Hardware-backed key custody
Status: Shipped (2026-09-24)
Public summary: Sealed privacy hardening summary
What this is
Identity secrets (12-word mnemonic, master key, private key, vault/backup recovery keys) are AES-256-GCM wrapped before they are stored in platform secure storage.
| Platform | Wrap key | Preference |
|---|---|---|
| Android | Android Keystore AES | StrongBox when available, else TEE |
| iOS | Keychain AES (WhenUnlockedThisDeviceOnly, non-synchronizable) |
Protected by the device Secure Enclave unlock hierarchy on SE devices |
Wire format: HW1. + base64(nonce ‖ ciphertext ‖ tag). Legacy installs migrate once on cold start.
What this is not
- Protocol secp256k1 ECDH/ECDSA still runs in the app (software).
- Do not read this as “Secure Enclave signs every message” or “StrongBox ECDH.”
Lock Database
- New custom app lock → Lock Database on by default (SQLCipher key wrapped with the app lock).
- Existing users with a custom lock and Lock Database off see a one-time recommend sheet.