Auditor 20 not working on Pixel 3a (RP1A.200720.009.2020.09.29.20)

I am running Graphene OS build number RP1A.200720.009.2020.09.29.20. I upgraded it from RP1A.200720.009.2020.09.18.13

Both local and remote scheduled verification do not seem to work.

• Scheduled remote verification does not work. When I scan the QR code on attestation.app my phone says:

Failed to submit remote attestation

• Local verification does not work. My phone says:

Error encountered generating attestation: Failed to verify certificate Certificate

Data:

Version: 3 (0x2)

Serial Number 1(0x1)

Signature Algorithm: ecdsa-with-SHA256

Issuer: serialNumber=90e8da3cadfc7820/

title=StrongBox

Validity

Not Before: Dec 29 15:31:03 2021 GMT

Not After: May 23 23:59:59 2029 GMT

Subject: CN=Android Keystore Key

Actually the error message is longer than this (I copied it by hand, and I do not know how to copy and past it from the phone, sorry).

I am using Auditor 20 either on Pixel 3a and on the device performing verification. Before testing the new Auditor version I have:

• Cleared Auditor pairings.
• Cleared Auditee pairings.
• Disabled remote verification.
• Cleared Auditor’s cache and data on both pones.
• Reboot both the devices.

None of these was helpful.

[thestinger]

https://github.com/GrapheneOS/Auditor/commit/47c7c7257287c5f649aec47d0563fa0de4900f56 works around this.

[thestinger]

So, this isn’t a bug in Auditor. It can potentially be worked around here, but this is Auditor working as designed. It’s a bug in either the OS (in how it syncs time to secure elements) or in the secure element firmware.