Cwa-documentation: Alternative software allowed to interface with backend?

Created on 29 May 2020 · 6Comments · Source: corona-warn-app/cwa-documentation

@zoobab if you don't trust your smart phone you are free to build an implementation on the hardware device of your choice (e.g. ESP32). The BLE specs will be released by Google/Apple and also the API to our backend.

_Originally posted by @MalteJ in https://github.com/corona-warn-app/cwa-documentation/issues/5#issuecomment-627844731_

That means an alternative app made for another OS than Android or iOS or even any software is allowed to interface with your backend system!? Are there any special requirements to be allowed to talk to your backend?

app documentation

Source

t3sserakt

👍2 👀1

Most helpful comment

According to #62 and corona-warn-app/cwa-server#82, device attestation will not be used. The back-end should therefore accept any client that abides by the access protocols. Or am I missing anything?

sventuerpe on 29 May 2020

👍5

All 6 comments

Hello @t3sserakt ,

thank you for your input. We will look into that and get back to you soon.

Best,

KevinMuessig on 29 May 2020

According to #62 and corona-warn-app/cwa-server#82, device attestation will not be used. The back-end should therefore accept any client that abides by the access protocols. Or am I missing anything?

sventuerpe on 29 May 2020

👍5

According to #62 and corona-warn-app/cwa-server#82, device attestation will not be used. The back-end should therefore accept any client that abides by the access protocols. Or am I missing anything?

We discussed that before here. There is some limitation of the Google API for creating Tokens. However a ESP Atmel Microcontroller with Bluetooth might be used to fake a cell phone. The ESP has a WiFi interface and one can think about a Android VM that is used to generate the tokens.

I think this can be done very very easy.

egandro on 30 May 2020

If you want to have clients that don't use the GAEN (Google / Apple Exposure Notification) API, they would still need to be compatible on the Bluetooth-End. The Bluetooth spec and the crypto spec are public.
On a first glance, that should be enough for a clean-room implementation.

svnk on 8 Jun 2020

👀1

@svnk Yes, and that's discussed e.g. here: https://github.com/corona-warn-app/cwa-app-android/issues/75

mh- on 8 Jun 2020

👍1

As mentioned https://github.com/corona-warn-app/cwa-documentation/issues/169#issuecomment-636122152 device attestation is not being used, so in principal, clients should be able to interface with the backend. If there are any concrete issues when doing that, please open a dedicated issue in the CWA server repository.