For the complete documentation index, see llms.txt. You can also append .md to any page URL to get its markdown version.
Skip to main content
For the complete documentation index, see llms.txt.

For the complete documentation index, see llms.txt

How it works

Hardware-protected keys are stored in hardware, typically in a trusted execution environment (TEE) or on a trusted platform module (TPM), and will never leave it. As a result, all operations that require the private key are performed in the secure hardware on the device.

Even rooted devices safeguard hardware-protected keys from extraction, as these keys cannot be cloned.

Activation​

The usual flow for activation of a hardware-protected key is as follows:

  1. The MobileID client SDK generates a key pair in the secure hardware.
  2. The secure hardware returns the public hardware-protected key to the MobileID client SDK.
  3. The MobileID client SDK returns this key to the MobileID server over the secure channel in the finish activation request.
  4. The MobileID server stores the public hardware-protected key on the registration, and this key will be used to verify all future authentications.

Sequence diagram showing flow for activation of hardware-protected keys

Authentication​

For devices activated with hardware-protected keys, an additional security check is conducted during every authentication. The MobileID server is used to validate the hardware signature.

The usual flow for authentication with hardware-protected keys is as follows:

  1. The MobileID client SDK will sign the authentication challenge, received from the MobileID server in the start authentication request, with the hardware-protected private key.
  2. The signed challenge is passed back to the MobileID server in the finish authentication request over the secure channel.
  3. The signed challenge is verified server-side with the hardware-protected public key.

Sequence diagram showing flow for validation during an authentication

Supported devices​

Hardware-protected keys are supported on the following devices:

  • Android 6 (most devices)
  • Android 7 or later (all devices)
  • iOS 10 or later (devices with Secure Enclave)
Note

Devices that do not support hardware-protected keys will only use software keys.

On this page