Re: [PATCH 4/4] doc: android: document the AVB root key source
Mattijs Korpershoek <[email protected]>
| Newsgroups | gmane.comp.boot-loaders.u-boot |
|---|---|
| Message-ID | <[email protected]> |
Hi Igor, Thank you for the patch. On Mon, Jul 27, 2026 at 19:14, Igor Opaniuk <[email protected]> wrote: > The root-key choice carries security pitfalls that are not obvious from the > Kconfig prompts alone: the built-in key is only a test key, a digest stored > as a TEE persistent value is worthless unless the TA refuses to overwrite > it while the device is unlocked, and the board provider must fail closed. > Spell these out so an integrator does not ship an insecure default by > accident. > > Signed-off-by: Igor Opaniuk <[email protected]> Reviewed-by: Mattijs Korpershoek <[email protected]> > ---