Page 15 - FIGI: Security analysis of the KaiOS feature phone platform for DFS applications Security, Infrastructure and Trust Working Group

R 8� The handset operating system should be of solutions that use strong public key cryptogra-
configured in a way to reduce the size of the trusted phy and end-to-end security�
computing base�
JavaScript applications in KaiOS can be built with
The approach of having a monolithic browser act- strong public key cryptography. For example, all
ing almost like an operating system and running messages that are exchanged with a server can
all applications does not reduce the size of the be signed cryptographically and verified by their
trusted computing base. recipient. This prevents any manipulation of mes-
sages in transit, even by the network operator. It
R 9� Consider transitioning away from mobile would be even more secure if the keys could be
applications that leverage SMS and USSD in favour protected by a secure hardware element.

6 CONCLUSIONS

The goal of KaiOS is to provide useful features on Another security issue related to cost optimisation
an affordable hardware. To be affordable, the hard- is the lack of effort spent to fix security issues in
ware has fewer features as compared, for example, phones that are already on the market. There is hope
to modern smart phones. Security-wise, the biggest that lessons will be learned from the first generations
lack is the absence of a secure element on the phone of KaiOS phones and the new phones will have fewer
that would protect keys and secrets in hardware. The issues.
platform is still quite recent, and the missing secure In the current state, KaiOS phones could be a valid
element might become available on newer devic- platform for low risk DFS that are controlled by the
es. Risk being related to impact, the current KaiOS mobile network operator (MNO), as they can lever-
phones could already be considered safe enough age the security of the SIM card. With a few improve-
for transactions of small amounts. For instance, the ments on the hardware, newer feature phones could
same type of reasoning has been applied to contact- be almost as secure as smart phones for running DFS
less cards, where small transaction can be done with- applications.
out any pin code.

Security analysis of the KaiOS feature phone platform for DFS applications 13