Starting March 27, 2025, we recommend using android-latest-release instead of aosp-main to build and contribute to AOSP. For more information, see Changes to AOSP.
Verified Boot
Stay organized with collections
Save and categorize content based on your preferences.
Verified Boot strives to ensure all executed code comes from a trusted source
(usually device OEMs), rather than from an attacker or corruption. It
establishes a full chain of trust, starting from a hardware-protected root of
trust to the bootloader, to the boot partition and other verified partitions
including system, vendor, and optionally
oem partitions. During device boot up, each stage verifies the
integrity and authenticity of the next stage before handing over execution.
In addition to ensuring that devices are running a safe version of Android,
Verified Boot checks for the correct version of Android with
rollback
protection. Rollback protection helps to prevent a possible
exploit from becoming persistent by ensuring devices only update to newer
versions of Android.
In addition to verifying the OS, Verified Boot also allows Android devices to
communicate their state of integrity to the user.
Background
Android 4.4 added support for Verified Boot and the
dm-verity kernel feature. This
combination of verifying features served as Verified Boot 1.
Where previous versions of Android warned users about device corruption, but
still allowed them to boot their devices, Android 7.0 started strictly enforcing
Verified Boot to prevent compromised devices from booting. Android 7.0 also
added support for forward error correction to improve reliability against
non-malicious data corruption.
Android 8.0 and higher includes
Android Verified Boot (AVB), a
reference implementation of Verified Boot that works with Project Treble. In
addition to working with Treble, AVB standardized partition footer format and
added rollback protection features.
Content and code samples on this page are subject to the licenses described in the Content License. Java and OpenJDK are trademarks or registered trademarks of Oracle and/or its affiliates.
Last updated 2024-08-26 UTC.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-08-26 UTC."],[],[],null,["# Verified Boot strives to ensure all executed code comes from a trusted source\n(usually device OEMs), rather than from an attacker or corruption. It\nestablishes a full chain of trust, starting from a hardware-protected root of\ntrust to the bootloader, to the boot partition and other verified partitions\nincluding `system`, `vendor`, and optionally\n`oem` partitions. During device boot up, each stage verifies the\nintegrity and authenticity of the next stage before handing over execution.\n\n\nIn addition to ensuring that devices are running a safe version of Android,\nVerified Boot checks for the correct version of Android with\n[rollback\nprotection](/docs/security/features/verifiedboot/verified-boot#rollback-protection). Rollback protection helps to prevent a possible\nexploit from becoming persistent by ensuring devices only update to newer\nversions of Android.\n\n\nIn addition to verifying the OS, Verified Boot also allows Android devices to\ncommunicate their state of integrity to the user.\n\nBackground\n----------\n\n\nAndroid 4.4 added support for Verified Boot and the\n[dm-verity](/docs/security/features/verifiedboot/dm-verity) kernel feature. This\ncombination of verifying features served as Verified Boot 1.\n\n\nWhere previous versions of Android warned users about device corruption, but\nstill allowed them to boot their devices, Android 7.0 started strictly enforcing\nVerified Boot to prevent compromised devices from booting. Android 7.0 also\nadded support for forward error correction to improve reliability against\nnon-malicious data corruption.\n\n\nAndroid 8.0 and higher includes\n[Android Verified Boot](/docs/security/features/verifiedboot/avb) (AVB), a\nreference implementation of Verified Boot that works with Project Treble. In\naddition to working with Treble, AVB standardized partition footer format and\nadded rollback protection features."]]
