Hardware backed keystorage in Android

Question

When searching through sites/blogs and articles about secure key storage on Android, I've found that hardware key storage isn't explained consistent. In the sense that some say that the keys are stored at the Trusted Execution Environment (TEE), while others say only the master key derived from a hardware key (baked in the TEE) is used to encrypt the encryption keys and is thus stored in the normal world.

So in summary, secure hardware backed key storage:

• Keys stored in the TEE?
• Keys stored in the normal world but protected with a hardware derived key?

Which one is implemented in Android? Or are both possible and is the implementation dependent on the processor manufacturers?

The litaturate is quite inconsistent.

Thanks in advance,

Gilles Callebaut

Answer 1

Generally, these two solutions are both possible, and also it is the recommended solution for TEE OS. You can just read the ARM and Global Platform's TEE whitepaper in detail.