To provide the Android hardware-backed keystore [1]

If it's present, this is used by apps like 'Google Authenticator' and 'Symantec Vip access' to store credentials in such a way that they can't be copied off the device or backed up.

When this technology works perfectly, the idea is if you have a short passcode and someone steals your phone, they can't extract the encrypted data and brute-force the passcode without an electron microscope and a team of engineers.

Unfortunately, it can also be used for user-hostile applications like providing DRM and preventing backups and rooting.

[1] https://source.android.com/security/keystore/

This is not used by Google Authenticator. GA just keeps the parameters in an sqlite database. It doesn't do much to protect them.

Do you have a link documenting that Google Authenticator (or Symantec) uses it?

I'm reasonably certain about Symantec Vip Access, because I've decompiled it (download apk 3.1.3 -> dex2jar -> jd-gui). Class named ṝ method named ˎ make calls that look like calls to the android key store. Hard to be 100% certain because the code is obfuscated though.

I was wrong about Google Authenticator. I assumed it was the same as Symantec because of all the people online complaining about being unable to back up their credentials.

DRM for example, see this older post where a bug in Qualcomm's DRM software enabled full system compromise: http://bits-please.blogspot.com/2016/05/qsee-privilege-escal...

it's used for stuff like trusted firmware, and easily leads to devices being bricked

Source?

He's a troll.

iPhones don't use it. They don't use Qualcomm SOC's.

Note that TrustZone is not a Qualcomm technology, but rather an ARM technology. Apple could have gone with TrustZone in their SOC.

(But yes, he is a troll and this whole case has nothing to do with Apple).

Nit: TrustZone isn't a Qualcomm technology, but KeyMaster is Qualcomm software built on top of it (and that appears to be where this break lies).

>iPhones

nah

http://www.apple.com/business/docs/iOS_Security_Guide.pdf page 7.

Despite widespread rumour to the contrary, the secure enclave on iPhones is a separate core, not just TrustZone on the main CPU.