2 ms·

The audit report does not explicitly state that the keys are erased on firmware update, but malicious firmware updates were specifically in scope for the audit,

The audit report does not explicitly state that the keys are erased on firmware update, but malicious firmware updates were specifically in scope for the audit, and this specific attack was not raised as an issue, and the blog post explains why. The Titan chip in your Pixel is not running the mentioned custom firmware that erases the keys on update (and malicious firmware updates to the HSM in the phone were not in scope for the audit). It is not at all clear that the FBI would have lost if they had continued to pursue Apple in the San Bernadino case. The distinction you are drawing is not as clear cut as you think it is.

monocasa 6y ago
When a core piece of their security model isn't backed up by the third party audit that they literally are presenting as "don't trust us, we have a audit covering this" (and the auditors did look at how google protects against malicious firmware updates, hence their attestation comments), _and_ when that would leave them being unable to update these modules without wiping everyone's backups, _and_ the auditors found security bugs that required a firmware update, _and_ literally the same chips are updated without wiping when against a threat model that has a better argument for wipes on update, I'm sorry I just don't believe the blog post. Bringing this back to the original point though, just using an HSM doesn't automatically mean that the manufacturer of the HSM can't access the keys.