# Device registration

The device registration phase prepares a device for storing an VDC
by registering an identity key in the Issuer's system.

## Request flow

![](https://developers.google.com/static/wallet/identity/provisioning/overview/images/device-registration.png)

## Flow description

| Step | Source | Description |
|---|---|---|
| 1 | Android-powered device | A new VDC request has been created on the user's device. A new identity key must be created by the Issuer. The user's device calls `getDeviceRegistrationNonce` to initiate this process. |
| 2 | Google servers | Google relays the `getDeviceRegistrationNonce` request to the Issuer. |
| 3 | Issuer servers | The Issuer generates a nonce, stores it with the `deviceReferenceId`, and returns the nonce to Google. |
| 4 | Google servers | Google relays the nonce to the user's device. |
| 5 | Android-powered device | The user's device signs the nonce and embeds it in an x509 certificate. This is included in the `registerDevice` call to verify the device. |
| 6 | Google servers | Google relays the [`registerDevice`](https://developers.google.com/wallet/identity/provisioning/api-reference/issuer-hosted/rest/v1/mdl/registerDevice) call to the Issuer. |
| 7 | Issuer servers | The Issuer performs the device integrity checks and stores the identity key associated with the device. |

## How to verify the integrity of a device

Device attestation is a security feature that allows issuers to verify
the integrity of a device before registering it.
This helps to prevent the registration of devices that have
been tampered with or that are running unauthorized software.

To verify the integrity of the device, the issuer should:

1. Validate the certificate chain sent in the [`/registerDevice`](https://developers.google.com/wallet/identity/provisioning/reference/issuer-hosted/rest/v1/mdl/registerDevice) request. The root certificate in the chain must match the [certificate](https://developer.android.com/training/articles/security-key-attestation#root_certificate) provided by Google.
2. Ensure that the root certificate is not part of the [Certificate Revocation List](https://developer.android.com/training/articles/security-key-attestation#certificate_status).
3. Parse the leaf certificate, read the extensions, and verify the following:
   - The `attestationChallenge` value matches the `nonce` sent during the [`/getDeviceRegistrationNonce`](https://developers.google.com/wallet/identity/provisioning/reference/issuer-hosted/rest/v1/mdl/getDeviceRegistrationNonce) operation.
   - `teeEnforced.rootOfTrust` has the following properties:
     - `deviceLocked=TRUE`
     - `verifiedBootState=VERIFIED`
   - Package names in `softwareEnforced.attestationApplicationId` match `com.google.android.gms` or `com.google.android.gsf`.

> [!TIP]
> **Tip:** You can use the [keyattestation](https://github.com/android/keyattestation) library to parse the information in the Device Identity certificate.

## Explanation of the different parts of the device attestation process

- **Certificate chain:** The certificate chain is a series of certificates that authenticate the identity of the device. The root certificate in the chain is the most trusted certificate, and each subsequent certificate in the chain is signed by the certificate above it.
- **Certificate Revocation List:** The Certificate Revocation List (CRL) is a list of certificates that have been revoked for some reason. If the root certificate in the device attestation certificate chain is on the CRL, then the certificate is invalid and the device attestation shouldn't be trusted.
- **Leaf certificate:** The leaf certificate is the certificate that is specific to the device. It contains information about the device, such as its hardware identifiers and its software version.
- **Extensions:** The extensions are additional pieces of information that are included in the certificate. The device attestation certificate contains a number of extensions that are used to verify the integrity of the device. For more information, refer to the certificate extension data [schema](https://developer.android.com/training/articles/security-key-attestation#certificate_schema).