Cryptographic ID0.5.7

Cryptographic ID lets you attest a phone’s trustworthiness by producing cryptographic signatures tied to an asymmetric key. It generates and uses key pairs to check device state, prove control of a private key, and let other parties validate signatures with the matching public key. This supports checking a phone, assessing a computer’s trusted state, or confirming that a person controls a key whose public counterpart was provided beforehand through a secure channel.

On a phone considered trustworthy, the software can create a private key and later sign a message; a correct signature can indicate that the signing phone is the one originally associated with that key. The verification key can be shared openly, while the private key supplies proof of possession. Because the operating system can access the phone’s private key, this protection is weaker than storing a key in a TPM2 and is limited by the phone’s own security.

A related Linux scenario keeps the private key inside the computer’s TPM2 and seals it to the machine’s current PCR state. Tying the key to PCR7 and the Secure Boot state, for example, can prevent signing after the computer starts an operating system signed by another vendor. The Linux implementation for this scenario uses cryptographic-id-rs and applies asymmetric signatures to computer trust verification.

As open-source Security & Privacy software for Android, Cryptographic ID suits people validating device identity or key possession through signed messages. It requires version 7.0 or later and supports arm64-v8a, armeabi-v7a, and x86_64 architectures. The current version is 0.5.7.