Contents
Do mobile phones have TPM?
The Mobile Trusted Platform Module (TPM MOBILE) is a security component and approved TCG specification for use in mobile devices. Its origin lies in the TPM v1. 2 and is intended to provide the same security and protocol interoperability, but with some enhancements for mobile devices: 1.
What is TrustZone in arm?
Arm TrustZone technology is used on billions of application processors to protect high-value code and data. Arm TrustZone technology offers an efficient, system-wide approach to security with hardware-enforced isolation built into the CPU.
What is Keymaster in Android?
Keymaster TA (trusted application) is the software running in a secure context, most often in TrustZone on an ARM SoC, that provides all of the secure Keystore operations, has access to the raw key material, validates all of the access control conditions on keys, etc.
Is Arm TrustZone a TPM?
In contrast to TPMs, which were designed as fixed-function devices with a predefined feature set, TrustZone represented a much more flexible approach by leveraging the CPU as a freely programmable trusted platform module.
What does the attestation extension on Android do?
The attestation extension contains a complete description of the keymaster authorizations associated with the key, in a structure that directly corresponds to the authorization lists as used in Android and the keymaster HAL.
How to support key attestation in Android 7.1?
To support key attestation, Android 7.1 introduced a set of tags, type, and method to the HAL. attestKey (vec keyToAttest, vec attestParams) generates (ErrorCode error, vec > certChain);
What is the purpose of a key attestation?
Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage.
How is attestation implemented in a hardware security module?
The code that creates or manages the relevant element (attestation or key) is implemented in a dedicated hardware security module. It could be altered if the hardware security module is compromised, but it is highly resistant to remote compromise and highly resistant to compromise by direct hardware attack.