Fix TS.43 EAP-AKA identity and entitlement request semantics

[keeltrace]

Summary

This remains a focused follow-up on the TS.43 path in rcs-bounty-2994 / microg#3784. It now contains three independent correctness fixes, each kept as an attributable commit:

1. d61bba261f44fbd1af35d52855567e33c45d9e54 — preserve the exact EAP identity used in the exchange when deriving EAP-AKA keys, including alternate realms.
2. 5776fbdfb3bd830f190938f6465acf2f3f41299d — honor an explicit TS.43 terminal_id; use the device IMEI only as fallback.
3. 9b728c8eab66ce172339fb93adefadb94340db43 — when the entitlement request omits terminal metadata, default vendor/model/software-version from the device before applying the existing GMS-compatible truncation lengths.

Why these matter

EAP-AKA identity

The flow already uses Ts43Challenge.eap_aka_realm when constructing the EAP_ID sent to the carrier. Before the first commit, performSimAkaAuth rebuilt a default-realm identity before deriving K_aut. RFC 4187 section 7 derives the master key from the identity used in the exchange, so alternate-realm flows could MAC the response using a different identity than the one sent to the carrier.

terminal_id precedence

The existing builder used the device IMEI whenever available and only used ServiceEntitlementRequest.terminal_id when IMEI was null. Android's Service Entitlement implementation does the reverse: an explicit request terminal ID wins, with IMEI as the fallback.

terminal metadata defaults

The existing builder could send empty terminal_vendor, terminal_model, and terminal_sw_version values when the request omitted them. Android's Service Entitlement request defaults these fields from the device (Build.MANUFACTURER, Build.MODEL, and Android software version). The third commit adds the same fallback behavior while preserving explicit request values and the existing truncation limits.

Verification

Prepared on top of naormeit/GmsCore:rcs-bounty-2994 at 063ccbea736763234b439f4a5802ccbe18e27649.

Dedicated proof run: https://github.com/keeltrace/GmsCore/actions/runs/34563119544

• focused TS.43 unit tests: PASS
• :play-services-constellation-core:lintDebug: PASS
• :play-services-constellation-core:assembleDebug: PASS

The proof branch contains only the same code/test tree plus an isolated CI workflow; that workflow is not part of this PR.

Prior work / attribution

This is a narrow follow-up to the Constellation/Asterism implementation by @opstic in microg#3359 / microg#3360 and the integration work in microg#3784. It does not claim ownership of that base implementation.

References:

• RFC 4187 section 7: https://www.rfc-editor.org/rfc/rfc4187.html#section-7
• Android Service Entitlement request defaults / terminal ID fallback: https://android.googlesource.com/platform/frameworks/libs/service_entitlement/+/refs/heads/main/java/com/android/libraries/entitlement/ServiceEntitlementRequest.java
• Android EAP-AKA request construction: https://android.googlesource.com/platform/frameworks/libs/service_entitlement/+/refs/heads/master/java/com/android/libraries/entitlement/eapaka/EapAkaApi.java

Limitations

No TS.43 carrier/SIM hardware end-to-end test has been run yet. These are protocol/request-construction corrections with unit/lint/build verification, not a claim that this PR alone completes microg#2994.

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing