I'm trying to figure out how exactly works the Android Verified Boot process and its usage with custom ROMs. The documentation I found on it is unclear (or outdated) as there seems to be several ways to do it.
What I understood (please correct me if I'm wrong) is listed below.
Before flashing :
- The bootloasder is initially locked, and has to be unlocked through the fastboot command (and a physical confirmation from the end user).
- The user data are totally wiped in order to prevent unauthorized access through rooting process (e.g. if a device is theft and the thief tries to access private data).
- The custom ROM public key is stored in the user-settable root of trust (alongside with the manufacturer's one) when the OS is flashed.
Boot process (after flashing) :
- The systems is powered on (physical button)
- The device embedded BIOS reads the public keys stored in the root of trust (manufacturer and user-settable) and verifies that the kernel image has not been tampered.
- If the public key used to check kernel tampering is the user-stable one, then a 10 seconds warning is displayed in order to warn the end-user that the pub. key used to perform these checks is not the manufacturer's one.
- Once the kernel integrity is confirmed, the initial ram image is loaded and the init process is called.
- The dm-verity kernel module ensures that the boot process is not tampered through cryptographically signature checks, using a public key.
As I write these lines, several steps are still unclear to me :
- Why are warnings displayed during boot if integrity checks pass ? I mean, even if the user-settable root of trust is used (instead of the manufacturer's one), integrity checks are still OK, don't they ?
- Is the UNLOCKED state needed in order to set the user-settable root of trust, or is it needed to bypass Android Verified Boot ?
- How is handled the "tamper evident" feature for the user-settable root of trust ? I mean : the user-settable root of trust should only be set by the end user (and not the manufacturer) but how can we be sure that It did not set one anyway ? Moreover, if the system is rooted, how can we be sure that the "new" OS has not reset the tamper evident flag ? Are one-time programmable memory used ?
- What public key is used by the dm-verity kernel module in order to perform integrity checks ?
Thanks in advance !