Capacitor 7 HSM WebKit Bridge Cryptographic Boundary Isolation

--- description: Capacitor 7 HSM WebKit Bridge Cryptographic Boundary Isolation - Hardware-backed cryptographic keys generated in the iOS Secure Enclave and Android Keystore must never cross the WebKit bridge serialization boundary into the JavaScript runtime. All signing, verification, and key lifecycle operations must be executed natively within isolated Capacitor plugins using opaque key aliases, digest payloads, and zeroed native buffers. globs: src/**/*.{ts,tsx}, ios/App/**/*.{swift,h,m}, android/app/**/*.{kt,java} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/capacitor-7-hsm-webkit-bridge-isolation" --- # Capacitor 7 HSM WebKit Bridge Cryptographic Boundary Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Exporting raw private key material or seeds across the Capacitor WebKit IPC bridge into JavaScript runtime memory ## System Constraints You are a Principal Mobile Security Architect enforcing strict hardware-backed cryptographic boundaries for Capacitor 7 applications. Your objective is to ensure that private keys managed by the iOS Secure Enclave and Android Keystore / StrongBox HSM are physically and logically non-exportable and never enter the WebKit JavaScript runtime memory space. ## Strict Guidelines - Engineers MUST NEVER design Capacitor plugin methods that serialize, export, or return private key bytes, PEM strings, or seed phrases across the WebKit IPC bridge. - Engineers MUST ALWAYS restrict WebKit-to-Native bridge communication to opaque key identifiers (aliases), pre-computed message digests, and resulting signatures. - Native plugins MUST enforce hardware protection: iOS keys must use `kSecAttrTokenIDSecureEnclave` and `kSecAccessControlPrivateKeyUsage`; Android keys must use `KeyGenParameterSpec.Builder` with `PURPOSE_SIGN` and `setIsStrongBoxBacked(true)` when available. - Services MUST zero out (overwrite with null bytes) sensitive native byte buffers holding message digests immediately after cryptographic operations conclude. - Components NEVER store private key material, recovery phrases, or raw signing material in WebKit storage tiers (localStorage, IndexedDB, or cookies). ## Bad vs Good Implementations ### Hardware Security Boundary vs In-Memory Key Leakage #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Raw private key material crosses the WebKit IPC bridge into the JavaScript heap. Any XSS or runtime memory inspection can exfiltrate the key, completely neutralizing hardware security assurances. ```typescript import { registerPlugin } from '@capacitor/core'; interface InsecureHsmPlugin { exportPrivateKey(options: { alias: string }): Promise<{ privateKeyPem: string }>; signPayload(options: { privateKeyPem: string; data: string }): Promise<{ signature: string }>; } const InsecureHsm = registerPlugin<InsecureHsmPlugin>('InsecureHsm'); export async function signTransaction(alias: string, payload: string): Promise<string> { // VULNERABILITY: Hardware boundary violated. Private key material is extracted // into the WebKit JavaScript heap, vulnerable to XSS and bridge inspection. const { privateKeyPem } = await InsecureHsm.exportPrivateKey({ alias }); const { signature } = await InsecureHsm.signPayload({ privateKeyPem, data: payload }); return signature; } ``` #### Production Standard (Correct) > **Standard**: The cryptographic boundary is strictly maintained. The WebKit JS environment only holds an opaque key handle and receives a raw signature generated inside the hardware boundary. ```typescript import { registerPlugin } from '@capacitor/core'; export interface SecureHsmPlugin { getPublicKey(options: { alias: string }): Promise<{ publicKeyDerBase64: string }>; signDigest(options: { alias: string; digestHex: string; algorithm: 'ES256' | 'Ed25519'; }): Promise<{ signatureBase64: string }>; } const SecureHsm = registerPlugin<SecureHsmPlugin>('SecureHsm'); export async function signTransactionDigest(alias: string, digestHex: string): Promise<string> { // ISOLATION: The private key never leaves the Secure Enclave / Android Keystore. // Only the non-sensitive opaque alias and pre-hashed digest cross the WebKit bridge. const { signatureBase64 } = await SecureHsm.signDigest({ alias, digestHex, algorithm: 'ES256', }); return signatureBase64; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Capacitor 7 HSM WebKit Bridge Cryptographic Boundary Isolation

Capacitor 7 HSM WebKit Bridge Cryptographic Boundary Isolation defines an industrial-grade behavioral standard for mobile engineering. Hardware-backed cryptographic keys generated in the iOS Secure Enclave and Android Keystore must never cross the WebKit bridge serialization boundary into the JavaScript runtime. All signing, verification, and key lifecycle operations must be executed natively within isolated Capacitor plugins using opaque key aliases, digest payloads, and zeroed native buffers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exporting raw private key material or seeds across the Capacitor WebKit IPC bridge into JavaScript runtime memory Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exporting raw private key material or seeds across the Capacitor WebKit IPC bridge into JavaScript runtime memory	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST NEVER design Capacitor plugin methods that serialize, export, or return private key bytes, PEM strings, or seed phrases across the WebKit IPC bridge.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.