GrapheneOS protections against data extraction from locked devices

The secure element rate limiting is integrated in a way that can only add security. It can't reduce the security of key derivation since it's only used to get an extra input for deriving the key. There are various other inputs in addition to the PIN/password too to add various security properties. The most relevant one is the token obtained from the secure element rate limiting system via successful authentication, but there are others.

The secure element comes from the same company making the main processor for both the upcoming Motorola devices (Qualcomm) and Pixels (Google). Why would they put a backdoor in the isolated secure element rather than the CPU? The backdoor argument can be made about any hardware.

A key is derived from the PIN or password and used for multiple purposes by using separate statically keyed hashes. One of those purposes is obtaining a token from the secure element to implement rate limiting and extremely reliable erasure of all the encrypted data for the profile. It's also passed alongside the obtained token into the final key derivation process. Why would you want to remove the secure element integration? That would mean losing the rate limiting with no benefit and solely relying on erasing key derivation material stored on the SSD for wiping data. That would still work due to hardware support for it but the SSD isn't nearly as reliable as the secure element and can be copied at a hardware level before trying any PIN/password.

We want more secure element features including duress PIN/password support as part of the rate limiting.

Reliable deletion of data depends on wiping keys with hardware support. Android has per-profile keys meaning separate keys for each user and Private Space. It can reliably erase all of the data or specific profiles. It's important to reboot the device to wipe the RAM to get rid of leftover traces after wiping a profile or the whole device. Deleting a single profile may seem like a good approach but there's metadata outside the profile for it to function and it will be obvious it existed. It will be obvious it was deleted and when that happened. It isn't a system designed for secretly deleting a profile. A bunch of filesystem and OS data/metadata will be left showing it existed. Reliable deletion of the data within the profile does exist but not hiding that the profile itself existed and was deleted.

Many files will have been copied around and modified leaving traces of those around on the SSD. It's possible to ask the SSD to securely erase a span of data but it's far too late to do that after using files in regular ways for a long time. The data would often be recoverable. It would also be obvious that it happened based on lots of metadata showing those apps were clearly installed. Lack of metadata and statistics which should be there is evidence too.

It's possible to make a feature with which runs in reserved storage space where every encryption passphrase is valid and produces garbage output if the feature wasn't set up or the passphrase isn't correct. That's definitely possible. It's only realistic to make it work properly with a VM and the space for this would need to be reserved for everyone by default with the option to remove it to free it for other uses to make it properly deniable. It's still likely possible to prove it's being used via low-level analysis of the SSD.

Deniable encryption has gotten way more advanced than this, though - the state-of-the-art is to have a bunch of independently unlockable data stores along with a mechanism to add chaff data that doesn't decrypt with any key. That's how bunnie's Betrusted project works, and it's the same idea as PhonebookFS from yesterdecade.

The main problem with any deniable encryption system is that while your adversary might not be able to prove if you gave them the decoy or real data, they can at least force you to wipe anything you fail to decrypt. In your partitioning scheme, that would mean wiping any partition that doesn't decrypt with the set of PINs you gave them. In the more advanced granular scheme that Betrusted devices use, that would mean border control unlocking all the basis keys you dared to give them, and then them running the storage reclaim tool that wipes all other keys.

In either case, it would probably be easier (and less suspicious!) to pre-wipe your device and then redownload a backup after you pass through border control... assuming you can get access to an untampered Internet connection after the fact, AND assuming your backup is actually complete. Like, I'm pretty sure most apps exclude their login tokens from backup, because every time I do wind up restoring a backup, I have to log into everything again, which makes me wonder what the point of the backup even is?

Going into detail about how it works: great.

Saying it's "italics-not wiped": bad.

> I'm surprised they didn't back up the device first.

There's no use in taking an image of the SSD and restoring it after a wipe. Data needed to derive the key encryption keys was wiped from the secure element. Separately from that, there's also additional data on the SSD needed to derive the key encryption keys which the TEE hardware will no longer consider valid.

Entering the duress PIN/password does the following:

* wipes TEE hardware keystore * wipes secure element hardware keystore * wipes the secure element other than Factory Reset Protection data which isn't used by GrapheneOS at this time * wipes the encryption metadata on the SSD with special wiping commands

The secure element data is inside the secure element's internal storage. TEE keystore keys are normally stored encrypted on the SSD with a hardware-based anti-rollback storage system to prevent reusing deleted keys. The secure element keystore is a lot more secure.

The most important data that's wiped is the Weaver table on the secure element. Weaver is the secure element rate limiting feature we describe in our post. It's implemented by the OS passing a dedicated hash of the initial key derived from the user's PIN/password. If it's the valid hash, the secure element provides a token needed alongside the initial derived key for the final key derivation. If it's not valid, it's a failed attempt wasting one of 20 attempts and triggering a hardware enforced delay.

It also isn't possible to simply image the SSD and then try to brute force the PIN/password due to the secure element rate limiting and the final key derivation done in the TEE.

It isn't the same as a typical disk encryption approach on a desktop, although GrapheneOS supports using a strong passphrase to avoid depending on the secure element rate limiting. GrapheneOS makes it convenient to use one via 2-factor fingerprint+PIN secondary unlock in After First Unlock state. It's the same as regular fingerprint unlock but with a PIN needed to complete it where incorrect ones count towards the limit of 5 attempts (reduced from 20 by GrapheneOS).