Generated per device.

Stored in secure enclave / TPM / keychain.

Used to decrypt:

• control keys
• delegated keys
• attribute bundles

If device is lost, device key is lost → attacker gets nothing.