iOS / Android / Backend
Device trust & replay lab
Change challenge age, replay state, signature verification, request binding, and assertion counters to see which server-side checks fail.
Evidence inputs
Simplified server policy decision
Accept evidence
Decision trace
Signature verified server-side: Pass
A server-side verifier accepted the signature (assumed for this model).
Challenge inside the acceptance window: Pass
The sample 90-second challenge TTL has not expired.
Challenge consumed at most once: Pass
The challenge has not been marked consumed in the simulated store.
Evidence bound to this action: Pass
The request context matches the server-issued challenge.
Assertion counter advances: Pass
The modeled assertion counter exceeds the last stored value.
What this model does — and does not do
This is a deterministic teaching model with synthetic inputs. No real credentials, traffic, signing keys, attestation services, authentication endpoints, or customer data are processed. A production system needs actual cryptographic checks, authoritative persistence, concurrency control, and integration tests.
Inspect the actual lab model
Download the deterministic TypeScript model and its automated regression tests as a self-contained source bundle. It contains no production app code, real secrets, or platform attestation implementation.
Download reference source + tests