Docs / Hardware Keystore and Security

Hardware Keystore and Security

Protect SSH private keys inside Android's hardware Trusted Execution Environment (TEE) with hardware-backed digital signing.

Hardware-Backed Key Protection

Mobile security is critical when managing remote infrastructure. Casshper secures your SSH credentials by generating and storing cryptographic private keys directly inside Android's Hardware Keystore (TEE). Private keys are generated on-device and never exposed to the filesystem.

Hardware Enclave Cryptography

Private SSH key material never touches the regular Android filesystem. All cryptographic signing operations occur entirely within the isolated hardware security module.

Security Architecture

  • Hardware RSA and ECDSA Key Generation: Generates hardware-bound RSA (up to 4096-bit) and NIST P-256 ECDSA key pairs directly inside AndroidKeyStore.
  • On-Device Hardware Signing: Performs digital signatures (SHA256withRSA and SHA256withECDSA) inside the TEE enclave, encoding ECDSA signatures directly into SSH protocol structure.
  • Strict Application Isolation: Non-privileged processes and third-party apps cannot inspect, read, or export private keys stored within Casshper's Keystore vault.
  • Zero Telemetry Guarantee: Credentials, SSH host fingerprints, and session data remain 100% local to your device. No cloud sync, remote storage, or external tracking.