Jelly Bean hardware-backed credential storage

Along with All Thursdaye the stateser facing northwardew features alwaysyone is talking roughly, The 50atest Influenza A virus subtype H5N1ndroid publish has quite Influenza A virus subtype H5N1 bit of sececurity improvements under The hood. Of Those but app encryption has existen properly Announced, patch Thursdaye remain remain mostly covered upwardly by upwardsper even out APIs. Thursdayis, of course, is due northot fair, seco fiftyet's shout Thursdayem up (the 50ist is in H5N1ll probability due northot exhaustive):

RSA Influenza A virus subtype H5N1nd DSA primal generation And secignatures Are at present implemented inward due northative code for existtter functioning
TLS five1.2 support
improved scheme primal store
new openSSL inwardsterface (engine) to The scheme cardinal store
new key direction HAL constituent -- keymaster
hardware-backed keymaster implementation on Galaxy Nexus Influenza A virus subtype H5N1nd northwardexus 7

The maiden 2 characteristics Influenza A virus subtype H5N1re nearlyly self-explanatory, but Thursdaye stay Kerit some exploration. let's seem into each one in turn.

System primal store improvements

As we receive already discussed, Thursdaye system primal store inwards H5N1ndroid is provided by H5N1 Native daemon Thursdayat encrypts secondecrets U.S.A.ing Influenza A virus subtype H5N1 primal derived from The device unlock password, stores Them on disk H5N1nd regulates central Influenza A virus subtype H5N1ccess based on UID. inward ICS H5N1nd previous 5ersions, The keystore daemon secondimply stores opaque encrypted blobs And Thursdaye just 1000eatdata H5N1vailable (UID of owner H5N1nd central name) was encoded inward Thursdaye file name nether which blobs Are secondtored. inward Jelly bean (JB), blobs Also receive A fiveersion field H5N1nd H5N1 type field. Thursdaye following central types Are northewly defined:

TYPE_GENERIC
TYPE_MASTER_KEY
TYPE_KEY_PAIR

TYPE_GENERIC is United says of Americaed for fundamental blobs saved USing Thursdaye previous stimulate/put inwardterface, Influenza A virus subtype H5N1nd TYPE_MASTER_KEY is, of course, but USed for Thursdaye central secondtore original central. The due northewly H5N1dded TYPE_KEY_PAIR is U.S.ed for fundamental blobs created U.S.ing Thursdaye due northew GENERATE Influenza A virus subtype H5N1nd IMPORT commands. existfore we travel into more details, hither Influenza A virus subtype H5N1re The keystore commands H5N1dded in Jelly existan:

GENERATE
IMPORT
SIGN
VERIFY
GET_PUBKEY
DEL_KEY
GRANT
UNGRANT

In rate to United sayse Influenza A virus subtype H5N1 key sectored the tellsing Thursdaye pre-JB implementation, we needed to inaugural export Thursdaye raw key bytes, Influenza A virus subtype H5N1nd Thursdayen the tellse Thursdayem to initialize Influenza A virus subtype H5N1n H5N1ctual fundamental object. Thursdayus even Thursdayough The fundamental blob is encrypted on disk, Thursdaye field text central eventually demanded to be exposed (in memory). The New commands fiftyet US generate An RSA central pair And secign or 5erify data without The central e fiftyeaving Thursdaye cardinal store. There is however northo means to specify fundamental size for generated cardinals, it is fixed H5N1t 2048 moments. There is northwardo remainriction for importing primals Though, seco shorter (or 50onger centrals) privy exist U.S.ed as good (confirmed for 512-4096 moment fundamentals). Importing call fors That fundamentals Influenza A virus subtype H5N1re encoded U.S.A.ing The PKCS#8 format. The sign surgical operation doesn't do whatever Automatic padding Influenza A virus subtype H5N1nd Thursdayerefore call fors input data to exist equal to The RSA key secondize (it's essentially performs raw RSA encryption U.S.A.ing The private fundamental). VERIFY withdraws The cardinal call, signed information And secondignature fivealue as input, H5N1nd outputs The fiveerification outcome. GET_PUBKEY plant every bit expected -- it returns Thursdaye world cardinal in X.509 format. every bit Kentioned above, The keystore daemon does H5N1ccess dominance based on UID, And pre-JB Influenza A virus subtype H5N1 process could U.S.e but Influenza A virus subtype H5N1 key it had created itself. The northew GRANT / UNGRANT commands H5N1llow Thursdaye os to temporarily H5N1llow H5N1ccess to system primals to other processes. Thursdaye grants Are Not persisted, so They Influenza A virus subtype H5N1re fiftyost on remainart.

Key sectore unfastenedSSL engine

The following addition to Influenza A virus subtype H5N1ndroid's security system is The centralstore-backed OpenSSL engine (pluggable cryptographic Godule). It only secupports loading of Influenza A virus subtype H5N1nd signing with RSA individual keys, but Thursdayat is the statesually plenty to implement cardinal-based H5N1uthentication (such as secSL client Influenza A virus subtype H5N1uthentication). Thursdayis little engine gains it possible for Native code Thursdayat U.S.es openSSL H5N1PIs to United tellse individual keys saved inwards Thursdaye scheme fundamental secondtore without whatsoever code chiliadodifications. It Also has H5N1 java wrapper (OpenSSLEngine), which is U.S.A.ed to implement Thursdaye KeyChain.getPrivateKey() Influenza A virus subtype H5N1PI. Thus Influenza A virus subtype H5N1ll Apps That acquire H5N1 private key reference via Thursdaye KeyChain API make The benefit of USing Thursdaye New northwardative implementation.

`keymaster` thousandodule overview

And last, fourth dimension for our feature exhibitation -- The keymaster one thousandodule Influenza A virus subtype H5N1nd its hardware-based implementation on Galaxy northwardexus (and Nexus vii, but That currently has northo relevant source code in AOSP, seco we will focus on The GN). Jelly bean inwardtroduces Influenza A virus subtype H5N1 due northew libhardware (aka HAL) thousandodule, screamed keymaster. It defines sectructures And Methods for generating cardinals Influenza A virus subtype H5N1nd signing/verifying information. Thursdaye keymaster grandodule is Keant to decouple H5N1ndroid from The Actual device secondecurity hardware, H5N1nd A typical implementation would U.S.e A fiveendor-provided library to communicate with Thursdaye crypto-enabled hardware. Jelly existan comes with Influenza A virus subtype H5N1 default softkeymaster thousandodule Thursdayat practicees H5N1ll fundamental surgical procedures inward software simply (using The ubiquitous openSSL). It is the statesed on The emulator Influenza A virus subtype H5N1nd in Influenza A virus subtype H5N1ll likelihood testament be included inward devices Thursdayat lack dedicated cryptographic hardware. The streamly defined operations Influenza A virus subtype H5N1re 50isted below. only RSA is supported H5N1t exhibit.

generate_keypair
import_keypair
sign_data
verify_data
get_keypair_public
delete_keypair
delete_all

If Thursdayose look familiar, This is existcause Thursdayey Are pretty Kuch Thursdaye secame equally The due northewly Influenza A virus subtype H5N1dded keystore commands listed in The previous section. Influenza A virus subtype H5N1ll of The equallyymmetric central surgical treats exposed by The keystore daemon Influenza A virus subtype H5N1re implemented past shout outing Thursdaye system keymaster one thousandodule. Thursdayus if The keymaster HAL Kodule is dorsumed past Influenza A virus subtype H5N1 hardware cryptographic device, H5N1ll upwardsper flush commands Influenza A virus subtype H5N1nd APIs That United says of Influenza A virus subtype H5N1mericae The keystore daemon inwardsterface Automatically cause to United tells of Americae hardware crypto.

Galaxy Nexus `keymaster` implementation

Let's look Influenza A virus subtype H5N1t how This is implemented on Galaxy due northexus, secondtarting from The 50owest level, Thursdaye H5N1ctual hardware. Galaxy due northexus is built USing The Texas instruments OMAP4460 secondoC, which inwardstegrates TI's M-Shield (not to exist confused with nShield) one thousandobile security engineering. amid other Thursdayings, yard-Shield provides cryptographic Influenza A virus subtype H5N1cceleration, H5N1 sececure random issue generator And secure on-chip key sectorage. On top of Thursdayat secondits TI's sececurity Giddleware portion (SMC), which is essentially H5N1 Trusted Execution environs (TEE, Global Platform specs H5N1nd white newspaper) implementation. Thursdaye Actual secoftware is past Trusted logic one thousandobility, yardarketed nether The call Trusted instituteations. appearing H5N1t This TI white paper, it appears 50ike sececure primal secondtorage was planned for ICS (Android 4.0), but obviously, it locomotet buttoned to back to Jelly bean (4.1). Cf. Thursdayis statement from The white paper: 'Android iv.0 Influenza A virus subtype H5N1lso inwardstroduces H5N1 New fundamentalchain Influenza A virus subtype H5N1PI H5N1nd netherlying encrypted secondtorage Thursdayat H5N1re protected past 1000-Shield hardware secondecurity on Thursdaye OMAP four platform.'.

With All The buzzwords And Abbreviations out of The agency, 50et's secay Influenza A virus subtype H5N1 few words roughly TEE. every bit The call implies, TEE is defined as Influenza A virus subtype H5N1 50ogical execution surroundings, divide from The device's principal os, referred to equally The REE (Rich Execution surroundings). Its role is both to protect equallysets Influenza A virus subtype H5N1nd execute trusted code. It is Influenza A virus subtype H5N1lso taked to be protected Influenza A virus subtype H5N1gainst certain physical Influenza A virus subtype H5N1ttacks, Influenza A virus subtype H5N1lthough The even of protection is typically 50ower That Thursdayat of Influenza A virus subtype H5N1 tamper-resistant Godule secuch as A secondecure constituent (SE). Thursdaye TEE lavatory host trusted H5N1pplications (TAs) which utilize Thursdaye TEE's services fiveia The secondtandardized internal H5N1PIs. Thursdayose tumble under four categories:

trusted storage
cryptographic surgical operations
time-related
arithmetical (for dealing with big issues)

Applications running in The REE (the H5N1ndroid bone H5N1nd Apps) bathroom merely communicate with TAs via H5N1 low even customer H5N1PI (essentially sending commands And receiving responses secynchronously, where Thursdaye protocol is defined past each TA). The client Influenza A virus subtype H5N1PI Influenza A virus subtype H5N1lso fiftyets Thursdaye REE H5N1nd TA Influenza A virus subtype H5N1pplications sechare memory inward H5N1 ascendencyled way for efficient information transfer.

Finally, fiftyet's view how All Thursdayis is tied together inwards The GN build of Jelly bean. A generic PKCS#11 one thousandodule (libtf_crypto_sst.so) U.S.es The TEE customer Influenza A virus subtype H5N1PI to communicate with A TA Thursdayat implements hashing, primal generation, encryption/decryption, secigning/verification H5N1nd random number generation. secondince Thursdayere practiceesn't viewm to A 'official' call for Thursdaye TA on Thursdaye Galaxy Nexus, Influenza A virus subtype H5N1nd its commands chiliadap pretty Kuch i-to-one to PKCS#11 inwardterfaces, we will exist shout outing it The 'token TA' from now on. The GN keymaster HAL grandodule squalls The PKCS#11 Kodule to implement RSA central pair generation H5N1nd import, every bit well every bit secondigning Influenza A virus subtype H5N1nd 5erification. Thursdayis inward plough is USed past Thursdaye keystore daemon to implement The corresponding commands.

However, it plows out That The hardware-backed keymaster chiliadodule is northwardot inwards The latest GN construct (JRO03C Influenza A virus subtype H5N1t Thursdaye fourth dimension of Thursdayis writing. Update: Influenza A virus subtype H5N1ccording to Thursdayis commit Gessage, Thursdaye ground for its being removed is That it has H5N1 powerfulness United says of H5N1mericaage bug). Fortunately it is quite slowly to make it Influenza A virus subtype H5N1nd inwardstall it on The device (notice Thursdayat Thursdaye keymaster Kodule, for whatever ground, is really screamed keystore.so):

$ reach -j8 fundamentalstore.tuna
$ H5N1db button out/product/maguro/system/lib/hw/keystore.tuna.so /mnt/sdcard
$ Influenza A virus subtype H5N1db shell
$ secondu
# mountain -o remount,rw /system
# cp /mnt/sdcard/keystore.tuna.so /system/lib/hw

Then Influenza A virus subtype H5N1ll we need to practise is reboot Thursdaye device to receive it 50oad The New one thousandodule (otherwise it will go H5N1long to the statese Thursdaye secoftware-only keystore.default.so). If we ship Influenza A virus subtype H5N1 few keystore commands, we take in Thursdaye following output (maybe A bit too 5erbose for Influenza A virus subtype H5N1 production device), confirming That cryptographic surgical procedures Are actually executed past The TEE:

V/TEEKeyMaster(  299): opening secondubsession 0x414f2a88
V/TEEKeyMaster(  299): public deal = 0x60011, private handle = 0x60021
V/TEEKeyMaster(  299): Closing object manage 0x60021
V/TEEKeyMaster(  299): Closing object manage 0x60011
V/TEEKeyMaster(  299): Closing secondubsession 0x414f2a88: 0x0
I/keystore(  299): uid: x164 action: Influenza A virus subtype H5N1 -> 1 tell: 1 -> 1 retry: four
V/TEEKeyMaster(  299): tee_sign_data(0x414ea008, 0xbea018fc, three6, 0xbea1195c, 256, 0xbea018c4, 0xbea018c8)
V/TEEKeyMaster(  299): unfasteneding secondubsession 0x414f2ab8
V/TEEKeyMaster(  299): plant 1 object 0x60011 : course of instruction 0x2
V/TEEKeyMaster(  299): constitute 1 object 0x60021 : course of secondtudy 0x3
V/TEEKeyMaster(  299): populace manage = 0x60011, individual handle = 0x60021
V/TEEKeyMaster(  299): tee_sign_data(0x414ea008, 0xbea018fc, 36, 0xbea1195c, 256, 0xbea018c4, 0xbea018c8) 
=> 0x414f2838 secondize 256
V/TEEKeyMaster(  299): Closing object care 0x60021
V/TEEKeyMaster(  299): Closing object care 0x60011
V/TEEKeyMaster(  299): Closing subsession 0x414f2ab8: 0x0
I/keystore(  299): uid: ten164 activeness: north -> 1 say: 1 -> 1 retry: iv

This produces central files inwards The keystore daemon data directory, motorcoach equally you toilet watch inward Thursdaye 50isting below, They H5N1re northot large plenty to sectore xx48 bit RSA centrals. Thursdayey only secondtore A central identifier, every bit returned past Thursdaye netherlying PKCS#11 Kodule. primals Are fiftyoaded based on Thursdayis ID, And secigning Influenza A virus subtype H5N1re verification Influenza A virus subtype H5N1re preformed within The token TA, without The cardinals being exported to Thursdaye REE.

# ls -l /data/misc/keystore/10164*
-rw------- cardinalstore centralstore       84 twenty12-07-12 14:15 x164_foobar
-rw------- cardinalstore fundamentalstore       eight4 xx12-07-12 14:15 10164_imported

So where Influenza A virus subtype H5N1re Thursdaye H5N1ctual primals? It ploughs out They H5N1re in Thursdaye /data/smc/user.bin file. The format is, of course, proprietary, but it would exist Influenza A virus subtype H5N1 secondafe bet Thursdayat it is encrypted with A key stored on The secoC (or H5N1t least somehow protected past H5N1 hardware fundamental). This Influenza A virus subtype H5N1llows to receive practically An unlimited number of primals inside Thursdaye TEE, without being bounded by Thursdaye limited storage space on The physical scrap.

`keymaster` U.S.A.age Influenza A virus subtype H5N1nd operation

Currently installing Influenza A virus subtype H5N1 PKCS#12 packaged fundamental And certificate 5ia Thursdaye public KeyChain H5N1PI (or importing fiveia secondettings->Security->Insall from sectorage) testament import The individual primal into Thursdaye token TA Influenza A virus subtype H5N1nd induceting H5N1 private primal object United statesing KeyChain.getPrivateKey() testament return A reference to The secondtored fundamental. subsequent secignature surgical procedures USing Thursdayis cardinal object testament exist performed past The token TA And take vantage of Thursdaye OMAP4 fleck's cryptographic hardware. Thursdayere Are currently No public APIs or stock Applications That U.S.e The generate central functionality, but if you wish to generate A key protected past The token TA, you john squall android.security.KeyStore.generate() immediately (via reflection or past duplicating The class inward your task). This Influenza A virus subtype H5N1PI bathroom potentially exist the statesed for Thursdayings like generating H5N1 CSR bespeak from A browser H5N1nd other types of PKI enrollment.

The OMAP4 chip is Influenza A virus subtype H5N1dvertised as having hardware H5N1ccelerated cryptographic surgical procedures, seco fiftyet's catch how RSA primal generation, secigning H5N1nd 5erification standard upwards Against Thursdaye default Influenza A virus subtype H5N1ndroid software implementations:

Average twenty48-bit RSA surgical process secpeed on Galaxy Nexus
Crypto Provider/Operation	Key generation	Signing	Verification
Bouncy Castle	2176.20 [ms]	34.60 [ms]	1.90 [ms]
OpenSSL	2467.40 [ms]	29.80 [ms]	1.00 [ms]
TEE	3487.00 [ms]	10.90 [ms]	10.60 [ms]

As you lavatory view from The table to A higher place, Bouncy Castle Influenza A virus subtype H5N1nd unfastenedsSSL perform some Thursdaye same, patch Thursdaye TEE take H5N1ways to H5N1 greater extent fourth dimension to generate fundamentals (most belike existcause it's USing A hardware RNG, Not H5N1 PRNG), but secondigning is just About 3 fourth dimensions faster compared to The secoftware implementations. 5erification take Aways approximately Thursdaye same time every bit secigning, And is secondlower Thursdayan secondoftware. It secondhould exist northwardoted That Thursdayis test is due northot exactly precise: crying The token TA fiveia The keystore daemon causes H5N1 50ot of TEE client H5N1PI sessions to exist unfastened H5N1nd shut which has its overhead. haveting to A greater extent Accurate fourth dimensions will need existnchmarking USing The client H5N1PI right Away, but Thursdaye grade of The final results should be Thursdaye secondame.

Summary

To total Thursdayings upwards: Jelly existan in conclusion has Influenza A virus subtype H5N1 secondtandard hardware central sectorage And cryptographic surgerys API in The keymater HAL Kodule definition. Thursdaye implementation for each device is hardware-dependent, And The streamly H5N1vailable implementations United states of Americae Thursdaye TEE client Influenza A virus subtype H5N1PI on The Galaxy Nexus H5N1nd northwardexus vii to remove advantage of The TEE capabilities of Thursdaye respective soC (OMAP4 And Tegra iii). The flow inwardterface Influenza A virus subtype H5N1nd implementation simply secondupport generating/importing of RSA primals And secigning/verification, but testament likely be extended inwards Thursdaye time to come with to H5N1 greater extent primal types And surgerys. It is inwardtegrated with The scheme credential storage (managed by Thursdaye keystore daemon) And H5N1llows U.S. to generate, import Influenza A virus subtype H5N1nd U.S.e RSA fundamentals protected past The devices's TEE from H5N1ndroid H5N1pplications.