3 ms·
If I'm reading this right (and I am only on my second coffee so it's possible I'm not) the whole decryption process relies on getting an initial decryption key
by spzb 6y ago
If I'm reading this right (and I am only on my second coffee so it's possible I'm not) the whole decryption process relies on getting an initial decryption key out of the Android Keystore. They kind of gloss over they do that in the first place. Presumably the phone has already been compromised to enable access to the Keystore.
- izacus 6y agoBasically you need root access to your own device. It's like "decrypting Chrome data" when you just look into ~/.config/chrome after your disk encryption keys have been entered. (Android devices use Full Disk Encryption by default and extracting this data needs an attacker that has gained access to unlocked storage first.)
- MacsHeadroom 6y agoIt's not that simple. Keystore uses an HSM if available. Decrypting FDE and having root gets you nowhere if the keys are in an HSM. The only way to secrets on a device with an HSM is to get past FDE, get root, and disable the HSM BEFORE the keys are created/stored. Disabling the HSM after the keys have been stored simply wipes the keys and makes them unrecoverable forever.