4

I have gone through questions One and Two. But still I have an additional question.

How do we find out that an android application uses Trusted Execution Environment (TEE) and Secure Element (SE). Particularly a hardware backed environment.

Thanks

Improve this question
5
  • 4
    Apps usually don't use TEE or SE directly. They aren't privileged enough to access underlying hardware resources. Instead they are using system APIs (e.g. Android keystore) or libraries (e.g. androidx.security) which subsequently use TEE if the device supports. So ask the developer or get the source code and find if the app is using any such API.
    – Irfan Latif
    Feb 12, 2021 at 13:21
  • @IrfanLatif To my knowledge apps can use the TEE, however this seems to require additional negotiations in the background between the app developer and the device manufacturer so not everybody can do so. For example the Netflix app is known to use the TEE. May be this is the reason that devices need to be certified for Netflix HD playback?
    – Robert
    Feb 12, 2021 at 13:28
  • @Robert yes definitely OEMs and ROM developers can access the hardware resources directly using low level APIs. And also they are sure if the device supports TEE or not. But normal apps cannot. Though they can query if the device supports TEE. Android Keystore, for instance, uses hardware-backed storage if the device supports, otherwise it silently uses software-backed storage. So even if we figure out that the app is using Keystore APIs, we cannot say for sure if it's using TEE. It depends on the device it's running on.
    – Irfan Latif
    Feb 12, 2021 at 13:35
  • 2
    @Robert Not in android. Google even recommends OEM against exposing API which can directly talk with kernel. Android has HALs that allow android framework to talk with the kernel. To use TEE, apps call AndroidKeystore Provider API which talks to Keymaster HAL which talks to kernel which talks to TEE.
    – defalt
    Feb 12, 2021 at 16:21
  • 2
    Any app that uses KeyStore and KeyPairGenerator or KeyGenerator classes along with the AndroidKeyStore provider and KeyChain API makes use of TEE. AndroidKeyStore provider API handles communication with whatever keystore is available on that device.
    – defalt
    Feb 12, 2021 at 16:27

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .