VEYRNOX · Learn · Android StrongBox
Android StrongBox
StrongBox is a tamper-resistant hardware element on modern Android devices that backs the Android Keystore. Keys marked "StrongBox" are generated and used inside dedicated hardware, isolated from the main CPU and operating system.
How it works
On Pixel and other flagship Android devices, StrongBox is a discrete secure element (or a secure enclave in the SoC). An app requests a key with the StrongBox property; the Keystore generates it in hardware and returns a reference. Signing and decryption run inside StrongBox, and biometric or PIN authentication is enforced by the hardware before the key is usable. StrongBox is FIPS-140-2 Level 3 validated on qualifying devices.
Why it matters
Software-only Android Keystore keys can be extracted on a compromised device. StrongBox keys cannot — they exist only inside the hardware element and are used, never released. For a mobile wallet, StrongBox is the Android equivalent of the iOS Secure Enclave: a hardware root of trust for the KEK that unwraps the vault.
Related concepts
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
- KEK (Key Encryption Key) — A KEK — Key Encryption Key — is a cryptographic key used to encrypt other keys rather than user data directly.
- Biometric Authentication — Biometric authentication uses a physical characteristic — fingerprint, face, iris — to authorise access.
- RASP (Runtime Application Self-Protection) — RASP — Runtime Application Self-Protection — is an in-app defence that detects tampering, debugging, and hostile runtime conditions while the app is running, and responds by refusing to hold sensitive state.
Frequently asked questions
Does every Android phone have StrongBox?
No. StrongBox is present on Pixel and select flagships. Older or budget devices use TEE-backed Keystore instead.
How do I check if my phone has StrongBox?
Apps can query the KeyInfo.isInsideSecureHardware() flag; Veyrnox will surface the hardware assurance level at onboarding.
Is StrongBox as secure as Secure Enclave?
On FIPS-validated devices, yes — both are tamper-resistant hardware roots of trust with equivalent threat coverage.
In Veyrnox
When Veyrnox ships on Android, StrongBox will back the KEK on supported devices. On devices without StrongBox, Veyrnox falls back to Keystore with TEE (Trusted Execution Environment) protection and warns the user of the reduced hardware assurance.