// Research series
Key Containers on Mobile Devices
A verifiability-first guide to mobile key custody across software, TEE, StrongBox and Secure Enclave environments.
3-part series · Read in order
// Reading path
From first question to final consequence.
- Part 1What “hardware-backed” means on Android.Android exposes software, TEE-backed and StrongBox-backed keys through one keystore API. The effective security level, mandated algorithm set and available attestation evidence vary by device and release.
- Part 2The certificate has two lists.Android key attestation records a key's security level and separates authorizations enforced by hardware from those enforced by software. A verifier must validate the certificate chain, revocation status, boot state and the…
- Part 3Seven containers, ranked by what you can prove.Mobile key containers form a degradation ladder ordered by what an issuer can prove, not only by resistance to attack. Below the policy cut line, fallback changes the custody model or prevents…
The certificate has two lists.
Type: Primer Category: Research — Keys & Secure Hardware Series: Key containers on mobile devices, part 2 of 3 Reading time: ~9 min Android key attestation is the only widely available way to prove to a remote party where a key lives — provided the verifier reads...