VEYRNOX · Learn · Biometric Authentication
Biometric Authentication
Biometric authentication uses a physical characteristic — fingerprint, face, iris — to authorise access. In wallets, biometrics gate the release of hardware-held keys rather than replacing them; the biometric proves user presence, and the hardware still enforces the cryptography.
How it works
On iOS, Face ID and Touch ID are enrolled into the Secure Enclave. When the wallet requests a biometric-gated key, the Enclave prompts the user, evaluates the biometric match against enrolment templates that never leave the chip, and releases the key on success. On Android, BiometricPrompt binds to a Keystore or StrongBox key with a userAuthenticationRequired flag; the key becomes usable only after a successful biometric match backed by hardware. In both platforms, the biometric template is not sent to the app; only the pass/fail signal is.
Why it matters
A biometric alone is not a secret — a fingerprint is visible on any glass. But a biometric bound to a hardware key becomes a presence check: the app cannot unwrap the vault without the user physically here and unlocking, on this device. Combined with a PIN fallback, biometrics give a low-friction unlock without lowering the security bar.
Related concepts
- iOS Secure Enclave — The Secure Enclave is a dedicated security coprocessor in Apple silicon (A7 and later, all M-series) that generates and stores cryptographic keys in hardware.
- Android StrongBox — StrongBox is a tamper-resistant hardware element on modern Android devices that backs the Android Keystore.
- KEK (Key Encryption Key) — A KEK — Key Encryption Key — is a cryptographic key used to encrypt other keys rather than user data directly.
- RASP (Runtime Application Self-Protection) — RASP — Runtime Application Self-Protection — is an in-app defence that detects tampering, debugging, and hostile runtime conditions while the app is running, and responds by refusing to hold sensitive state.
Frequently asked questions
Can I unlock with just biometrics?
For routine unlock, yes. For high-value transactions and initial setup, the PIN is required as a second factor.
What if my biometric changes (injury, glasses, etc.)?
Re-enrol under the phone’s biometric settings; Veyrnox will re-bind on next unlock. The PIN always works as a fallback.
Does Veyrnox see my biometric data?
No. Biometric templates never leave the Secure Enclave or StrongBox. The wallet receives only a pass/fail signal.
In Veyrnox
Veyrnox uses Face ID and Touch ID (Secure Enclave) on iOS and BiometricPrompt (StrongBox / TEE) on Android to gate KEK release. The 8-digit PIN is the fallback path when biometrics are unavailable or refused.