attested_secure_keys library

Hardware-backed, attestable EC P-256 keys for Flutter.

Generate non-exportable signing keys inside Android Keystore/StrongBox or the iOS Secure Enclave, sign with ES256 (raw R‖S JOSE/COSE output), and produce a server-verifiable proof of hardware origin (Android Keystore attestation / Apple App Attest). Every result reports the assurance it actually achieved — the library never silently downgrades.

Start from the AttestedSecureKeys facade.

Classes

AndroidKeyOptions
Android-specific generation options. Mirrors the ergonomics of flutter_secure_storage's AndroidOptions.
AttestedSecureKeys
Hardware-backed, attestable EC P-256 keys.
AttestedSecureKeysPlatform
The interface that platform implementations of attested_secure_keys must implement.
DeviceKeyCapabilities
What a given device/OS can actually do — call once before committing to a flow so the UI can degrade honestly.
ErrorCodes
Stable platform error codes shared between the native side and Dart.
Es256Signature
An ES256 signature in JOSE/COSE form: raw R‖S, 64 bytes, base64url.
HwKey
A freshly generated hardware key handle.
HwKeyInfo
Metadata for an existing key, returned by getKeyInfo.
IosKeyOptions
iOS-specific generation options. Mirrors flutter_secure_storage's IOSOptions.
Jwk
An EC P-256 public key in JSON Web Key form (RFC 7517).
KeyAttestation
A verbatim attestation artifact, for the server to re-verify against the real manufacturer roots. The client never makes a trust decision from it.
UserAuthPolicy
How a key should be gated behind user authentication.

Enums

AttestationEncoding
Encoding of the verbatim attestation artifact handed to the server.
IosAccessibility
iOS keychain accessibility for the persisted (encrypted) key blob. The private key itself never leaves the Secure Enclave; this controls when the reference blob can be read.
KeyAttestationType
What proof of hardware origin the platform can produce for a key.
KeySecurityLevel
Where a private key actually lives. Ordered weakest-last for documentation; use isHardwareBacked rather than comparing ordinals.
UserAuthType
The OS-enforced user-presence requirement for using a key.

Exceptions / Errors

AttestationUnavailableError
Thrown by attest when no hardware attestation can be produced on this device (the caller should apply a degraded policy server-side). On iOS this also covers App Attest being unsupported or unreachable (it needs network); inspect message for the underlying DCError domain/code.
AttestedSecureKeysException
Base type for all errors thrown by this library. Always an Exception; the underlying platform error code is preserved in code, and any raw native diagnostic payload (e.g. the native stack trace, or a security-level / alias hint) in details, so the app always has the full picture — nothing the native side reports is swallowed.
HwKeyUnsupportedError
Thrown by generateKey when the requested minSecurityLevel cannot be met.
KeyInvalidatedError
Thrown by sign when the key was permanently invalidated by the OS — typically because the user added or removed a fingerprint/face (Android KeyPermanentlyInvalidatedException; iOS keys created with .biometryCurrentSet). The private key is gone and unrecoverable; on Android the dead entry is also removed. The correct reaction is to generate a new key and re-enroll it with your backend — do NOT retry the signature.
KeyNotFoundError
Thrown when an operation references an alias that doesn't exist.
KeyOperationError
A catch-all for unexpected platform failures during a key operation. message always carries the native exception type + description (and, on iOS, the error domain + code), and details the native stack trace on Android, so the failure is never opaque.
UserNotAuthenticatedError
Thrown by sign when an auth-gated key is used without a fresh, valid user authentication (e.g. the biometric prompt was cancelled, timed out, or the user is locked out). The key is intact — prompt again and retry.