Crate tenzro_device_key 

Hardware-backed device keys for Tenzro.

A device key is a non-extractable P-256 keypair living in the platform’s hardware-rooted secure element. On macOS/iOS that is the Secure Enclave (via security-framework + kSecAttrTokenIDSecureEnclave), gated by Touch ID / Face ID. The private key never enters process memory.

Two capabilities:

1. Signing (DeviceKey::sign_prehash) — sign a 32-byte digest; the OS triggers the user-presence ceremony.
2. Secret wrapping ([wrap_secret] / [unwrap_secret]) — ECIES-encrypt an arbitrary secret to the device public key (no biometrics), and decrypt it with the private key (biometrics). The decrypt output is STABLE across calls, which makes this the right primitive for deriving a persistent keystore password — see SecureEnclaveUnlocker.

Where the key is persisted

The Secure-Enclave key is persisted in the legacy file-based (login) keychain via Location::DefaultFileKeychain, which sets kSecAttrIsPermanent=true without the kSecUseDataProtectionKeychain attribute. Only the data-protection keychain requires a keychain-access-groups entitlement backed by a provisioning profile; the file keychain does not, so a plain Developer-ID build can persist the key and re-open() it by label across process restarts. Touch ID / Face ID still gates every signing operation via the key’s SecAccessControl, and AMFI does not SIGKILL the app. See Apple TN3137 (“On Mac keychains”).

Cross-restart persistence of a secret therefore works: SecureEnclaveUnlocker creates the key once, wraps the keystore password to its public key, and a later run reopens the key by label to unwrap the on-disk ciphertext. The live SecKey handle is additionally cached in-process to avoid repeated keychain queries within a run; in the rare context where file-keychain persistence fails, create() falls back to a non-persistent session key that still supports same-session create→sign→wrap/unwrap.

Re-exports

pub use pq_companion::PqCompanion;

Modules

pq_companion

PqCompanion — an ML-DSA-65 post-quantum signing key that rides alongside the Secure Enclave P-256 passkey.

Structs

Attestation

Hardware attestation evidence. Format is backend-specific.

SecureEnclaveUnlocker

A KeystoreUnlocker whose password is bound to a Secure Enclave key.

Enums

DeviceKeyError

Traits

DeviceKey

One hardware-resident P-256 keypair. The label is the user-facing key tag; the private key bytes are never returned by any method.

Functions

create

Create a new biometry-gated, non-extractable P-256 key under label.

delete

Delete a key. Idempotent.

open

Open an existing key by label, or return NotFound.

Type Aliases

DevicePublicKey

Raw uncompressed SEC1 P-256 public key (x ‖ y, no 0x04 prefix).

DeviceSignature

Raw r ‖ s ECDSA-P-256 signature (no DER wrapper).

Result