From 258a65ba59fcc22c6bdefac7ae8583c338cfaa37 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 17 Mar 2026 19:56:45 +0100 Subject: [PATCH] docs(release): add v4.8 changelog for StrongBox hardening and LRU pruning --- module/changelog.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/module/changelog.md b/module/changelog.md index d2e9492..9b10e67 100644 --- a/module/changelog.md +++ b/module/changelog.md @@ -1,3 +1,17 @@ +## TEESimulator-RS v4.8: StrongBox Hardening & LRU Pruning + +Tested against DuckDetector on OnePlus (Android 16, KSU). Tamper score dropped from 32 to 8. + +- **LRU operation pruning** — Concurrent software operations capped at 15 per UID (TEE) and 4 per UID (StrongBox), with oldest-first eviction. Pruned operations return `INVALID_OPERATION_HANDLE (-28)`, matching AOSP keystore2 malus-based pruning. +- **StrongBox param guard** — Unsupported StrongBox params (RSA >2048-bit, non-P256 EC curves) forwarded to real HAL for proper rejection instead of generating in software. +- **StrongBox timing** — Key generation floors at 250ms, signing at 80ms on StrongBox security level to match real secure element latency. +- **StrongBox op limit** — Sliding-window enforcer caps concurrent StrongBox operations for both software and hardware key paths, returning `TOO_MANY_OPERATIONS (-29)` when exceeded. +- **ECDSA algorithm alias** — Accept "ECDSA" in addition to "EC" as JCA private key algorithm name. Fixes SIGSEGV crash on Android 10 devices where the provider reports EC keys as "ECDSA". Closes #4. +- **createOperation domain handling** — Software-generated keys now found via both `Domain.APP` (alias) and `Domain.KEY_ID` (nspace) lookup paths. +- **Permission guards** — Device ID attestation tags (IMEI, MEID, serial) require caller permission checks. + +--- + ## TEESimulator-RS v4.7: Operation & Attestation Fixes Tested against [KeyDetector](https://github.com/XiaoTong6666/KeyDetector) and [Key Attestation](https://github.com/nickel-lang/nickel) on OnePlus (Android 16) and Xiaomi Redmi 14C (Android 14).