hesela.devRollback protection
Rollback protection rejects protected state older than an enforced version or freshness boundary using trusted state that cannot be rolled back with the protected object.
Android Verified Boot's locked-state policy compares image rollback indexes with protected stored minimums and accepts equality; index checking is not required in the unlocked state. This boot policy does not establish freshness for arbitrary mutable user data. [1] [3] Hesela's architectural inference: an older image sharing an accepted index is not rejected by that comparison alone, and an expected version inside the same restorable snapshot is not an independent freshness reference. Authorized restore needs an explicit policy. [2] Each relevant index location must pass separately; a higher index elsewhere does not compensate for a lower one. For Android-style A/B fallback, the documented update policy advances stored indexes only from a slot marked successful. [3]
Relations
- related
- replay-attack, authenticated-encryption, dm-verity, dm-integrity