Broken TEE with e/Os 3.1 on FP6

ThatsWhatIMean · August 18, 2025, 1:23pm

Hi there ^^/.

With an FP6, have there been any cases of TEE problems after unlocking the bootloader?

I’m asking because the FranceIdentité app isn’t working, and thinking it was due to MicroG, I was told that it was probably due to a TEE malfunction.

Is there also a ‘simple’ way to fix this (with clear steps)?

github.com/microg/GmsCore

[fr.gouv.franceidentite] App don't launch (loop) and after, show an error

opened 02:03PM - 04 Aug 25 UTC

AnonAlly

**Affected app** Name: France Identite Package id: fr.gouv.franceidentite https:…//play.google.com/store/apps/details?id=fr.gouv.franceidentite&hl=fr **Describe the bug** A clear and concise description of what the bug is. **To Reproduce** Steps to reproduce the behavior: 1. Launch the app **Expected behavior** The app launch **System** Android Version: 15 Custom ROM: e/Os 3.1 **microG** microG Core version: [e.g. 0.2.13.203915] microG Self-Check results: [e.g. All ticked] **Additional context** ``` 2025-08-04 15:52:36.927 1195-1205 QC-time-services time_daemon E Daemon: Time-services: Waiting to acceptconnection 2025-08-04 15:52:36.959 904-904 KeymasterUtils and....security.keymint-service-qti E IKMHal_sendCmd failed with rsp_header->status: -49 2025-08-04 15:52:36.960 904-904 KeyMasterHalDevice and....security.keymint-service-qti E keymint_generate_key 2025-08-04 15:52:36.960 904-904 KeyMasterHalDevice and....security.keymint-service-qti E ret: -49 2025-08-04 15:52:36.961 976-9889 keystore2 keystore2 E system/security/keystore2/src/error.rs:183 - system/security/keystore2/src/security_level.rs:680 Caused by: 0: system/security/keystore2/src/security_level.rs:674: While generating without a provided attestation key and params: [KeyParameter { tag: r#KEY_SIZE, value: Integer(256) }, KeyParameter { tag: r#ALGORITHM, value: Algorithm(r#EC) }, KeyParameter { tag: r#EC_CURVE, value: EcCurve(r#P_256) }, KeyParameter { tag: r#PURPOSE, value: KeyPurpose(r#SIGN) }, KeyParameter { tag: r#DIGEST, value: Digest(r#SHA_2_256) }, KeyParameter { tag: r#NO_AUTH_REQUIRED, value: BoolValue(true) }, KeyParameter { tag: r#CERTIFICATE_NOT_AFTER, value: DateTime(2461449600000) }, KeyParameter { tag: r#CERTIFICATE_NOT_BEFORE, value: DateTime(0) }, KeyParameter { tag: r#CERTIFICATE_SERIAL, value: Blob([1]) }, KeyParameter { tag: r#CERTIFICATE_SUBJECT, value: Blob([48, 31, 49, 29, 48, 27, 6, 3, 85, 4, 3, 19, 20, 65, 110, 100, 114, 111, 105, 100, 32, 75, 101, 121, 115, 116, 111, 114, 101, 32, 75, 101, 121]) }, KeyParameter { tag: r#ATTESTATION_CHALLENGE, value: Blob([216, 212, 241, 255, 147, 131, 218, 103, 249, 250, 214, 51, 126, 84, 80, 24, 77, 238, 9, 43, 226, 86, 176, 42, 22, 148, 155, 244, 234, 4, 55, 118]) }, KeyParameter { tag: r#CREATION_DATETIME, value: DateTime(1754315556922) }, KeyParameter { tag: r#ATTESTATION_APPLICATION_ID, value: Blob([48, 69, 49, 31, 48, 29, 4, 22, 102, 114, 46, 103, 111, 117, 118, 46, 102, 114, 97, 110, 99, 101, 105, 100, 101, 110, 116, 105, 116, 101, 2, 3, 15, 201, 134, 49, 34, 4, 32, 106, 122, 32, 168, 125, 38, 144, 103, 5, 36, 223, 71, 147, 89, 149, 12, 223, 203, 233, 105, 134, 216, 38, 31, 94, 90, 18, 249, 254, 8, 117, 83]) }]. 1: Error::Km(r#SECURE_HW_COMMUNICATION_FAILED) ```

Pato · August 18, 2025, 2:17pm

I don’t know what is TEE, but I noticed there are issues with Play Integrity on the FP6. I’ve post about it there :

There is a fix for Revolut coming in 3.1 which seems to be linked to Play integrity issues, I hope it will be enough to make France Identité work on FP6. I hope it will be released this week
But if someone has more information about it, I’m interested as well.