Chapter 33
Hardware Security
SANKET Technical Security & Architecture Whitepaper. Public edition 2.0, 7 October 2026.
SANKET does not require special hardware, but it benefits from, and is designed to be deployed with, hardware security features on servers and endpoints.
Table 57: Hardware security options
| Feature | Use with SANKET | Status |
|---|---|---|
| Mobile secure storage (Keychain, Keystore) | Protects protocol state, device keys and refresh tokens on phones, this device only | IMPLEMENTED |
| Secure Enclave (iOS) | A non-exportable P-256 key in the Secure Enclave; a 256-bit AES-GCM key derived from it (ECDH and HKDF-SHA256) wraps the libsignal store, device secrets, the device certificate key and the account list key. Usable after first unlock, so background delivery and calls work while locked | IMPLEMENTED |
| StrongBox, with TEE fallback (Android) | A StrongBox key where the phone has a StrongBox secure element; a TEE-backed Android Keystore key otherwise; wraps the same items with AES-256-GCM | IMPLEMENTED |
| Protection level per device | Each phone reports Secure Enclave, StrongBox, TEE or software (simulators and emulators); stored per device, shown in the console; policy can require a minimum level | IMPLEMENTED |
| Desktop OS keychain | Protects desktop protocol state and secrets | IMPLEMENTED |
| TPM 2.0 on servers | Full-disk encryption key protection; measured boot | RECOMMENDED |
| Secure Boot on servers | Boot-chain integrity of the host | RECOMMENDED |
| Encrypted server storage | Full-disk encryption (for example LUKS with TPM) for all installation volumes | RECOMMENDED |
| HSM | Root CA keys; evaluation of OpenBao auto-unseal against customer key infrastructure | RECOMMENDED |
| FIDO2 security keys | Phishing-resistant administrator sign-in (WebAuthn, ES256 or EdDSA, user verification required), verified by the installation; required on new installations for every administrator | IMPLEMENTED |
| Redundant infrastructure | Redundant power, storage and network for the host | RECOMMENDED |
| Android Key Attestation | Proof that a phone's keys are held in StrongBox or the TEE, verified offline against vendor roots and a revocation snapshot shipped with each release | IMPLEMENTED |
Evaluating SANKET for your organisation?
Talk to Tosh Defence about a technical briefing, a deployment plan for your infrastructure, or the controlled edition of this whitepaper under a non-disclosure agreement.