StrongBox availability can affect device coverage. Assess a requirement for a stronger key boundary alongside legitimate users' ability to access the service.
Evaluation approach
Key-generation options relate to security level, algorithm and usage requirements. Define an explicit path when the device lacks support or cannot satisfy the requested operation.
Application example
An application that prefers StrongBox for high-value signing must not silently imply equivalent assurance on an unsupported device.
Limits and considerations
Stronger key protection does not independently prove that the transaction content approved by the user is correct.
Do not assume hardware support
StrongBox use depends on support for the selected device, algorithm and parameters. State what happens on unsupported devices in the product requirements. Quietly switching to a different assurance level can invalidate the server's acceptance assumptions.
A test report should cover the resulting key's expected properties, not just a successful API call. Measure hardware-backed operation latency and its interaction with user authentication in the same device cohort. Assess the security choice alongside accessibility and device coverage.
Checks and decisions
- Measure device support
- Document fallback policy
- Test operation latency
An alternative for unsupported devices must not become a silent security downgrade.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.