Mobile Device Management (MDM) with containerization keeps a hardware-anchored root key inside the phone's secure element (Secure Enclave / TEE). It is never exported. Enrollment derives a per-container key-encryption key from it via a KDF, and every managed app's data-encryption key is wrapped by that KEK — a standard key-wrapping hierarchy:
KEK = KDF(HardwareRootKey, enrollment_nonce, policy_id)
DEK_i = random 128/256-bit key, generated per app
Wrapped_i = AES-KeyWrap(KEK, DEK_i) // stored on disk
App data = AES-GCM(DEK_i, plaintext) // decrypted only after unwrap
Brute-forcing a key of n bits at r guesses/second takes on average 2n-1/r seconds. At r = 10¹² guesses/s (an optimistic dedicated cracking cluster):
t(128-bit) ≈ 2^127 / 1e12 s ≈ 5.4×10¹⁸ years
t(256-bit) ≈ 2^255 / 1e12 s ≈ 1.8×10⁵⁵ years
- Managed apps slider — how many work apps are enrolled in the MAM container; each gets its own DEK wrapped by the shared container KEK (lines to the red KEK node).
- AES-128 / AES-256 — the DEK length used for newly wrapped app keys; changes the brute-force estimate live.
- Simulate rogue app access — launches an unmanaged personal app at the container boundary; app-sandboxing (separate UID/keychain namespace) blocks the read before it reaches any wrapped key.
- Remote wipe (crypto-shred) — the real technique MDM uses for "wipe": instead of erasing gigabytes of ciphertext, it deletes only the container KEK. Every wrapped DEK instantly becomes unrecoverable, so all container data is cryptographically destroyed in milliseconds — personal apps outside the boundary are untouched.
- Re-enroll device — derives a fresh KEK and re-wraps new DEKs for the container, restoring protected status.
This mirrors real enterprise mobility management (Apple Managed Apple ID / Android Enterprise work profile, Intune, Jamf): work and personal data are cryptographically and structurally separated on one physical device, and "wipe" is a key-destruction operation, not a data-overwrite operation.