Hardware-backed ECDSA P-256 (ES256) signing for device-bound authentication in Tauri v2 apps, via AndroidKeyStore and the Apple Secure Enclave.
The private key is generated inside AndroidKeyStore or the Secure Enclave and signing happens there. The raw scalar never enters the WebView, the Rust process or app memory.
How it works
Desktop and web fallbacks report software and hardwareBacked false. An unrecognised backing tag maps down to software, never up to hardware.
Six platforms, compared
An ambient key that never prompts, for every request, and a user-present key bound to a biometric or the device credential, for the operations that need a human.
The two-key model
Every backend's signature is verified against the JWK it reported, with p256, WebCrypto or java.security, and the DER to P1363 codec has known-answer tests in Kotlin and Swift.
How we know it works
This plugin is a port of vaam-apps/flutter-sign-keypair, the same hardware-backed signer for Flutter apps. The Kotlin and Swift keystore code is a direct port; the Rust, TypeScript and WebCrypto sides are new. Fixes do not flow automatically between the two projects.