Assistance with iOS DCAppAttestService.SharedService.GenerateAssertionAsync

[Mike-E-angelo]

Hi all,

I am implementing iOS Attestation + Assertion functionality in our Maui application. I got attestations working, but parsing the result returned from DCAppAttestService.SharedService.GenerateAssertionAsync seem to not work as expected. There are very few examples of this in the wild, and zero that I have found for .NET. As reference, I have been using Grok, which has been surprisingly helpful, but the parsing of the payload fails when I load it into a Org.BouncyCastle.Cms.CmsSignedData.

So basically:

var token = await DCAppAttestService.SharedService.GenerateAssertionAsync(keyId, hash);
var signed = new Org.BouncyCastle.Cms.CmsSignedData(token); // Throws IOException

I am hoping someone here can perhaps point me to a good resource to get this working and/or can tell me what I am doing wrong with the above. I'm mostly following Grok's lead so if something is terribly out of place we can blame it. 😁

Thank you for any assistance.

[ghost]

Could it be that token is not the parameter type CmsSignedData expects? CoPilot AI pointed me to this direction.

[rolfbjarne]

Unfortunately I have no idea how to use this API; all I can offer is Apple's documentation (https://developer.apple.com/documentation/devicecheck/establishing-your-app-s-integrity?language=objc), which I assume you've already read?

[Mike-E-angelo]

Thank you for the check-in and confirmation @rolfbjarne, it is appreciated. I have indeed seen that page, and outside of being non-C# (more difficult to follow for me 😇), it doesn't really say how to handle the data in the callback. This is where AI is hallucinating, as it seems to suggest CmsSignedData (but this is not mentioned anywhere in the documentation).

[rolfbjarne]

I found this: https://dev.to/mnelsonwhite/implementing-apples-device-check-app-attest-protocol-4p2g (search for "Validating Attestation Statement"), which seems to be what you're looking for.

[Mike-E-angelo]

Ah, that's the attestation object, which indeed works and we have working here on our side (using that article, in fact). Here we're looking for the assertion object which occurs after. I know, it's confusing, and it's made me double-check many times! 😅

[rolfbjarne]

Oh ops, sorry about that... Apple didn't make this easy 😐

I'm sorry I couldn't help more, but it certainly sounds blog-worthy if you're ever able to make it work!

[Mike-E-angelo]

I am very happy to say that 6 months later, Grok was able to provide some quality guidance in this area. We now have basic attestations + assertions working in our application, and if you are interested, you can follow the rabbit hole here:
https://github.com/DragonSpark/Framework/blob/2521290d6e6f4ad770f5c8781de53c4758b2ebad/DragonSpark.Server.Mobile/Platforms/iOS/Attestation/Records/ExistingAttestation.cs