Hacker News Reader

Comment by guelo | Hacker News Reader

All Android devices certified by Google will have a hardware security module which should keep the keys secure. Some cheap non-certified devices (mostly Chinese) might not have hardware backed keystores, but I doubt those devices would be able to run this Google app.

View on HN

>> All Android devices certified by Google will have a hardware security module which should keep the keys secure.

Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification.

On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).

Titan M. They have it built into their Pixel devices much like a tiny mobile TPM.

https://www.blog.google/products/pixel/titan-m-makes-pixel-3...

With that said, I cant find mention of this on the page so it's probably not leveraging this.

It is. If you have a pixel you can just use a button press, because the Titan m can directly sense the button state.

Here's the CTS for Android 7.0 https://source.android.com/compatibility/7.0/android-7.0-cdd...

"When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware and meet following requirements: MUST have hardware backed implementations of RSA, AES, ECDSA and HMAC cryptographic algorithms and MD5, SHA1, SHA-2 Family hash functions to properly support the Android Keystore system's supported algorithms. MUST perform the lock screen authentication in the secure hardware and only when successful allow the authentication-bound keys to be used. The upstream Android Open Source Project provides the Gatekeeper Hardware Abstraction Layer (HAL) that can be used to satisfy this requirement. "

Not doubting you, but were did you find that information? The only thing I see is "it’s built into devices running Android 7.0+" and I found that on multiple pages.

As Android 7.0 is available to install on any device and I don't see anything about "certified android devices", I assume they mean ANY Android 7.0 device? Then again it only works with Google services atm, but I know you can sideload google play services so...

https://support.google.com/accounts/answer/6103523

Android 7 supports key attestation. https://source.android.com/security/keystore/attestation

That's great, but that doesn't actually guarantee that this new feature requires that the phone is using the hardware security module, just that you'd be able to prove if it it was.

Don't get me wrong, it's still better than TOTP in many ways, but having the actual security coprocessor is a big distinction.

There is no practical difference. For people who need the security, this API can guarantee it.

I just said I doubt it, I don't actually know. The combination of the Google web service and the android keystore api probably makes it at least difficult. But if you're running some custom compiled aosp code maybe it could be hacked.

1. This functionality only works on Android devices having passed CDD (try it). 2. Titan M is leveraged on Pixel 3.

If a Google app is required for this, we've already entered the "can't be trusted" category.

Reply on news.ycombinator.com