Can a web app use the Secure Element (or Enclave) through a mobile browser?
Asked Answered
W

1

6

Native mobile apps can use the Secure Element (or Enclave), e.g. to generate and use private keys for encrypting and signing data. These private keys are stored in the hardware of the mobile device, inaccessible to even the phone manufacturer, giving them extremely strong security properties.

I'd like to have the same functionality in a web app (which would be more widely usable since it requires no installation). Is this possible?

I've scoured the web but haven't found any good information on this. In principle, it seems that mobile browsers (because they're native apps themselves) could use the Secure Element just like any other app. In fact, as one example, I'm pretty sure they're using it to enable authentication through WebAuthn, which uses key pairs with the private key stored on the device. But... as far as I know the browsers don't expose access to web apps.

Any information on this would be much appreciated! Thanks

Whoa answered 13/1, 2021 at 22:28 Comment(0)
A
1

While you can generate keys with the Web Crypto API, accessing special security hardware chips is not possible. There is an open Issue for the spec, where this feature request is being discusses. Feel free to chime in there if you want, or just subscribe to the Issue to be informed of progress.

Acerb answered 9/2, 2023 at 8:2 Comment(0)

© 2022 - 2025 — McMap. All rights reserved.