App Attestation Outstanding Tasks

[jleach]

The following are TODO items needed to make app attestation production ready:

• Cache Nonce

The nonce sent by the Controller to Apple should be cached so that it can be looked up and confirmed it was the one sent to a device. It should probably expire, it should not be sent back from the device.

• Complete Apple Verification

To verify an Apple attestation there are 9 steps. Steps 1-5 are complete, while 6-9 are outstanding. These steps need to be completed to finalize the work for iOS.

• Google Play API

The Google Play API should be implemented so that google integrity can be verified. This needs to be implemented in the npm package as well as the controller.

• Convert Controler to Plug-in

The server side controller logic should be converted to an ACA-py plug-in so that it can be better integrated into an agent.

• Protocol via RFC

As per Stephen's comment ACA-py on Discord the protocol used should be formalized in its own RFC and become a separate entity to Basic Message. This would require designing the protocol, writing an RFC, and pushing ahead with the adoption of the the RFC.

• Finalize VC Schema

The draft schema for the PoC has the following attributes:

• Assurance Level
• Issue Date

Which are fictitious and may or may not be in the final schema. For BC, we should come up with a proper schema and implement all the necessities like publishing, documenting it, and providing OCA branding for it. We should also consider what it means to be "Hight Assurance" for example, if an alternative method is used on iOS < 14 do we note it's a "medium" assurance credential.

• Support for < iOS 14.

The current functionality is only supported on iOS 14 and devices with a secure-enclave. We may want to implement app-store receipt checking devices lower than 14.

Technical Debt

• The Apple Attestation is done in Objective-C which is perhaps legacy now. Consider converting it to Swift before the code base gets overly large.

[jleach]

@cvarjao @bryce-mcmath FYI. I think this ticket represents an epic because any one of the the check-items above represent notable effort. I think after doing #1363 we're in a decent crawl state and can now address this as a team.

[cvarjao]

Duplication of epic #895