nLabs is the research practice at Neodata, in Montevideo, Uruguay. Corrections and questions: nlabs@neodata.com.uy
Mobile key containers form a degradation ladder ordered by what an issuer can prove, not only by resistance to attack. Below the policy cut line, fallback changes the custody model or prevents issuance rather than producing a weaker form of the same credential.
Android key attestation records a key’s security level and separates authorizations enforced by hardware from those enforced by software. A verifier must validate the certificate chain, revocation status, boot state and the specific list containing every relied-upon constraint.
Android exposes software, TEE-backed and StrongBox-backed keys through one keystore API. The effective security level, mandated algorithm set and available attestation evidence vary by device and release.