Cloud Secure Area - Server Reference Implementation

Note: This reference implementation is not production quality. Use at your own risk.

Attestation Root

Certificate

SEQUENCE (8 elem)
  [0] (1 elem)
    INTEGER 2
  INTEGER 0c 82 6f a4 74 09 9b 33 b6 a2 c5 c1 0d
  SEQUENCE (1 elem)
    OBJECT IDENTIFIER 1.2.840.10045.4.3.3 ECDSA coupled with SHA-384
  SEQUENCE (2 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String OpenID Key Attestation Root at http://localhost:8051
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
        UTF8String US
  SEQUENCE (2 elem)
    UTCTime 2026-09-11T14:58:54Z
    UTCTime 2027-03-10T14:58:54Z
  SEQUENCE (1 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String OpenID Key Attestation at http://localhost:8051
  SEQUENCE (2 elem)
    SEQUENCE (2 elem)
      OBJECT IDENTIFIER 1.2.840.10045.2.1 Elliptic curve public key cryptography
      OBJECT IDENTIFIER 1.2.840.10045.3.1.7 NIST Curve P-256
    BIT STRING (520 bit) 0000010001010101110001001000011110000011001110100001100101011101000010010000010100011001010001110100010011000011010110001010100011100000001000110010101010011000100010111100111000011001000100010000110110110101011110101100110100011100000011101010100011111010101001111101000110100111111011111001101100001010111011100101110111010111010101011000101111000110010011001001110001001001110110111001111100010000111110111101011011100100111101110111011000001000101000111010000011110000000110000111011110011001010000111101111101110101
  [3] (1 elem)
    SEQUENCE (6 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.35 authorityKeyIdentifier (X.509 extension)
        OCTET STRING (24 byte) 30 16 80 14 cc 7a b9 27 5d e5 f2 0e 63 ba d3 2b f9 d4 52 de e0 6f 2f 99 ("0.�.�z�']��.c��+��R��o/�")
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.15 keyUsage (X.509 extension)
        BOOLEAN true
        OCTET STRING (4 byte) 03 02 02 84 ("...�")
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.19 basicConstraints (X.509 extension)
        BOOLEAN true
        OCTET STRING (8 byte) 30 06 01 01 ff 02 01 00 ("0...�...")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.18 issuerAltName (X.509 extension)
        OCTET STRING (25 byte) 30 17 86 15 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 ("0.�.http://localhost:8051")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.31 cRLDistributionPoints (X.509 extension)
        OCTET STRING (51 byte) 30 31 30 2f a0 2d a0 2b 86 29 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 2f 63 72 6c 2f 6b 65 79 5f 61 74 74 65 73 74 61 74 69 6f 6e ("010/�-�+�)http://localhost:8051/crl/key_attestation")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.14 subjectKeyIdentifier (X.509 extension)
        OCTET STRING (22 byte) 04 14 92 4f ac 4f 64 2f 58 e3 d5 07 35 6a 28 77 35 a5 d9 7b 66 73 ("..�O�Od/X��.5j(w5��{fs")

Certificate

SEQUENCE (8 elem)
  [0] (1 elem)
    INTEGER 2
  INTEGER 11 00 51 8c 10 8a e2 4d 52 05 f8 29 28 c9 96 99
  SEQUENCE (1 elem)
    OBJECT IDENTIFIER 1.2.840.10045.4.3.3 ECDSA coupled with SHA-384
  SEQUENCE (2 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String OpenID Key Attestation Root at http://localhost:8051
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
        UTF8String US
  SEQUENCE (2 elem)
    UTCTime 2026-09-11T14:58:54Z
    UTCTime 2041-09-07T14:58:54Z
  SEQUENCE (2 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String OpenID Key Attestation Root at http://localhost:8051
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
        UTF8String US
  SEQUENCE (2 elem)
    SEQUENCE (2 elem)
      OBJECT IDENTIFIER 1.2.840.10045.2.1 Elliptic curve public key cryptography
      OBJECT IDENTIFIER 1.3.132.0.34 EC Curve P-384
    BIT STRING (776 bit) 00000100110110110001100101010000100110111000001100011100110011001111100011111010011011010011100110001000110011101000111011110010100001111111000001100100111110101110001001101011001110100011010110011001111110110100011101100101100110110001001100111110110110100010010100010001001000010110110011001011001000011000101100000111110101101110110000011000001111000000100110000101010111001101010001110001111010110111000111110110011110010011000001010111011001010000000000001110001011010001001001010101111100010011101011111001110100110000101010110111110011110101000001001010111011010100101010111000101011111110110110101101001110101111101110111100111000001010001000000011100001011000110100100001110100101010000011100101100111110100001000110000011110000011110000110111001001111001010110000100
  [3] (1 elem)
    SEQUENCE (6 elem)
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.15 keyUsage (X.509 extension)
        BOOLEAN true
        OCTET STRING (4 byte) 03 02 01 06 ("....")
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.19 basicConstraints (X.509 extension)
        BOOLEAN true
        OCTET STRING (8 byte) 30 06 01 01 ff 02 01 01 ("0...�...")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.18 issuerAltName (X.509 extension)
        OCTET STRING (25 byte) 30 17 86 15 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 ("0.�.http://localhost:8051")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.31 cRLDistributionPoints (X.509 extension)
        OCTET STRING (51 byte) 30 31 30 2f a0 2d a0 2b 86 29 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 2f 63 72 6c 2f 6b 65 79 5f 61 74 74 65 73 74 61 74 69 6f 6e ("010/�-�+�)http://localhost:8051/crl/key_attestation")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.14 subjectKeyIdentifier (X.509 extension)
        OCTET STRING (22 byte) 04 14 cc 7a b9 27 5d e5 f2 0e 63 ba d3 2b f9 d4 52 de e0 6f 2f 99 ("..�z�']��.c��+��R��o/�")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.35 authorityKeyIdentifier (X.509 extension)
        OCTET STRING (24 byte) 30 16 80 14 cc 7a b9 27 5d e5 f2 0e 63 ba d3 2b f9 d4 52 de e0 6f 2f 99 ("0.�.�z�']��.c��+��R��o/�")

Cloud Binding Key Attestation Root

Certificate

SEQUENCE (8 elem)
  [0] (1 elem)
    INTEGER 2
  INTEGER 0c 19 12 0f 58 66 ca 8c a8 21 d5 b1 17
  SEQUENCE (1 elem)
    OBJECT IDENTIFIER 1.2.840.10045.4.3.3 ECDSA coupled with SHA-384
  SEQUENCE (2 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String CSA Binding Root at http://localhost:8051
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
        UTF8String US
  SEQUENCE (2 elem)
    UTCTime 2026-09-11T14:58:55Z
    UTCTime 2027-03-10T14:58:55Z
  SEQUENCE (1 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String CSA Binding at http://localhost:8051
  SEQUENCE (2 elem)
    SEQUENCE (2 elem)
      OBJECT IDENTIFIER 1.2.840.10045.2.1 Elliptic curve public key cryptography
      OBJECT IDENTIFIER 1.2.840.10045.3.1.7 NIST Curve P-256
    BIT STRING (520 bit) 0000010001010111110011001010010100011111111111010001100100101010000001111110001010011001110110011000000110000001111001110010110101001110111001010100101101000010001100000000001000100100000010001010001011000011000100100010101100010000100010011010101111011101100100101100001011000100001110100100011101011000110101101011100011111010101100000011010001100000101010100100010001000000100111001110110100110011000100010110110001100110100011001010111100010010111000111100101101110110011000100100010010001001100010100010000101101000
  [3] (1 elem)
    SEQUENCE (6 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.35 authorityKeyIdentifier (X.509 extension)
        OCTET STRING (24 byte) 30 16 80 14 79 84 15 1f 2d d3 8f ea cf a7 90 6e d2 4f 53 36 e8 af 1e 1b ("0.�.y�..-ӏ�ϧ�n�OS6�..")
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.15 keyUsage (X.509 extension)
        BOOLEAN true
        OCTET STRING (4 byte) 03 02 02 84 ("...�")
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.19 basicConstraints (X.509 extension)
        BOOLEAN true
        OCTET STRING (8 byte) 30 06 01 01 ff 02 01 00 ("0...�...")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.18 issuerAltName (X.509 extension)
        OCTET STRING (25 byte) 30 17 86 15 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 ("0.�.http://localhost:8051")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.31 cRLDistributionPoints (X.509 extension)
        OCTET STRING (61 byte) 30 3b 30 39 a0 37 a0 35 86 33 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 2f 63 72 6c 2f 63 6c 6f 75 64 5f 73 65 63 75 72 65 5f 61 72 65 61 5f 62 69 6e 64 69 6e 67 ("0;09�7�5�3http://localhost:8051/crl/cloud_secure_area_binding")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.14 subjectKeyIdentifier (X.509 extension)
        OCTET STRING (22 byte) 04 14 50 5f c1 8e 82 8a 36 c8 a5 d1 69 fd f4 87 45 74 47 39 12 2b ("..P_����6ȥ�i��EtG9.+")

Certificate

SEQUENCE (8 elem)
  [0] (1 elem)
    INTEGER 2
  INTEGER 43 d2 f2 b3 6a 1e 52 e3 fe d6 ad c3 73 e7 43 5c
  SEQUENCE (1 elem)
    OBJECT IDENTIFIER 1.2.840.10045.4.3.3 ECDSA coupled with SHA-384
  SEQUENCE (2 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String CSA Binding Root at http://localhost:8051
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
        UTF8String US
  SEQUENCE (2 elem)
    UTCTime 2026-09-11T14:58:55Z
    UTCTime 2041-09-07T14:58:55Z
  SEQUENCE (2 elem)
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.3 commonName (X.520 DN component)
        UTF8String CSA Binding Root at http://localhost:8051
    SET (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.4.6 countryName (X.520 DN component)
        UTF8String US
  SEQUENCE (2 elem)
    SEQUENCE (2 elem)
      OBJECT IDENTIFIER 1.2.840.10045.2.1 Elliptic curve public key cryptography
      OBJECT IDENTIFIER 1.3.132.0.34 EC Curve P-384
    BIT STRING (776 bit) 00000100111011001100111101101100000010010011111101010101101110011110010000101110000100011111010100010111000001101011111001001100101111000000101101010000100101110101011100110100000101111110110101000101111100101110100001111110110111111111101110111100001011110101100000100101111100110000111010000010101100001100101110000010000110000111010101110111001011011010101000000001111011100011111001001110011000010111111110100101001000110111000011011101010000011101011110110011111011000010001000001110100100001001001110000101111011110111000011001101100111110011111111010101110010010001111110101000010110010011010010010100101101110100001010111111100101000011011110011101100111000100000011111011111101101001000001001010111111110011011111011000000101000010011001000001010110011111101001011101
  [3] (1 elem)
    SEQUENCE (6 elem)
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.15 keyUsage (X.509 extension)
        BOOLEAN true
        OCTET STRING (4 byte) 03 02 01 06 ("....")
      SEQUENCE (3 elem)
        OBJECT IDENTIFIER 2.5.29.19 basicConstraints (X.509 extension)
        BOOLEAN true
        OCTET STRING (8 byte) 30 06 01 01 ff 02 01 01 ("0...�...")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.18 issuerAltName (X.509 extension)
        OCTET STRING (25 byte) 30 17 86 15 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 ("0.�.http://localhost:8051")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.31 cRLDistributionPoints (X.509 extension)
        OCTET STRING (61 byte) 30 3b 30 39 a0 37 a0 35 86 33 68 74 74 70 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 3a 38 30 35 31 2f 63 72 6c 2f 63 6c 6f 75 64 5f 73 65 63 75 72 65 5f 61 72 65 61 5f 62 69 6e 64 69 6e 67 ("0;09�7�5�3http://localhost:8051/crl/cloud_secure_area_binding")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.14 subjectKeyIdentifier (X.509 extension)
        OCTET STRING (22 byte) 04 14 79 84 15 1f 2d d3 8f ea cf a7 90 6e d2 4f 53 36 e8 af 1e 1b ("..y�..-ӏ�ϧ�n�OS6�..")
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 2.5.29.35 authorityKeyIdentifier (X.509 extension)
        OCTET STRING (24 byte) 30 16 80 14 79 84 15 1f 2d d3 8f ea cf a7 90 6e d2 4f 53 36 e8 af 1e 1b ("0.�.y�..-ӏ�ϧ�n�OS6�..")