3

I am new to Trusty TEE OS. Is there any way to find out if an Android Device uses such an OS without rooting the device ?

AFAIK there, DRM (Digital Rights Management) is the most widely used application of Trusty OS. Some examples for DRM frameworks are Widevine/PlayReady/ClearKey.

Does it mean that if any of these frameworks are present in the Android device, it is safe to assume that there is an underlying Trusty TEE OS in use ?

Thanks

1
  • 1
    Trusty is a kinda reference implementation of a TEE OS. But many OEMs have been using their own closed source implementations including QSEE, Kinibi, TEEGris, iTrustee etc. I don't think you'll find a clue about the underlying implementation on a non-rooted device. One possibility is that the name of the HAL(s) (binary blobs) process (usually an init service) interacting with TEE hardware may include some hint. On a rooted device, however, there are higher chances of getting a hint e.g. from the name or hexdump of some TEE-related partition. Even running strings on such partition may help. Feb 12, 2021 at 10:14

1 Answer 1

3

If it is an android 8+ device, TEE is a mandatory requirement for OEMs to obtain Google Mobile Services (GMS) licensing for devices that have Google apps pre-installed.

In Settings > Security > Advanced > Encryption & credentials > (CREDENTIAL STORAGE) Storage type > Hardware-backed

If it says hardware backed then TEE is present.

Programmatically, you can use isInsideSecureHardware() which returns true if the key resides inside TEE or SE.

If you want to explicitly verify if it's SE, use setIsStrongBoxBacked on the keyGenParameterSpecBuilder, key generation will fail with a StrongBoxUnavailableException if StrongBox is not supported.

Qualcomm Snapdragon and Samsung Exynos SoCs contain integrated TEE and they throw StrongBox unavailable exception but returns true for isInsideSecureHardware. Google's Titan M chip and Samsung Knox chip are discrete TEEs (called strongbox) that contains SE inside.

3
  • 1
    Well explained but it answers "How to find out if an Android device is using TEE?" (or SE). The question is "How to find out if an Android device is using Trusty TEE OS?" TEE is not always Trusty, it's OEM's choice. Feb 12, 2021 at 11:37
  • Right. I thought OP meant TEE only and might be calling Trusty TEE because of the title on android source. I made the same mistake few years back when I first read TEE support in android. Open to edits.
    – defalt
    Feb 12, 2021 at 12:18
  • 1
    yes I actually meant only TEE. thanks for pointing it out. I have posted a new related question here android.stackexchange.com/questions/233749/… maybe you could suggest something here as well ? Feb 12, 2021 at 12:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .