Tauri Plugin Secure Element

A Tauri plugin for secure element functionality on Windows (TPM 2.0), macOS & iOS (Secure Enclave) and Android (StrongBox & TEE).

Features

• Generate secure keys using hardware-backed secure storage
• Sign data with keys stored in secure elements
• List and manage secure keys
• Check secure element support on the device
• Support for biometric and PIN authentication modes
• Cross-platform support for macOS, Windows, iOS, and Android

Prerequisites

• Rust (latest stable version)
• Node.js (version 20.19+ or 22.12+)
• pnpm (package manager)
• Setup system dependencies for Tauri

Install and Build

pnpm install
pnpm build

This will install dependencies, build the plugin, its JS bindings, and the test app frontend.

Running the Test App

iOS

cd test-app
pnpm tauri ios dev

Android

cd test-app
pnpm tauri android dev

macOS

macOS Secure Enclave access requires special code signing setup with a provisioning profile. See the macOS Development Guide for detailed instructions. pnpm tauri dev will not work for Secure Enclave development because it runs the raw binary without a bundle structure or signed provisioning profile.

Quick start (after setup):

cd test-app
./build-macos-dev.sh
open src-tauri/target/debug/bundle/macos/test-app.app

Windows

cd test-app
pnpm tauri dev

Using Tauri Plugin Secure Element

Installation

npm

npm install tauri-plugin-secure-element-api
# or
pnpm add tauri-plugin-secure-element-api
# or
yarn add tauri-plugin-secure-element-api

Cargo

[dependencies]
tauri-plugin-secure-element = "0.1.0-beta.4"

Setup

Add the plugin to your Rust code in src-tauri/src/lib.rs:

#[cfg_attr(mobile, tauri::mobile_entry_point)]
pub fn run() {
    tauri::Builder::default()
        .plugin(tauri_plugin_secure_element::init())
        // ... other plugins
        .run(tauri::generate_context!())
        .expect("error while running tauri application");
}

Add the plugin permissions to src-tauri/capabilities/default.json:

{
  "identifier": "default",
  "description": "Capability for the main window",
  "windows": ["main"],
  "permissions": ["core:default", "secure-element:default"]
}

Android Biometrics

In order to use biometric protected keys, add this to src-tauri/gen/android/app/build.gradle.kts:

dependencies {
    implementation("androidx.biometric:biometric:1.1.0")
}

Note: The src-tauri/gen/android folder is generated by Tauri but should be committed to version control and customized as needed. Once you add the biometric dependency, it will persist across builds (you only need to add it again if you completely regenerate the Android project with tauri android init).

iOS Face ID Permission

Important: For authentication-required keys to work on iOS with Face ID, you must add the Face ID usage description to your iOS Info.plist.

Add to src-tauri/gen/apple/tauri-app_iOS/Info.plist (replace tauri-app_iOS with your app name):

<key>NSFaceIDUsageDescription</key>
<string>This app uses Face ID to authenticate access to your secure keys.</string>

Add this entry anywhere within the <dict> section of the Info.plist file.

Note: Like the Android configuration, the src-tauri/gen/apple folder should be committed to version control. The Face ID permission will persist across builds unless you regenerate the iOS project with tauri ios init.

Touch ID does not require a separate permission entry - it works automatically when Face ID permission is granted or when no biometric hardware is available.

Usage

import {
  checkSecureElementSupport,
  generateSecureKey,
  listKeys,
  signWithKey,
  deleteKey,
} from "tauri-plugin-secure-element-api";

// Check device secure element capabilities
const capabilities = await checkSecureElementSupport();
console.log("Strongest backing:", capabilities.strongest);
console.log("Can enforce biometric-only:", capabilities.canEnforceBiometricOnly);

// Generate a new secure key
const { publicKey, keyName } = await generateSecureKey(
  "my-key-name",
  "pinOrBiometric" // or 'none' or 'biometricOnly'
);

// List all keys
const keys = await listKeys();

// Sign data with a key
const data = new Uint8Array([1, 2, 3, 4]);
const signature = await signWithKey("my-key-name", data);

// Delete a key
await deleteKey("my-key-name");

API Reference

checkSecureElementSupport()

Returns detailed information about secure element hardware capabilities on the device.

Returns: Promise<SecureElementCapabilities>

/**
 * Hardware backing tiers, ordered weakest → strongest:
 * "none" < "firmware" < "integrated" < "discrete"
 */
type SecureElementBacking = "none" | "firmware" | "integrated" | "discrete";

interface SecureElementCapabilities {
  /** A discrete physical security chip is available (e.g. discrete TPM 2.0, macOS T2, Android StrongBox) */
  discrete: boolean;
  /** An on-die isolated security core is available (e.g. Apple Silicon Secure Enclave, ARM TrustZone/TEE) */
  integrated: boolean;
  /** Firmware-backed security is available but no dedicated secure processor (e.g. Windows fTPM via Intel PTT or AMD PSP) */
  firmware: boolean;
  /** The security is emulated/virtual (e.g. vTPM in a VM, iOS Simulator, Android Emulator) */
  emulated: boolean;
  /** The strongest hardware backing tier available on this device */
  strongest: SecureElementBacking;
  /** Whether biometric-only authentication can be enforced at the key level (Android API 30+ only) */
  canEnforceBiometricOnly: boolean;
}

Hardware Backing Tiers:

Tier	Description	Examples
none	No secure element available (software-only)	Unsupported devices, some VMs
firmware	Firmware-backed, no dedicated secure processor	Windows fTPM (Intel PTT, AMD PSP)
integrated	On-die isolated security core	Apple Silicon Secure Enclave, ARM TrustZone/TEE
discrete	Physically separate security processor	Discrete TPM 2.0, macOS T2 chip, Android StrongBox

Usage Example:

const caps = await checkSecureElementSupport();

// Check if any hardware backing is available
if (caps.strongest === "none") {
  console.warn("No secure element available - keys will be software-only");
}

// Check for high-security backing (discrete or integrated)
if (caps.strongest === "discrete" || caps.strongest === "integrated") {
  console.log("High-security hardware backing available");
}

// Warn if running in emulated environment
if (caps.emulated) {
  console.warn("Running in emulator/VM - security may be reduced");
}

// Check before creating biometric-only keys
if (caps.canEnforceBiometricOnly) {
  await generateSecureKey("my-key", "biometricOnly");
}

generateSecureKey(keyName: string, authMode?: AuthenticationMode)

Generates a new secure key in the device's secure element.

Parameters:

• keyName: Unique name for the key
• authMode: Authentication mode ('none', 'pinOrBiometric', or 'biometricOnly')

Returns: Promise<GenerateSecureKeyResult>

interface GenerateSecureKeyResult {
  publicKey: string;
  keyName: string;
}

Note: The biometricOnly mode requires Android 11 (API 30) or higher. On older Android versions, this mode will be rejected with an error. Use checkSecureElementSupport().canEnforceBiometricOnly to check support before creating biometric-only keys.

listKeys(keyName?: string, publicKey?: string)

Lists keys stored in the secure element. Can filter by key name or public key.

Returns: Promise<KeyInfo[]>

interface KeyInfo {
  keyName: string;
  publicKey: string;
}

signWithKey(keyName: string, data: Uint8Array)

Signs data using a key stored in the secure element.

Parameters:

• keyName: Name of the key to use
• data: Data to sign as Uint8Array

Returns: Promise<Uint8Array> - The signature

deleteKey(keyName?: string, publicKey?: string)

Deletes a key from the secure element. Exactly one parameter must be provided (not both).

Returns: Promise<boolean> - Success status

Public Key Format

Public keys are returned as base64-encoded strings in X9.62 uncompressed point format (65 bytes), consistent across all platforms:

Byte(s)	Content
0	0x04 (uncompressed)
1-32	X coordinate (32 bytes)
33-64	Y coordinate (32 bytes)

All keys use the secp256r1 (P-256) elliptic curve.

Platform Support

Platform	Hardware	strongest	Notes
iOS	Secure Enclave	integrated	On-die security core in A-series/M-series chips
macOS (Apple Silicon)	Secure Enclave	integrated	On-die security core in M1/M2/M3/M4 chips
macOS (Intel + T2)	T2 Chip	discrete	Separate security processor on motherboard
Android (StrongBox)	StrongBox	discrete	Tamper-resistant hardware module
Android (TEE only)	TrustZone/TEE	integrated	ARM TrustZone isolated execution environment
Windows (discrete TPM)	TPM 2.0	discrete	Separate TPM chip on motherboard
Windows (fTPM)	Firmware TPM	firmware	Intel PTT or AMD PSP firmware-based TPM
Simulators/Emulators	None	none	emulated: true flag is set

Platform Limitations

Windows

• Windows 11 (build 22000 or higher) requires TPM 2.0
• TPM 2.0 is supported on Windows 10 (since version 1507)

macOS

• Secure Enclave is available on Macs with Apple Silicon (M1/M2/M3/M4) or T2 chip

Android

Feature	Requirement	Notes
Hardware-backed keys	API 23+	TEE or StrongBox required
StrongBox	API 28+	Falls back to TEE if unavailable
biometricOnly auth mode	API 30+	Rejected on older versions

iOS

• Secure Enclave is available on all devices with A7 chip or later (iPhone 5s+)
• Simulator does not support Secure Enclave - test on physical devices

Authentication Modes

Mode	iOS/MacOS	Android	Windows
none	✅ No auth required	✅ No auth required	✅ No auth required
pinOrBiometric	✅ Face ID, Touch ID, or passcode	✅ Biometric or PIN/pattern/password	✅ Windows Hello
biometricOnly	❌ Not supported	✅ API 30+ only, biometric only	❌ Not supported

License

Apache-2.0

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Links

• Repository
• Issues