5 ms·

They're talking about ARM TrustZone (http://www.arm.com/TrustZone http://www.arm.com/TrustZone) here, which can do these kinds of things securely. However, I'm

• comex 12y ago
  'Securely' is relative. While a TrustZone kernel is supposed to be isolated from the main OS, it can still be compromised, which would allow the key to be retrieved. I don't know why they are storing the key at all, considering that it's supposed to be derived from the password; other systems certainly don't. (Apple's goes farther than that by attempting to prevent parallelized cracking using hardware encryption keys.)
  • michaelt 12y ago
    I don't know why they are storing the key at all, considering that it's supposed to be derived from the password A lot of people secure their phone with comparatively weak passwords of 4 to 6 numeric digits - I know I do! While you'd certainly want to hash that and include it in the key, using it as the sole source to derive the key wouldn't be enough. I can understand also trying to work in some sort of trusted hardware that imposes a rate limit and prevents performing attacks in parallel. You'd still hash the user's password into the encryption key, of course. And shether Samsung has managed to get the trusted hardware right is of course another matter...