It s said that widevine L1 level requires hardware support so that it s impossible even for manufacturer to provide it through a system update.
But what exactly has to be done by the hardware?
-
1You need an ARM cpu with TrustZone/Trusted Execution Engine (TEE). AFAIK this is already a requirement for new Android devices. Additionally the device have to pass the Widevine L1 certification by Google.– RobertSep 2, 2020 at 11:30
-
@Robert so it excludes other cpu isa?– user2284570Sep 2, 2020 at 12:21
Add a comment
|
1 Answer
To meet security Level 1, all content processing, cryptography, and control must be performed within the Trusted Execution Environment (TEE) of the device’s processor, to prevent external tampering and copying of the media file. All ARM Cortex-A processors implement TrustZone technology, creating a hardware separation that allows a trusted OS (such as Android) to create a TEE for DRM, and other secure applications.
(click to enlarge )
System update is at OS level (including drivers) but not at CPU/ TEE level which are totally independent. Quoting from wiki
The TEE is a standard which creates an isolated environment that runs in parallel with the operating system, providing security for the rich environment. It is intended to be more secure than the User-facing OS. ARM TrustZone TEE is an implementation of the TEE standard
For more , see The Complete Guide to Widevine Google’s DRM Platform
answered Sep 2, 2020 at 11:50
-
So does it excludes other cpu isa offerring an equivalent feature for keys like Intel trusted execution? Sep 2, 2020 at 12:29
-
Yes, that is what one can infer from the diagram that shows ARM. Intel seems to have a different implementation Sep 2, 2020 at 12:33
-
Hardware restriction wiki has more details Intel Insider, a technology that provides a "protected path" for digital content can be considered a form of DRM but in the context of Android it has to be ARM Sep 2, 2020 at 12:40