googlesamples / android-play-safetynet

Samples for the Google SafetyNet Attestation API
Apache License 2.0
285 stars 133 forks source link

Unknown bytes in base64 encoded nonce #17

Open xelhark opened 5 years ago

xelhark commented 5 years ago

I'm testing the Safety Net APIs, and I found out that the base64 encoded nonce in the response also contains several bytes preceding the actual nonce.

What are these?

Here's an example:

I send foobar as nonce, and in the response, once I base 64 decode the nonce value, I find these bytes:

D\xcak\x9bT\xf0\xda\xa1_\xaf-\xc2{\x03)p,\x96\xfaC_?\xc5\xc7foobar

The nonce is there at the end, but what's the rest?