How to use Apple App Attest in your Unity game

What is App Attest?

How App Attest works

How to set up App Attest

1. In your Apple Developer account, open your App ID under Certificates, Identifiers & Profiles and enable the App Attest capability.
2. Add the entitlement com.apple.developer.devicecheck.appattest-environment to the app. During development Apple uses a sandbox environment. Builds from TestFlight and the App Store always use production.
3. Link DeviceCheck.framework to the Xcode project.

#if UNITY_IOS
using UnityEditor;
using UnityEditor.Callbacks;
using UnityEditor.iOS.Xcode;

public static class AppAttestPostProcess
{
    [PostProcessBuild]
    public static void OnPostProcess(BuildTarget target, string path)
    {
        if (target != BuildTarget.iOS) return;

        string projPath = PBXProject.GetPBXProjectPath(path);
        var proj = new PBXProject();
        proj.ReadFromFile(projPath);
        string mainTarget = proj.GetUnityMainTargetGuid();
        proj.AddFrameworkToProject(proj.GetUnityFrameworkTargetGuid(), "DeviceCheck.framework", false);

        var ent = new PlistDocument();
        ent.root.SetString("com.apple.developer.devicecheck.appattest-environment",
            EditorUserBuildSettings.development ? "development" : "production");
        ent.WriteToFile(path + "/game.entitlements");

        proj.AddFile("game.entitlements", "game.entitlements");
        proj.SetBuildProperty(mainTarget, "CODE_SIGN_ENTITLEMENTS", "game.entitlements");
        proj.WriteToFile(projPath);
    }
}
#endif

How to use App Attest in Unity

#import <DeviceCheck/DeviceCheck.h>

static void Send(const char* method, NSString* msg) {
    UnitySendMessage("AppAttest", method, msg.UTF8String);
}

extern "C" bool AppAttest_IsSupported() {
    return DCAppAttestService.sharedService.isSupported;
}

extern "C" void AppAttest_Attest(const char* challengeHashB64) {
    NSData* hash = [[NSData alloc] initWithBase64EncodedString:@(challengeHashB64) options:0];
    DCAppAttestService* service = DCAppAttestService.sharedService;
    [service generateKeyWithCompletionHandler:^(NSString* keyId, NSError* error) {
        if (error) { Send("OnError", error.localizedDescription); return; }
        [service attestKey:keyId clientDataHash:hash completionHandler:^(NSData* att, NSError* err) {
            if (err) { Send("OnError", err.localizedDescription); return; }
            Send("OnAttested", [NSString stringWithFormat:@"%@|%@",
                keyId, [att base64EncodedStringWithOptions:0]]);
        }];
    }];
}

using System;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using UnityEngine;

public class AppAttest : MonoBehaviour
{
#if UNITY_IOS && !UNITY_EDITOR
    [DllImport("__Internal")] private static extern bool AppAttest_IsSupported();
    [DllImport("__Internal")] private static extern void AppAttest_Attest(string challengeHashB64);
#else
    private static bool AppAttest_IsSupported() => false;
    private static void AppAttest_Attest(string _) { }
#endif

    public void Attest(byte[] serverChallenge)
    {
        if (!AppAttest_IsSupported()) return; // Simulator or old device. Tell the server.
        using var sha = SHA256.Create();
        AppAttest_Attest(Convert.ToBase64String(sha.ComputeHash(serverChallenge)));
    }

    private void OnAttested(string msg)
    {
        string[] parts = msg.Split('|');
        PlayerPrefs.SetString("AppAttestKeyId", parts[0]); // The ID is not secret.
        // Send parts[0] (keyId) and parts[1] (attestation) to your server.
    }

    private void OnError(string error) => Debug.LogWarning("App Attest: " + error);
}

How to verify on your server

• checks the certificate chain against Apple's App Attest root certificate
• checks that the nonce matches your challenge, so the attestation is fresh
• checks that the App ID hash matches your Team ID and bundle ID
• checks that the counter is 0 and the key ID matches the public key
• stores the public key, and later verifies every assertion signature and a rising counter

Why App Attest helps your game

Takeaway: Sign the requests that give something away first: rewards, scores, and purchases. Start with soft consequences, like no ranked play, before you block anyone.

Conclusion