5 ms·

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese

by guelo 8y ago

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

JohnFen 8y ago
If a Google app is required for this, we've already entered the "can't be trusted" category.
penagwin 8y ago
Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so... https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523
- lern_too_spel 8y ago
  Android 7 supports key attestation. https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation
  - munchbunny 8y ago
    That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was. Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.
    - lern_too_spel 8y ago
      There is no practical difference. For people who need the security, this API can guarantee it.
- guelo 8y ago
  I just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.
  - christiaanbrand 8y ago
    1. This functionality only works on Android devices having passed CDD (try it). 2. Titan M is leveraged on Pixel 3.
zimmerfrei 8y ago
>> All Android devices certified by Google will have a hardware security module which should keep the keys secure. Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification. On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).
- kpU8efre7r 8y ago
  Titan M. They have it built into their Pixel devices much like a tiny mobile TPM. https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3... With that said, I cant find mention of this on the page so it's probably not leveraging this.
  - dgacmu 8y ago
    It is. If you have a pixel you can just use a button press, because the Titan m can directly sense the button state.
- guelo 8y ago
  Here's the CTS for Android 7.0 https://source.android.com/compatibility/7.0/android-7.0-cdd#9_11_keys_and_credentials https://source.android.com/compatibility/7.0/android-7.0-cdd... "When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware and meet following requirements: MUST have hardware backed implementations of RSA, AES, ECDSA and HMAC cryptographic algorithms and MD5, SHA1, SHA-2 Family hash functions to properly support the Android Keystore system's supported algorithms. MUST perform the lock screen authentication in the secure hardware and only when successful allow the authentication-bound keys to be used. The upstream Android Open Source Project provides the Gatekeeper Hardware Abstraction Layer (HAL) that can be used to satisfy this requirement. "

by guelo 8y ago

JohnFen 8y ago

If a Google app is required for this, we've already entered the "can't be trusted" category.

penagwin 8y ago

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages. As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so... https://support.google.com/accounts/answer/6103523 https://support.google.com/accounts/answer/6103523

lern_too_spel 8y ago
Android 7 supports key attestation. https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation
- munchbunny 8y ago
  That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was. Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.
  - lern_too_spel 8y ago
    There is no practical difference. For people who need the security, this API can guarantee it.
guelo 8y ago
I just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.
- christiaanbrand 8y ago
  1. This functionality only works on Android devices having passed CDD (try it). 2. Titan M is leveraged on Pixel 3.

zimmerfrei 8y ago

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure. Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification. On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).

kpU8efre7r 8y ago
Titan M. They have it built into their Pixel devices much like a tiny mobile TPM. https://www.blog.google/products/pixel/titan-m-makes-pixel-3-our-most-secure-phone-yet/ https://www.blog.google/products/pixel/titan-m-makes-pixel-3... With that said, I cant find mention of this on the page so it's probably not leveraging this.
- dgacmu 8y ago
  It is. If you have a pixel you can just use a button press, because the Titan m can directly sense the button state.
guelo 8y ago
Here's the CTS for Android 7.0 https://source.android.com/compatibility/7.0/android-7.0-cdd#9_11_keys_and_credentials https://source.android.com/compatibility/7.0/android-7.0-cdd... "When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware and meet following requirements: MUST have hardware backed implementations of RSA, AES, ECDSA and HMAC cryptographic algorithms and MD5, SHA1, SHA-2 Family hash functions to properly support the Android Keystore system's supported algorithms. MUST perform the lock screen authentication in the secure hardware and only when successful allow the authentication-bound keys to be used. The upstream Android Open Source Project provides the Gatekeeper Hardware Abstraction Layer (HAL) that can be used to satisfy this requirement. "