As noted in the article I reversed the protocol for a related Goodix device (which was on Intel so used actual SGX instead of the white-box): I used the firmware update system to insert additional vulnerabilities in the sensor firmware and extract the PSK from that side.
Damn, I always thought that the fingerprint data was encoded somehow and never left the sensor hardware itself! OS-level access to the imagery seems like a security risk, but also opens some interesting possibilities for alternative uses.
AFAIK many phones store the fingerprints on-chip. I haven't looked too deeply into it, though, so it's possible there's a brand out there that streams fingerprint information as a video.
On Android, there are different levels of biometrics: https://source.android.com/docs/security/features/biometric If your fingerprint scanner reports Class 3/STRONG, hardware key stores are a requirement. Anything Class 2/WEAK or higher is supposed to make sure a kernel compromise cannot leak keys/authenticate to the OS. If it's Class 1/CONVENIENCE, simply running the biometrics in the trusted execution environment (think "secure VM acting as TPM") is also permitted.
On iOS the TPM/secure element deals with credentials, they're not submitted to the CPU.
Can you please post a link to high quality images of your own fingerprints? It should be fine, probably nobody has the technology to make them show up on a threatening letter mailed to the government, or anything like that.
Of course I won't, but then again I would send you pictures of any other body parts the same.
If someone gets a hand on anything you touched, they have your fingerprint. Last time you traveled to another country - did you have to give them fingerprints? Is the software running your phone closed source? Could you ambush me at night near my house and forcefully take them?
All I am saying is they are so weak as a secret that rhey should not be regarded as one.
I did a talk about it here: https://www.youtube.com/watch?v=IyjUY-xvFw4
IIRC, none of them do it particularly securely.
On Android, there are different levels of biometrics: https://source.android.com/docs/security/features/biometric If your fingerprint scanner reports Class 3/STRONG, hardware key stores are a requirement. Anything Class 2/WEAK or higher is supposed to make sure a kernel compromise cannot leak keys/authenticate to the OS. If it's Class 1/CONVENIENCE, simply running the biometrics in the trusted execution environment (think "secure VM acting as TPM") is also permitted.
On iOS the TPM/secure element deals with credentials, they're not submitted to the CPU.
If someone gets a hand on anything you touched, they have your fingerprint. Last time you traveled to another country - did you have to give them fingerprints? Is the software running your phone closed source? Could you ambush me at night near my house and forcefully take them?
All I am saying is they are so weak as a secret that rhey should not be regarded as one.
Most recently did some work on BitLocker: https://news.ycombinator.com/item?id=42747877
Wow, i expect them using hardcoded PSK, with PSK is flashed in factory.
That's cool the raw data image GIMP
EDIT: You have the code in the repo. https://github.com/tlambertz/goodix-fingerprint-reversing/bl...