4 ms·

> It is decreed that ARM systems not be user deactivatable. There are certain consumer Android ARM tablets/phones that for whatever reason, do not have secure

> It is decreed that ARM systems not be user deactivatable. There are certain consumer Android ARM tablets/phones that for whatever reason, do not have secure boot enabled (which are not devkits from Aliexpress). So not all of them. But they are indeed quite rare, and is one of the reasons why you can't just replace the Android bootloader with something else (you need the appropriate signing keys to do so). On Qualcomm devices, secure boot, once enabled, blows an irreversible hardware fuse. You then need the appropriate signing keys and software to sign images and you can, I believe, continue to blow fuses to overwrite old signing keys should you want to invalidate them. Thanks to the fuses, you can never deactivate secure boot (without, like, replacing the SoC with a miraculous solder job, or whatever). It's really irreversible.

octoberfranklin 5y ago
> continue to blow fuses to overwrite old signing keys That is definitely wrong. By their very nature efuses can be programmed only once. You can never overwrite the old values with arbitrary new values. In theory you can flip more zeroes to ones, since the fusing operation is only performed on the ones (or only on the zeroes -- the polarity choice is arbitrary but it is made at manufacturing time). But this is not really helpful; you can't feasibly generate your own signing key under the constraint that certain bits must be one... the cost of doing this grows exponentially with the number of constrained bits. In practice I have never ever seen an efuse array that didn't also have a "permanent write-protect" fuse. If that fuse exists, the programming software will certainly activate it after verifying that the key was programmed correctly.
- kaladin-jasnah 5y ago
  > By their very nature efuses can be programmed only once. You can never overwrite the old values with arbitrary new values. My understanding is this: you cannot overwrite the old values, but you can blow an additional fuse. If you have five fuses, then you blow the first fuse for the first key, then the second fuse for the second key. When you blow the second fuse, the system will only look at the second fuse, then the third, etc.
  - nightfly 5y ago
    > In practice I have never ever seen an efuse array that didn't also have a "permanent write-protect" fuse. If that fuse exists, the programming software will certainly activate it after verifying that the key was programmed correctly.

octoberfranklin 5y ago

> continue to blow fuses to overwrite old signing keys That is definitely wrong. By their very nature efuses can be programmed only once. You can never overwrite the old values with arbitrary new values. In theory you can flip more zeroes to ones, since the fusing operation is only performed on the ones (or only on the zeroes -- the polarity choice is arbitrary but it is made at manufacturing time). But this is not really helpful; you can't feasibly generate your own signing key under the constraint that certain bits must be one... the cost of doing this grows exponentially with the number of constrained bits. In practice I have never ever seen an efuse array that didn't also have a "permanent write-protect" fuse. If that fuse exists, the programming software will certainly activate it after verifying that the key was programmed correctly.

kaladin-jasnah 5y ago
> By their very nature efuses can be programmed only once. You can never overwrite the old values with arbitrary new values. My understanding is this: you cannot overwrite the old values, but you can blow an additional fuse. If you have five fuses, then you blow the first fuse for the first key, then the second fuse for the second key. When you blow the second fuse, the system will only look at the second fuse, then the third, etc.
- nightfly 5y ago
  > In practice I have never ever seen an efuse array that didn't also have a "permanent write-protect" fuse. If that fuse exists, the programming software will certainly activate it after verifying that the key was programmed correctly.