On Android distros [LWN.net]

On Android distros

Posted Jan 2, 2025 22:10 UTC (Thu) by excors (subscriber, #95769)
In reply to: On Android distros by epa
Parent article: Some things to expect in 2025

The kernel may not be low-level enough - the Google Play Integrity API reports a few different levels of integrity, and I believe the strongest requires Verified Boot and hardware attestation to prove you're running a certified, locked, unrooted, official bootloader/kernel/etc (https://developer.android.com/google/play/integrity/verdi...). If an app requires that level of integrity, and is willing to sacrifice compatibility with older Android devices and niche device configurations, no amount of fiddling with software will get around it (barring severe bugs in the implementation).

GrapheneOS notes that instead of using the Play Integrity API, apps could use AOSP's lower-level attestation API and choose to accept devices that match a list of "official GrapheneOS verified boot keys" (https://grapheneos.org/articles/attestation-compatibility...), which should provide a similar level of assurance without being tied to the proprietary Google Play Services. But I don't know if any serious apps actually do that.

to post comments

On Android distros

Posted Jan 3, 2025 11:31 UTC (Fri) by epa (subscriber, #39769) [Link] (3 responses)

What is to stop the API reporting that it's certified and unrooted when running a custom distribution?

On Android distros

Posted Jan 3, 2025 12:08 UTC (Fri) by excors (subscriber, #95769) [Link] (2 responses)

The app connects to some online service (e.g. your bank) which controls all the sensitive data this system is trying to protect. (It's not meant to protect purely offline apps). The app uses the API to get a securely signed attestation report, which it forwards to the online service for verification (checking the root certificate is signed by Google's attestation root key, the Verified Boot details say it's running trustworthy firmware, etc). The app/kernel/firmware can't forge the signatures, because the hardware does a reasonable job at keeping the private keys secret, so the server would reject a fake report and the app wouldn't have access to your money/secrets/etc.

On Android distros

Posted Jan 3, 2025 14:01 UTC (Fri) by epa (subscriber, #39769) [Link] (1 responses)

So you're saying the signature for the attestation report comes from the TPM (not the Linux operating system).

On Android distros

Posted Jan 3, 2025 16:25 UTC (Fri) by excors (subscriber, #95769) [Link]

Basically, yes.

(Technically it's not called a TPM, probably because that's a specific ISO standard and they don't implement that, but it's a vaguely similar idea. On Pixel phones there's a small 'secure' OS running on the main CPU in parallel to Linux, using ARM TrustZone for isolation; plus a security core on the main SoC, with its own dedicated CPU/RAM/etc running another OS; plus a physically separate security chip with yet another simple OS. Some combination of those are used for Verified Boot, attestation, etc. See https://security.googleblog.com/2021/10/pixel-6-setting-n...)

On Android distros

Posted Jan 10, 2025 13:30 UTC (Fri) by anton (subscriber, #25547) [Link]

According to the German Wikipedia, GrapheneOS works with a number of banking apps (the bank where I have my main account is listed). I don't know if these apps use the attestation API, but it certainly looks encouraging.