Skip to main content


This section describes the security requirements for the device.

Android Verified Boot

Verified Boot is the process of verifying the integrity of the Android operating system. It typically starts with a read-only portion of the device firmware which loads code and executes it only if the integrity of the device is verified.

Integrating with Buildsystem

Refer to Android Verified Boot 2.0 Build System Integration for details on how to integrate verified boot into your build system.

Before getting started, Our private keys are available in private_keys repository. Clone the repository to vendor/hentai/build/target/product/security.

AVB is enabled with BOARD_AVB_ENABLE variable.


By default, the algorithm SHA256_RSA4096 is used with keys from vendor/hentai/build/target/product/security directory.

BOARD_AVB_KEY_PATH := $(PROD_CERTS)/hentai_rsa4096.pem

Devices with vbmeta partitions should configured to use chained partitions:

BOARD_AVB_VBMETA_SYSTEM := system system_ext

To prevent rollback attacks, the rollback index location should be set to a value greater than 0 and increased on a regular basis (we sets our index as our Security Patch timestamp). The rollback index can be set with the BOARD_AVB_VBMETA_ROLLBACK_INDEX variable:


Some devices support the end-user configuring the root of trust to use, in this case, see End-User Root of Trust Configuration for details.

End-User Root of Trust Configuration

This section describes the end-user configuration of the root of trust.

Normal Devices

On sane devices, the boot loader supports a virtual partition with the name avb_custom_key. Flashing and erasing this partition only works in the UNLOCKED state. Setting the custom key is done like this:

avbtool extract_public_key --key key.pem --output pkmd.bin
fastboot flash avb_custom_key pkmd.bin

Erasing the key is done by erasing the virtual partition:

fastboot erase avb_custom_key

When the custom key is set and the device is in the LOCKED state it will boot images signed with both the built-in key as well as the custom key. All other security features (including rollback-protection) are in effect, e.g. the only difference is the root of trust to use.

When booting an image signed with a custom key, a yellow screen will be shown as part of the boot process to remind the user that the custom key is in use.