Welcome to the Unified Attestation project wiki. This wiki documents the full architecture, implementation details, workflows, and operational guidance for the system.

• Architecture
• Protocol
• Backend
• Public Device Registry
• Frontend Portal
• OEM Trust Anchors & Keybox
• Attestation Validation
• Federation
• Android System Service
• Android SDK
• Example App
• Example App Server
• Server SDKs
• Client-Side Verification
• API Reference
• Database
• Setup & Running
• Installation Guide
• Environment Variables
• config.yaml
• Root Cert Generation
• Security Notes
• Troubleshooting

• Single Backend acts as both Home Backend (X) and Device Backend (Y).
• No DeviceID, no RequestID in the protocol.
• Provider discovery A2: SDK returns backendIds only.
• requestHash = SHA-256(UTF8(canonicalRequestString)).
• Token is signed by backend; apps never see device PoP.
• scopedDeviceId = SHA-256(backendId || projectId || spkiDER) for logs only.
• Federation verifies tokens offline using stored public keys.