4

First, I hope I choose the right stackexchange for that question.

Android 4.3 introduces a "Hardware-backed" Credential Storage. If I go to Settings->Security under the "Credentials-Storage" Header there is a (non-clickable) option "Storage-Type" which is set to "only Software". How to set it to "Hardware-Backed"?

I already removed/reseted the credentials storage and tried it with different LockScreen-Options (Pin, Password, Pattern), but I can't get that option to change to "Hardware-Backed". Isn't the Galaxy Nexus capable of enabling it?

6

The "Hardware Backed Credential Storage" aka "Android Key Store" is only hardware backed when the hardware on the device has the necessary hardware components in it. When there isn't the necessary hardware available it falls back to software storage.

Android also now supports hardware-backed storage for your KeyChain credentials, providing more security by making the keys unavailable for extraction. That is, once keys are in a hardware-backed key store (Secure Element, TPM, or TrustZone), they can be used for cryptographic operations but the private key material cannot be exported. Even the OS kernel cannot access this key material. While not all Android-powered devices support storage on hardware, you can check at runtime if hardware-backed storage is available

From Android 4.3 APIs - hardware credential storage. My emphasis.

Finally, there is an API and even a system settings field that lets you check whether the credential store is hardware-backed (Nexus 4, Nexus 7) or software only (Galaxy Nexus)

From Credential storage enhancements in Android 4.3

This a new feature and so it's likely that only newer, higher end devices have the hardware in them. According to that, the Galaxy Nexus doesn't have the necessary hardware. The Nexus 4 does have full hardware support for this;

As you may now (sic), the Nexus 4 is based on Qualcomm's Snapdragon S4 Pro APQ8064 SoC. Like most recent ARM SoC's it is TrustZone-enabled and Qualcomm implement their Secure Execution Environment (QSEE) on top of it.

From Credential storage enhancements in Android 4.3

The ARM TrustZone technology is analogous to the TPM hardware used on Intel x86 PC compatible hardware to provide a hardware secure credential storage area. And just like TPM when it was first introduced is taking a while to trickle into all new phones.

So, in the case of the Nexus 4, the 'hardware' is simply the ARM SoC. Are other implementations possible? Theoretically, a hardware-backed keymaster implementation does not need to be based on TrustZone. Any dedicated device that can generate and store keys securely can be used, the usual suspects being embedded secure elements (SE) and TPMs. However, there are no mainstream Android devices with dedicated TPMs and recent flagship devices have began shipping without embedded SEs

From Credential storage enhancements in Android 4.3

So, no, the Galaxy Nexus is not capable of enabling hardware backed credential storage, because it doesn't have the necessary hardware in it.

  • So this means that any device with an S4 Pro (Xperia Z, etc) essentially has the hardware requirements? Is there any resource that lists TrustZone-enabled SOC's? Anyway, both this answer and your username are excellent! – dotVezz Oct 22 '13 at 17:21
  • @dotVezz It also depends on the manufacturer having set up things correctly, so it's possible to have a phone with a SoC that has the hardware but that's incapable of using it. – Dan Hulme Oct 22 '13 at 20:58
  • just like the galaxynexus having a SE in its NFC chip. This could possibly fulfill all hardware requirements, but isn't used for that. Great answer to a sad story anyway – Rafael T Oct 23 '13 at 1:37
  • Actually the Galaxy Nexus has had a hardware-backed credential storage since 4.1. It just isn't enabled in production builds. Also, TrustZone is a software thing, it does not require anything but a TZ-enabled ARM chip, which pretty much all recent ones are. TPM requires an actual secure chips. In order to take advantage of TZ, a secure OS needs to be installed, along with the relevant drivers and a way to link it to Android. This requires the manufacturer to integrate it, of course. – Nikolay Elenkov Jan 17 '14 at 4:06
  • @nikolay do you have any references for that? And your comment seems a bit confused about what's hardware and software. Have you thought about writing a full answer to this so that you've got more space to explain and include sources/references? – GAThrawn Jan 17 '14 at 8:04
0

Actually the Galaxy Nexus has had a hardware-backed credential storage since 4.1. It just isn't enabled in production builds.

Read this for details: http://nelenkov.blogspot.com/2012/07/jelly-bean-hardware-backed-credential.html

As this is not officially supported it might take some work to get it running on recent Android versions. The reason the driver is not used is that the driver has a power usage bug which cannot be fixed without updating the baseband. So use with caution. Cf. this commit message:

https://android.googlesource.com/device/samsung/tuna/+/b74801dc22bb4945ddf79b2e12e6328a862d68c3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.