Manage keyboxes
Keybox Manager loads, verifies, selects, and monitors authorized attestation key material.
Where to find it: Keyboxes. Where is each feature?
What to do
- Upload an authorized XML or CBOX.
- Check Verification, then review Stored Keyboxes and the priority order.
- Disable a file to remove it from selection without deleting it.
Details and limits
It supports one legacy keybox file, multiple XML files, and encrypted CBOX containers.
Loading and selection
Files in the protected keybox directory are discovered as a bounded set. Application rules can select a specific file. If no application specific file is selected, the active verified pool is used according to the request algorithm.
Files obtained from an explicitly configured secure source are treated as untrusted input until the same verification process completes. Server metadata, refresh intervals, and authentication settings are validated before use.
Pool control
Every stored keybox can be disabled from the WebUI without deleting it. A disabled keybox stays in the list with a Disable badge, leaves the active pool immediately, and is skipped by selection. Deleting the file clears its stored state.
The opt-out list lives in a plain-text disabled_keyboxes file inside the configuration directory, one scope:filename identifier per line (keyboxes:keybox2.xml, root:keybox.xml). Because the state is a file, it survives module updates and can be maintained by hand or through Magisk tooling. Removing the file re-enables every keybox.
Naming on upload
Pasted or dropped keyboxes are stored under the supplied filename, or as keybox.xml when no filename is supplied. When that name already exists, the manager automatically picks the next free name (keybox2.xml, keybox3.xml, and so on), so an existing keybox is never silently replaced.
The assigned name is returned to the WebUI, and RKP provenance is bound to the final stored name.
Verification
The verifier confirms that every private key matches its leaf certificate. It checks supported algorithms, certificate chain relationships, certificate dates, duplicate or ambiguous material, and revocation information.
Valid key material is activated immediately upon boot without waiting for network connectivity. When Automatic Keybox Check is enabled, revocation verification is performed asynchronously once online, and revoked keys are deactivated. When Automatic Keybox Check is disabled, custom or revoked key material is admitted without revocation enforcement.
A pool containing a malformed entry is rejected as a whole so request behavior does not depend on file ordering.
Automatic checks
Automatic Keybox Check runs independently of Spoof Engine as part of core Keystore protection. The worker uses a bounded schedule and stops when the service shuts down. File observers and a low frequency fallback poll detect updates without continuous directory scanning.
Operational guidance
Prefer encrypted CBOX files for storage and transfer. Plain XML contains private key material even when filesystem permissions limit access. Never commit a real keybox to source control.
Keep a verified backup before rotating material. After an update, review the WebUI status and restart an application that may have cached an earlier certificate result.