Out of interest, if you disable USNF on both devices and reboot, does 'broken TEE' one still give Basic evaluation type in YASNAC? (expected as bad keymaster implementation should cause SafetyNet to fall back to Basic attestation type)... And Basic also on the other one?...
- I'm curious if
both use Basic type w/o USNF as I expect Google will have removed this device from the list of devices (whitelist) that are known by Google to support HKA (Hardware backed cryptographic Key Attestation) after testing failed, but may have restored the listing once a patch/fix became available... This is is a different fall-back* implemented using model prop(s).
Please report if you do this test.
* Nb.
Either of these fall-back types, (1) keymaster failure and (2) no Model prop match, will result in Basic attestation reported in apps like YASNAC, but Hardware attestation may actually still be enforced by its counterpart. Where this is the case, passing CTS Profile match may be impossible even with Basic attestation reported.
- I believe this is a shortcoming of Safety net checking apps. - Really they should only indicate Basic for Evaluation type when both fall-backs are triggered since only then will Basic attestation work and HKA be fully disengaged...
- In any case, USNF overcomes this by
both registering a fake keystore provider that causes Play Services to throw an exception resulting in (1), and appending a space character to model prop value causing a mismatch with whitelist resulting in (2).
PW
PW
PW
... 
PW
PW
