Remote Key Provision Turns Back On After Reboot

[waichanrx]

Hello,

Currently, I am able to achieve Strong Integrity only after I turn off TEE-RKP only and StrongBox RKP only. Upon reboot, these settings are turned back on and needs to manually turned off again. Is this expected behavior?

Thank you for your time and efforts.

[JingMatrix]

@waichanrx Before making a design decision on this, I want to be very sure:

1. With all these toggle on, are you able to obtain Play Integrity ?
2. With only the Enable rkpd option off, are you able to obtain Play Integrity ?
3. If you failed in the step 2, how about doing it after a reboot ?

I intend to conclude that only the Enable rpkd option is important, which is already persistent.

@bocho8, I need your response as well.

[waichanrx]

@waichanrx Before making a design decision on this, I want to be very sure:

1. With all these toggle on, are you able to obtain Play Integrity ?
2. With only the Enable rkpd option off, are you able to obtain Play Integrity ?
3. If you failed in the step 2, how about doing it after a reboot ?

I intend to conclude that only the Enable rpkd option is important, which is already persistent.

@bocho8, I need your response as well.

1. With all three (TEE RKP-only, Strongbox RKP, Enable rkpd) turned on, my device has "No Integrity."

2. With only "Enable rpkd" turned off, I am also getting "No Integrity" as well.

3. After a reboot, I am still getting "No Integrity" in either configuration of settings. I can quickly re-achieve "Strong Integrity" by toggling all three options off.

[bocho8]

@waichanrx Before making a design decision on this, I want to be very sure:

1. With all these toggle on, are you able to obtain Play Integrity ?
2. With only the Enable rkpd option off, are you able to obtain Play Integrity ?
3. If you failed in the step 2, how about doing it after a reboot ?

I intend to conclude that only the Enable rpkd option is important, which is already persistent.

@bocho8, I need your response as well.

Hey, sorry for the delay.

1. No, I get no integrity.
2. No.
3. No.

For me atleast I get Integrity when I have TEE Rkp-only off and Enable rkpd off. Toggling (on or off) StrongBox RKP-only doesn't seem to affect my integrity.

Edit: Forgot to mention, with ONLY Enable rkpd on I get integrity.

Edit 2: Althought I get strong integrity on play store my apps don't work when having only Enabled rkpd enabled. They only work with everything turned off.

[JingMatrix]

@waichanrx @bocho8 A build with the reboot-persistence fix (#270) is here — https://github.com/JingMatrix/TEESimulator/actions/runs/32499718146 (sign in to GitHub, grab the Debug/Release artifact at the bottom) — please just confirm that a "TEE RKP-only off" toggle stays off after a reboot without you touching it.

[bocho8]

@waichanrx @bocho8 A build with the reboot-persistence fix (#270) is here — https://github.com/JingMatrix/TEESimulator/actions/runs/32499718146 (sign in to GitHub, grab the Debug/Release artifact at the bottom) — please just confirm that a "TEE RKP-only off" toggle stays off after a reboot without you touching it.

Its working perfectly, thanks!

[waichanrx]

@JingMatrix I am confirming that all three settings stay off after rebooting.

[FroggMaster]

Apologies, looks like I should have searched the issue list a little harder. I'll flash the CI build you linked here and give it a go. :)
Thank you, much appreciated for all the development work you've put in.

Edit:
My testing also confirms that the toggles remain off upon reboot with this new build. Thanks again. :)

[KoljaFrahm]

I have the same problem that I only get integrety with all three off.

[waichanrx]

@JingMatrix The issue has returned with TEESimulator-v4.0-68-931e63. Remote Key Provision is turning back on with reboot.

[JingMatrix]

@waichanrx yes, because the PR solving the issue is not merged yet.

Will merge soon.

[rossiscool123]

@JingMatrix Any update on when this PR will be merged into a release or which release doesn't have this issue since having TEE RKP-only and Strongbox RKP-only enabled on device boot breaks attestation and I need to clear the data of certain apps before they'll validate a valid form of attestation. Quite annoying. 😅