Knox Vault

About Knox Vault

Knox Vault is the part of Samsung Knox you cannot buy, configure or switch on. It is hardware: a secure subsystem built into the chipset of a Galaxy device, with its own processor, memory and cryptographic engine, plus a separate storage chip alongside it. Its job is to hold the small number of secrets that matter most, chiefly lock screen credentials, biometric keys and Android Keystore keys, in a place the main application processor cannot reach even if Android itself has been fully compromised.

That distinction is the reason this page exists. Buyers regularly search for Knox Vault expecting a licence, a console or a subscription. There is none. Knox Vault either came with the handset or it did not, so the only decision it informs is which Samsung model to purchase.

What Knox Vault is, in hardware terms

Samsung's security documentation splits Knox Vault into two parts.

The Knox Vault Subsystem sits inside the system on chip. Samsung describes it as an independent processor with dedicated SRAM and ROM, its own crypto engine covering AES, SHA, RSA and ECC along with random number generation, a hardware monitor carrying sensors for temperature, voltage, glitch and laser attacks, an external memory manager controlling any access to DRAM, and a device-unique key burned into one-time-programmable bits.

Knox Vault Storage is a separate integrated circuit: non-volatile NOR flash with its own secure processor, cryptographic module and tamper detection, talking to the subsystem over an encrypted and authenticated I2C bus.

The practical point is that secrets are not merely processed in isolation. They are stored in isolation too, on different silicon.

Where Knox Vault sits in the Knox family

Knox Vault is the floor of the Knox stack, not a competitor to the rest of it.

Samsung Knox, the platform, is the software and firmware layer above it: verified boot, Real-time Kernel Protection, the work container and the policy controls an administrator configures through a management console. That is what an IT department buys and operates.

Knox Guard is different again. It is a paid cloud service letting a carrier, retailer or lender remotely lock a handset when a customer stops paying. It has nothing to do with key storage.

Knox Vault underpins the platform without being part of its licensing. Nothing in a Knox Suite plan adds Knox Vault to a device that shipped without it.

What Knox Vault stores

Samsung's documentation names the contents fairly precisely: cryptographic keys protecting biometric data, hardware-backed Android Keystore keys, blockchain credentials, lock screen credentials including PIN, password and pattern material, and the Knox device health attestation key. Samsung's Knox blog adds the Samsung Attestation Key.

Just as important is what it does not hold. Knox Vault is not general storage. Photographs, messages and application data live in ordinary encrypted device storage, protected by keys that Knox Vault guards. It is a key safe, not a filing cabinet, and describing it as a place where personal data is kept overstates it.

What it is designed to resist

Samsung groups the threats into five categories: physical probing through direct electrical contact, physical manipulation of the circuit, forced information leakage through fault exploitation, side-channel attacks including power analysis and timing variation, and fault injection using light or power glitches.

That list describes an adversary with the device in hand and laboratory equipment, which is the correct reading. Knox Vault is aimed at physical attack and at the case where the Android kernel above it has already lost. It offers nothing against a user who installs a malicious application and grants it permissions, and nothing against an account takeover in the cloud.

Samsung states that Knox Vault components hold Common Criteria evaluation at EAL4 and above. Verifying that means checking the certification entry for the specific chipset and model.

Which Samsung devices have Knox Vault

Both Samsung's documentation and independent coverage put the starting point at the Galaxy S21 generation. Samsung's wording is that Knox Vault is integrated into select Samsung devices starting from the Galaxy S21, and XDA Developers describes it as launching with the Galaxy S21 and later, now standard on recent flagship models.

The operative word is select. Presence is not guaranteed across every mid-range and entry-level Galaxy device sold since 2021, and Samsung publishes no single canonical list. Anyone procuring on the strength of Knox Vault should confirm it against the specification sheet for the exact model and market rather than assuming it from the year or the brand.

Knox Vault against Apple and Google

The nearest equivalents are Apple's Secure Enclave and Google's Titan M2, and all three solve the same problem: keep credentials and keys away from a processor running a large, attackable operating system.

Android Authority describes Titan M2 as a dedicated security chip in recent Pixel phones with its own memory, running a minimal operating system, holding disk encryption keys, StrongBox keys for third-party applications and biometric material, and enforcing hardware limits on unlock attempts. That is close to Samsung's description of Knox Vault. The same article states that Google is the only smartphone maker using a security module as a chip separate from the main processor, which sits awkwardly beside Samsung's documentation of a distinct Knox Vault Storage IC. Worth knowing before treating any single comparison as settled.

In buying terms the comparison rarely decides anything on its own. It matters when a regulator or certification scheme asks where keys live, and there the certification entry for the specific model, not the brand name, carries the weight.

Who should care about Knox Vault

Security architects specifying handsets for government, defence, healthcare or financial use are the real audience. If a control framework requires hardware-backed key storage, or if a Knox feature such as DualDAR is in scope, the presence of Knox Vault on the chosen model is a procurement condition worth writing into the specification.

Developers of payment, identity, e-signature and secure communication applications are the second audience. Samsung positions Knox Vault as something partners build on to reach certification levels their customers demand without shipping a separate secure element.

Everyone else benefits passively. It protects the lock screen and the keystore on devices that have it, and requires no action.

Who should buy something else

Anyone looking for a product to purchase should stop here. Knox Vault has no licence, no console, no plan and no price. If you arrived wanting something to deploy, you want Samsung Knox the platform, or Knox Suite if you need the management services. If you arrived wanting to lock devices customers have not paid for, you want Knox Guard.

Organisations that cannot standardise on Samsung hardware should not treat Knox Vault as a reason to try. Pixel devices with Titan M2 and iPhones with the Secure Enclave address the same threat, and choosing a fleet for one silicon feature while ignoring management tooling, update commitments and application compatibility is a poor trade.

Anyone whose actual exposure is phishing, credential reuse, malicious applications or misconfigured cloud sharing should spend the effort elsewhere. Knox Vault defends against an attacker holding the device with laboratory equipment: a real threat for a small number of organisations and a rare one for most.

Finally, buyers of older or budget Galaxy models should not assume it is present. If the specification sheet does not say so, plan as though it is not.