>> All Android devices certified by Google will have a hardware security module which should keep the keys secure.
Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification.
On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).
"When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware and meet following requirements:
MUST have hardware backed implementations of RSA, AES, ECDSA and HMAC cryptographic algorithms and MD5, SHA1, SHA-2 Family hash functions to properly support the Android Keystore system's supported algorithms.
MUST perform the lock screen authentication in the secure hardware and only when successful allow the authentication-bound keys to be used. The upstream Android Open Source Project provides the Gatekeeper Hardware Abstraction Layer (HAL) that can be used to satisfy this requirement.
"
Source? I understood that having a HW-backed key store is still entirely optional for the purpose of Android certification.
On top of that, I noticed some ambiguity on whether a TEE like ARM TrustZone qualifies as a hardware-grade protection mechanism in the same way a discrete and dedicated crypto processor is (I think the two technologies provide very different assurance levels).