Fixes 6 detection vectors flagged by attestation validator apps.
Attestation Policy Enforcement
Replicate AOSP keystore2's add_required_parameters() validation that our software keygen path was bypassing:
- CREATION_DATETIME — Reject caller-provided input with
INVALID_ARGUMENT (20), matchingsecurity_level.rs:424. Our cert gen still adds its own timestamp, same as real keystore2. - Device ID attestation — Reject ATTESTATION_ID_SERIAL, IMEI, MEID, SECOND_IMEI, and DEVICE_UNIQUE_ATTESTATION with
CANNOT_ATTEST_IDS (-66). No consumer app has READ_PRIVILEGED_PHONE_STATE. - Error reply format — Fixed AIDL ServiceSpecificException parcel write order (was errorCode→message, now message→errorCode).
Certificate Fix
Leaf certificate Subject CN corrected from "Android KeyStore Key" to "Android Keystore Key" (lowercase s), matching AOSP KeyGenParameterSpec.java:282. Both Kotlin and Rust paths.
Binder Timing
Skip interception for system transaction codes (PING, INTERFACE, DUMP) above LAST_CALL_TRANSACTION. Eliminates the JNI round-trip that inflated binder ping ratio to 3.85x (detector threshold: 3.0x).