4 ms·
Is this like Google's central "root key"? Or does each Android OS distributor, e.g. Samsung, LineageOS, etc., have their own certificate?
by RjQoLCOSwiIKfpm 4y ago
Is this like Google's central "root key"? Or does each Android OS distributor, e.g. Samsung, LineageOS, etc., have their own certificate?
- themoonisachees 4y agoI expect keys to be per software vendor, because otherwise lineageOS, and pretty much all small device manufacturers would not be able to sign their android kernel (required for pretty much anything secure, like google pay or safetynet), and giving them a central key would be a significant security risk compared to say Samsung. That said the private key for the CA could be compromised and in that case everything not up to date is toast
- ShredKazoo 4y ago>That said the private key for the CA could be compromised and in that case everything not up to date is toast I don't follow. Do different Android distributors make use of the same CA? If so why? I don't even see why they would need to make use of a CA if their public key is shipped with the device.
- Zeik0s 4y agoThere are different certificates for each vendor, therefore there are multiple hashes listed in the Bugtracker: https://bugs.chromium.org/p/apvi/issues/detail?id=100 https://bugs.chromium.org/p/apvi/issues/detail?id=100
- mjg59 4y agoThe public evidence doesn't seem to suggest that any Google-owned keys are affected. Platform certificates are owned by the vendor.
- MishaalRahman 4y agoThese platform certificates are all from different vendors, but the problem is that one of the leaked certs appears to be from the biggest Android vendor...Samsung. And that cert is seemingly still being used by them to sign apps.