Chris Palmer wrote:
All is fine and well if the application is provisioning its own data
(keys in my case). But that doesn't scale well so there will be a
common key-provisioning facility which is a part of the mobile platform.
Applications provisioning their own data doesn't scale well? It's been
going ok so far...
In the scheme I play with the browser is the key provisioning tool
but the keys may be used by other apps like VPNs.
Now the trick is to make it possible to "mark" keys during provisioning
so that they can only be used by certain applications.
Android has a mechanism for doing this: permissions and signatures. A
key storage Service could store keys for apps, and then (as an example
of just one possible policy) serve the key out to any client
application signed with the same signing certificate as the app that
originally stored the key.
That's a possibility but it is not particularly universal.
Alternately, as an example of another
possible policy, it could require that clients have been granted some
particular permission.
I want the *key* to hold the permission (ACL kind of), not the applications.
Still, one would have to ask, what exact real-world problem are you
trying to solve? I've never, in several years, heard you state a
specific problem that you are faced with that can only be solved
through some brand new mechanism that still eludes our grasp...
The bank wants to deposit a key for on-line banking or payments.
They want to be sure that in a non-broken/non-rooted system the
key is only usable by application(s) they have granted (but not
necessarily written). This is a legitimate requirement for enterprise
keys as well.
The alternative is to lock down the entire device and that is IMO
not a very attractive position.
Anders
--
You received this message because you are subscribed to the Google Groups "Android
Security Discussions" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/android-security-discuss?hl=en.
