Gernot Heiser

microkerneldude.bsky.social

06 April 2025 16:33

Giving a joint keynote at ASPLOS+EuroSys was an honour but also 😁 After all, I was talking about LionsOS

GrapheneOS

grapheneos.org

10 March 2025 14:53

There's a traditional hardware keystore implemented via TrustZone but decent devices Pixels or flagship Snapdragon devices have another higher latency keystore implemented via a secure element. Biometrics, etc. have gradually moved to the secure element on Pixels. TrustZone is for when perf matters.

Gernot Heiser

microkerneldude.bsky.social

10 March 2025 14:53

It’s got picked up by the Register: www.theregister.com/2025/03/08/k...

GrapheneOS

grapheneos.org

09 March 2025 13:54

Not related to the the main purpose of the article, but Android Verified Boot isn't based on TrustZone and authentication/encryption is only partly based on it. Pixels use a secure element on a separate chip paired with a secure core on the SoC for storing boot state and encryption throttling.

Gernot Heiser

microkerneldude.bsky.social

03 March 2025 00:00

Thanks Alex Mason for posting this interesting article on LinkedIn: randomaugustine.medium.com/on-apple-exc... While not all seems to be correct, it contains a lot of stuff I didn’t know, thanks Random Augustine for the in-depth analysis!