On Android distros [LWN.net]

On Android distros

Posted Jan 3, 2025 14:01 UTC (Fri) by epa (subscriber, #39769)
In reply to: On Android distros by excors
Parent article: Some things to expect in 2025

So you're saying the signature for the attestation report comes from the TPM (not the Linux operating system).

to post comments

On Android distros

Posted Jan 3, 2025 16:25 UTC (Fri) by excors (subscriber, #95769) [Link]

Basically, yes.

(Technically it's not called a TPM, probably because that's a specific ISO standard and they don't implement that, but it's a vaguely similar idea. On Pixel phones there's a small 'secure' OS running on the main CPU in parallel to Linux, using ARM TrustZone for isolation; plus a security core on the main SoC, with its own dedicated CPU/RAM/etc running another OS; plus a physically separate security chip with yet another simple OS. Some combination of those are used for Verified Boot, attestation, etc. See https://security.googleblog.com/2021/10/pixel-6-setting-n...)