This is really awesome:
Quote Tweet
Pixel now supports Binary Transparency! wired.com/story/google-p
Show this thread
1
2
17
Conversation
Replying to
It is very cool, would love to see the details - especially how they protect against an attacker causing the device to display the expected hashes.
1
Replying to
Exactly what I was wondering also... maybe hashes are emitted by low-level ROM?
2
It's extremely likely that it's based on the verifiedBootHash from key attestation. Key attestation also might be getting extended to cover firmware attestation better.
Our Auditor app provides support for obtaining that both locally and via our attestation.app service.
See developer.android.com/training/artic for information about key attestation.
It hasn't been updated for the latest revisions though. v3 already wasn't the latest. 5th generation Pixels launched with v4 attestation. So just bear in mind that already wasn't fully up-to-date/complete docs.
1
2
Can see we have the verified boot hash in the local (Auditor) and remote (attestation.app) verification output for Auditor. If they've expanded the information from key attestation, we'll be able to provide more. The verified device information section is from hardware.
read image description
ALT
read image description
ALT
1
2
Show replies