3 ms·

Such a thing, more or less, exists today. It is called Secure Element[1]. It comes in microSD + NFC or embedded as part of SmartCard/SIM card. Incidentally this

by bravo22 11y ago

Such a thing, more or less, exists today. It is called Secure Element[1]. It comes in microSD + NFC or embedded as part of SmartCard/SIM card. Incidentally this "secure element" is why GooglePay was/is dependant on carriers. The carriers already have a secure element (in their SIM) to authenticate you on their network. It seems the real value in what they've done is expand the software support for it by, hopefully, making it a key part of Android API. [1] https://www.datacard.com/downloads/ViewDownLoad.dyn?elementId=repositories/downloads/xml/NFC-micro-sd-secure-elements-data-sheet.xml&index=1&repositoryName=downloads https://www.datacard.com/downloads/ViewDownLoad.dyn?elementI...

sangnoir 11y ago
That's explicitly called out in the article: > ...there’s already advanced security features on your phone, contained in the SIM card, which protects the things important to carriers. Vault is designed to be an equivalent, but designed to project a user’s important content. SIM card is controlled by carrier, and protects carriers' cryptographic interests. The vault is independent of the Secure Element: it user-controlled, and protects user's cryptographic interests.
- bravo22 11y ago
  Correct. The carrier controls that SE, in this case Google is making it easier for people to work with their own SE by giving Android ability to talk to it. You can/could do the same thing with carrier's SIM actually. All SEs run something called Java Card, which is a standard API you can write against (in Java). Each app gets it's own isolated part of the secure storage, and runs in complete sandbox from other apps and can communicate to apps on the host device. The chip inside the SIM and the SDCard are pretty much the same. Just different packaging.
- deleted 11y ago
  [deleted]
andor 11y ago
AFAIK the secure element for Google Wallet is part of the NFC chip.
- bravo22 11y ago
  Almost. The biggest hurdle in SE is "provisioning", i.e. how do you get your master keys in there. This is why Google needed to rely on the carriers for authentication. They already have a full infrastructure for that in place. The NFC chip in Nexus for example (PN5323 IIRC) interfaces with an external secure element[1], which would be in the SIM card in their case and in the new use cases it would be the external uSD card. The NFC chip passes data transparently between the external NFC device and the SE like a bridge.[2] I believe in Apple's case they just built an SE directly into their chip and came up with their own provisioning infrastructure, bypassing the carrier. Which I think is the better way. That is what Google should have done. [1] http://www.adafruit.com/datasheets/pn532ds.pdf http://www.adafruit.com/datasheets/pn532ds.pdf (page 20) [2] http://en.wikipedia.org/wiki/NFC-WI http://en.wikipedia.org/wiki/NFC-WI

by bravo22 11y ago

sangnoir 11y ago

That's explicitly called out in the article: > ...there’s already advanced security features on your phone, contained in the SIM card, which protects the things important to carriers. Vault is designed to be an equivalent, but designed to project a user’s important content. SIM card is controlled by carrier, and protects carriers' cryptographic interests. The vault is independent of the Secure Element: it user-controlled, and protects user's cryptographic interests.

bravo22 11y ago
Correct. The carrier controls that SE, in this case Google is making it easier for people to work with their own SE by giving Android ability to talk to it. You can/could do the same thing with carrier's SIM actually. All SEs run something called Java Card, which is a standard API you can write against (in Java). Each app gets it's own isolated part of the secure storage, and runs in complete sandbox from other apps and can communicate to apps on the host device. The chip inside the SIM and the SDCard are pretty much the same. Just different packaging.
deleted 11y ago
[deleted]

andor 11y ago

AFAIK the secure element for Google Wallet is part of the NFC chip.

bravo22 11y ago
Almost. The biggest hurdle in SE is "provisioning", i.e. how do you get your master keys in there. This is why Google needed to rely on the carriers for authentication. They already have a full infrastructure for that in place. The NFC chip in Nexus for example (PN5323 IIRC) interfaces with an external secure element[1], which would be in the SIM card in their case and in the new use cases it would be the external uSD card. The NFC chip passes data transparently between the external NFC device and the SE like a bridge.[2] I believe in Apple's case they just built an SE directly into their chip and came up with their own provisioning infrastructure, bypassing the carrier. Which I think is the better way. That is what Google should have done. [1] http://www.adafruit.com/datasheets/pn532ds.pdf http://www.adafruit.com/datasheets/pn532ds.pdf (page 20) [2] http://en.wikipedia.org/wiki/NFC-WI http://en.wikipedia.org/wiki/NFC-WI