TEE Proxy

[1vivy]

There's some recent exploits that let us have root with a locked bootloader. So TEE is happy, no keyboxes are swapped and hardware attestation doesn't fail.

But, those are exploits that will be patched quickly. And it will be hard to do OTAs unless you keep your phone on an old version.

Is it possible to proxy all TEE operations from a good device to another?

It probably makes it easier than finding leaked keyboxes, or pitifully extracting your own.

Instead you have an old device you keep on 24/7 .

[xingkong123600]

Good idea, I've thought about it before too, but I didn't know how to make it happen.

[1vivy]

There already seems to be an proof of concept for this idea

https://github.com/vocolboy/RemoteKeyAttestation

https://xdaforums.com/t/tricky-store-bootloader-keybox-spoofing.4683446/page-423#post-90511378

[JingMatrix]

Yes, that is what we are working on to defeat RKP.