Droidcedas : Ics Credential Storage Implementation

Oleh Didiet86

Friday, July 27, 2018

Bagikan :

Tweet

In the previous entry, nosotros looked at how the novel ICS KeyChain API is used too tried installing a user somebody key/certificate pair too a CA certificate. Now we'll volition crusade to uncovering out where  they are genuinely stored too how they are protected.

Looking at frameworks/base/keystore/java/android/security, nosotros notice several interesting classes that are non mentioned inwards the SDK documentation. The most promising is the KeyStore class, too thus let's cause got a look. Sure enough, it is marked equally hidden (using the dreaded @hide comment). It does cause got methods for interacting alongside the substitution shop (get(), put(), delete(), reset(), etc.), exactly where is the actual substitution store? As it turns out, all methods mail command to a local socket aptly named 'keystore'. With a trivial creative grepping, nosotros uncovering out that in that place is native daemon alongside the same call listening on that socket. The source is inwards frameworks/base/cmds/keystore/keystore.cpp, too thus let's cause got a look. The file has closed to helpful comments, too nosotros larn that keys are encrypted, checksummed too saved equally files (one substitution per file). But where are the actual files? Looking at /init.rc nosotros uncovering the keystore daemon startup command looks similar this:

service keystore /system/bin/keystore /data/misc/keystore     cast chief     user keystore     grouping keystore     socket keystore flow 666

Next footstep is, of course, peeking into /data/misc/keystore

# ls -la /data/misc/keystore -rw------- keystore keystore       84 2011-11-30 15:26 .masterkey -rw------- keystore keystore      980 2011-11-30 15:56 1000_CACERT_testca -rw------- keystore keystore      820 2011-11-30 15:55 1000_USRCERT_test -rw------- keystore keystore      932 2011-11-30 15:55 1000_USRPKEY_test 

Here each file call consists of the UID of the user that created it (1000 is system), the entry type (CA certificate, user certificate or somebody key), too the substitution call (alias) connected alongside underscores. And, of course, in that place is a .masterkey. Going dorsum to the keystore daemon source, nosotros uncovering out that:

• each substitution is encrypted alongside a 128-bit AES master copy substitution inwards CBC mode
• each substitution blob contains an information header, the initial vector (IV) used for encryption, an MD5 hash value of the encrypted information too the encrypted information itself
• the master copy substitution (in .masterkey) is itself encrypted alongside an AES key. The encryption substitution is derived from the password using the PBKDF2 key-derivation role alongside 8192 iterations (it may cause got a while...). The tabular array salt is randomly generated too is stored inwards the .masterkey file's information header.

What this agency inwards practise is that the Android substitution shop is pretty secure for a software solution: fifty-fifty if you lot had access to a rooted device too managed to extract the substitution blobs, you lot would withal withdraw the keystore password to derive the master copy key. Trying out unlike password to decrypt the master copy substitution would require at least 8192 iterations to derive a key, which is prohibitively expensive. In addition, the derivation role is seeded  with a 128-bit random number, too thus pre-calculated password tables cannot endure used.

Key blobs are owned past times the keystore user, too thus on a regular (not rooted) device, you lot withdraw to acquire through the daemon to access the keys. As it turns out, in that place is a helpful command trouble utility that talks to the daemon too lets us manipulate the substitution store: keystore_cli. It has commands for initializing the substitution store, listing, getting too deleting keys, etc. Experimenting alongside it shows that the keystore daemon is additionally checking the calling process's UID to grant or deny access to each command:

# keystore_cli unlock keystore_cli unlock vi Permission denied # keystore_cli acquire CACERT_testca keystore_cli acquire CACERT_testca 1 No mistake -----BEGIN CERTIFICATE----- MIICiTCCAfKgAwI...  # su organization su organization $ keystore_cli insert foo bar keystore_cli insert foo bar 1 No mistake $ keystore_cli saw "" keystore_cli saw "" 1 No mistake foo USRPKEY_test USRCERT_test CACERT_testca $ keystore_cli acquire foo keystore_cli acquire foo 1 No mistake bar $ overstep  # su app_44 su app_44 $ keystore_cli saw "" keystore_cli saw "" 1 No mistake $ keystore_cli insert baz boo keystore_cli insert baz boo 1 No mistake $ keystore_cli acquire baz keystore_cli acquire baz 1 No mistake boo 

This basically translates to:

• root cannot lock/unlock the substitution store, exactly tin give the axe access organization keys
• the system user tin give the axe create pretty much anything (initialize or reset the substitution store, etc.)
• regular users tin give the axe insert, delete too access keys, exactly tin give the axe alone come across their ain keys

The android.security.KeyStore cast nosotros industrial plant life piece browsing the framework's source is close a one-to-one port of the keystore_cli command's functionality to Java. By using it Java apps tin give the axe acquire straight access to the keystore daemon, exactly equally nosotros said, that cast is non part of Blue Planet API. There are a yoke of reasons for this:

• even if they had access to it, normal apps wouldn't cause got the needed permissions to initialize or unlock the substitution store
• it's interface exposes the electrical flow implementation: keys are returned equally raw blobs which wouldn't endure possible if the substitution shop too related cryptographic operations were implemented inwards hardware (such equally inwards a TPM).

As mentioned inwards the previous article, most of the described credential storage functionality has been available inwards Android since at to the lowest degree Donut (1.5), exactly the substitution shop was alone accessible to organization applications such equally Settings, too the WiFi too VPN clients. What ICS adds are a few layers on tiptop of this that move into possible to offering user applications access to the organization substitution shop too assert fine-grained command over what keys each app is allowed to use. In the side past times side part of the serial nosotros volition await at the implementation of the novel credential storage functionality added inwards ICS.

Tag : android security