Enum Protection

java.lang.Object
java.lang.Enum<Protection>
com.codename1.security.vault.Protection
All Implemented Interfaces:
Comparable<Protection>
public enum Protection extends Enum<Protection>

One protection a store or a key either has or does not have.

These are deliberately independent flags rather than points on a scale. A single number -- "security level 3" -- reads as though every property below it is implied, and on the browser that is exactly the misreading this package exists to prevent: an entry can be encrypted at rest under a key that cannot be exported, and still be readable by any script the page runs. Encryption and isolation from the page are different questions, so they are different flags.

Every flag is reported through ProtectionReport, which answers YES, NO or UNKNOWN for each one. UNKNOWN is a real answer and not a polite NO: a browser cannot tell an application whether its key ended up in a secure element, and a report that guessed would be the same lie in a different place.

  • Enum Constant Details

    • PERSISTENT

      public static final Protection PERSISTENT
      The value survives the process. On a native port that means an application restart; in a browser it means a page reload, and only for as long as the browser keeps the origin's storage -- see VaultError.QUOTA_EXCEEDED and the eviction discussion in Vault.

    • ENCRYPTED_AT_REST

      public static final Protection ENCRYPTED_AT_REST

      What is written to disk is ciphertext under a key held somewhere else. Someone who reads the storage pool, the profile directory or a backup finds no plaintext.

      This says nothing about who can ask for a decryption. See ISOLATED_FROM_APPLICATION_CODE.

    • NON_EXTRACTABLE_KEY

      public static final Protection NON_EXTRACTABLE_KEY

      The key that protects the data cannot be exported through the platform's normal API. A browser CryptoKey created with extractable: false has this; a raw 32 byte string in local storage does not.

      Non-extractability is not hardware backing and not isolation. The key still performs operations for whatever code asks.

    • OS_PROTECTED

      public static final Protection OS_PROTECTED

      The key lives in an operating system secret store -- the iOS keychain, the Android keystore, the desktop credential store -- rather than in storage the application itself can enumerate.

      No browser reports this. IndexedDB is application-visible storage no matter what it holds.

    • HARDWARE_BACKED

      public static final Protection HARDWARE_BACKED
      The key is held by a secure element, a TEE or a StrongBox, and the platform said so in a way that can be checked. Inferring this from a platform name, from non-extractability or from the fact that a biometric prompt appeared is how an application ends up claiming a guarantee it does not have, so a port that cannot verify reports UNKNOWN.

    • USER_VERIFICATION

      public static final Protection USER_VERIFICATION
      Access is gated on the user proving they are present -- a biometric, a device passcode, a passkey with user verification. Distinct from OS_PROTECTED: a keychain item with no access control is protected by the OS and asks nothing of the user.

    • ISOLATED_FROM_APPLICATION_CODE

      public static final Protection ISOLATED_FROM_APPLICATION_CODE

      Code running in the application's own origin or process cannot read the protected value while the vault is unlocked.

      No Codename One port reports YES for this, and the browser cannot. It is listed because the question gets asked, and because an application that needs it needs to be told NO rather than left to infer an answer from the flags above. Web Workers do not provide it; neither does non-extractability, which stops a key being copied and not a key being used. Once hostile script runs in an unlocked application's origin it can call the same decrypt the application calls.

  • Method Details

    • values

      public static Protection[] values()
      Returns an array containing the constants of this enum type, in the order they are declared.
      Returns:
      an array containing the constants of this enum type, in the order they are declared

    • valueOf

      public static Protection valueOf(String name)
      Returns the enum constant of this type with the specified name. The string must match exactly an identifier used to declare an enum constant in this type. (Extraneous whitespace characters are not permitted.)
      Parameters:
      name - the name of the enum constant to be returned.
      Returns:
      the enum constant with the specified name
      Throws:
      IllegalArgumentException - if this enum type has no constant with the specified name
      NullPointerException - if the argument is null