and the key