Question

A security engineer is designing a mobile field-inspection application that must store a per-device private key used to sign inspection records. The organization requires that the private key never be exportable, that key operations be gated by biometric user presence, and that the backend be able to cryptographically verify the key was generated and is stored inside the device's hardware security module rather than in software. Which approach best satisfies all of these requirements?

Accepted Answer

Generate the key inside the device's Secure Enclave/TPM-backed keystore with a non-exportable attribute and biometric-gated usage, then send a hardware key attestation certificate chain to the backend for validation

Answer

Generate the key in the app's memory, encrypt it with a passphrase-derived AES key, store the ciphertext in the OS keychain, and require the passphrase before each signing operation

Answer

Provision a shared organizational private key to all devices via MDM and require biometric unlock before the app loads the key into memory for signing

Answer

Generate the key on the backend HSM, wrap it with the device's public key, and push it to the device where it is decrypted and cached in secure application storage