This repository contains code and documentation related to the paper:
"SARA: Secure Android Remote Authorization"
Abdullah Imran, Habiba Farrukh, Muhammad Ibrahim, Z. Berkay Celik, and Antonio Bianchi
published at the Usenix Security Symposium, 2022.
The code is released as an Android library that can be integrated in any existing Android app.
The documentation is available in this PDF file.
ProVerif code is available in this folder.
The original paper is available here.
After the publication of this paper, we were notified by Prof. XiangHang Mi from University of Science and Technology of China that our original implementation could potentially be bypassed by a root attacker.
As a countermeasure, we updated the code to use the setUserAuthenticationParameters API, available in modern Android devices, as explained in the original paper in Section 4.4.