Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore

Résumé

We analyze the security of Android KeyStore, a system service whose purpose is to shield users credentials and cryptographic keys. The KeyStore protects the integrity and the confidentiality of keys by using a particular encryption scheme. Our main results are twofold. First, we formally prove that the used encryption scheme does not provide integrity, which means that an attacker is able to undetectably modify the stored keys. Second, we exploit this flaw to de ne a forgery attack breaching the security guaranteed by the KeyStore. In particular, our attack allows a malicious application to make mobile apps to unwittingly perform secure protocols using weak keys. The threat is concrete: the attacker goes undetected while compromising the security of users. Our findings highlight an important fact: intuition often goes wrong when security is concerned. Unfortunately, system designers still tend to choose cryptographic schemes not for their proved security but for their apparent simplicity. We show, once again, that this is not a good choice, since it usually results in severe consequences for the whole underlying system.
Fichier principal
Vignette du fichier
2016_esorics_breaking_into_the_keystore.pdf (478.71 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-01432695 , version 1 (28-04-2021)

Identifiants

Citer

Mohamed Sabt, Jacques Traoré. Breaking Into the KeyStore: A Practical Forgery Attack Against Android KeyStore. ESORICS 2016, Sep 2016, Heraklion, Greece. ⟨10.1007/978-3-319-45741-3_27⟩. ⟨hal-01432695⟩
376 Consultations
1062 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More