61

Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an authorized fingerprint is given.

My question is: why?

  • 12
    I can't answer because the question is protected and I have only 5 legit points, but in any case, have you considered the security aspect of someone physically forcing your finger onto the fingerprint reader, or worse, cutting off your finger in order to use it on your phone? By the device requiring the code at startup, if you think your phone is in danger you can shut it off and suddenly your finger is no longer interesting to cut off... – ErikE Aug 21 '16 at 3:33
  • 2
    @ErikE Yeah, this makes my fingers safer :) Also, forcing typing password each time the phone is rebooted makes it less possible for someone to forget it. – nalzok Aug 21 '16 at 3:46
  • I should have said no longer as interesting to cut off, because it has no primary purpose. Someone could still threaten to cut off fingers as torture or to make you unlock your phone, but that's still a whole different ball of wax than simply needing your finger off your dead body to get your phone contents. – ErikE Aug 21 '16 at 3:49
  • 4
    Can't answer either, but the law might protect you from being forced to give up your password to law enforcement even though they may have the right to take your fingerprints. – Najib Idrissi Aug 22 '16 at 6:38
  • 3
    @ErikE: I can't really imagine refusing to type my password into my phone when I'm being threatened by someone willing to cut off my finger. And even if I did refuse, now they have an interest in cutting off any number of my fingers to persuade me to co-operate, not just the one that unlocks the phone. So this seems like quite a niche feature if that was the real reason: it doesn't make your fingers any safer but it does keep your data safe if you lose them :-) – Steve Jessop Aug 22 '16 at 14:30
81

First:

  • password is used to get access to the full disk encryption key
  • fingerprint is used to unlock the screen (of an already "decrypted" device)

Encryption key retrieval must be:

  • accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be able to decrypt the data
  • secure - derived through a one-way function, not "unlocked" by comparing data provided by a user with a pattern stored on the device

Fingerprint recognition does not meet the above requirements, it is:

  • fuzzy - on each press the sensor provides the device an approximate image of a part of a fingerprint which is matched at a certain accuracy; on each verification attempt the actual data differs due to different position, skew, press strength
  • non-secure - recognition is performed by comparing the actual fingerprint with the data stored on the device - this data must be both readable and modifiable which makes it vulnerable to an attacker
  • 1
    @Bakuriu I use OxygenOS 3.2.4 on my phone which is built on 6.0.1 and according to the settings uses encryption. However, I merely use fingerprint + pattern and can receive notifications before proving the pattern but the phone won't let me unlock it via fingerprint the first time I unlock it after a reboot. Because I can receive notifications, user applications definitely work before unlocking the phone the first time after a reboot. – UTF-8 Aug 20 '16 at 18:36
  • 4
    @OrangeDog Even if some form of hashing is used, it is not a secure hash function. I can't see any statement in my answer that is incorrect or unclear. Would you explain your usage of "except"? If you have knowledge of cryptographically secure hash functions used for fingerprint recognition, please answer this question, I would be happy to learn about new developments in the area. – techraf Aug 20 '16 at 21:14
  • 2
    @UTF-8 Did you read the documentation? It mentions that in Android the services are divided into core, main and late_start. Core services start before encryption and keep running. Main start before encryption and are re-started after decryption, late_start start only after the decryption. It is possible that some part of the notification service is in either core or main and so it is started before decryption. – Bakuriu Aug 21 '16 at 7:54
  • 1
    I have just rebooted my phone, typed web.airdroid.com into my browser on my computer, it logged me automatically into airdroid which granted me access to the files stored on the virtual SD card. Just to be sure it doesn't just now the file names, I downloaded a photo before unlocking my phone. So /storage/emulated/0 where pretty much all the personal files are isn't encrypted, is it? The files in /etc aren't encrypted either. In fact, I haven't found a single folder in which files are encrypted (I either can't see them or or they only contain unintelligible data). Can you name one? – UTF-8 Aug 21 '16 at 9:27
  • 1
    Airdroid shows me an empty folder if I try to access /data regardless of whether I unlocked my phone. That's probably because root access is required to view the contents of /data and airdroid doesn't have root access. Anyway, "full disk encryption" sounds pretty bold for not even encrypting the data on the virtual SD card. (I suppose it's encrypted but the pattern isn't part of the key, btw., but have no idea. The key would be known to the phone. That at least would make it impossible to access the data of a sold device if a factory reset changes the key.) – UTF-8 Aug 21 '16 at 9:29
42

Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements.


As you probably know, the primary function of a lockscreen is to make sure that the person accessing your device is you. This is called authentication. If someone inserts the correct pin / password / fingerprint on a lockscreen, the device knows that that person is probably you, and grants you access to the system.

Besides authentication, the screen that asks you for your password when you boot up your phone also serves a different purpose. Modern phones feature something called Disk Encryption. This means that all the user data stored on the device is protected by a encryption algorithm.

When using a properly implemented disk encryption, given just the phone's storage, no one can access your data - not even the device itself! The kind of symmetric encryption used for this purpose uses a secret key, and this key is never stored by the device, for security purposes. Instead, the device must be told the correct key in order to access your data.

Now, because of the nature of this algorithm, a secret key needs to have some important properties:

  • It must be long
  • It must be exact. A key that is almost exactly the same as the secret key is completely useless

Unfortunately, it turns out that systems based on biometrics, such as a fingerprint reader, don't fulfill these properties. The amount of information provided by them is usually small and inexact.

This is the reason you need to enter your password - it's the only mechanism that we know of that properly fulfills the requirements. This is done by feeding your password through a key derivation function.

After booting up and being told your password, the phone keeps the derived encryption key in its volatile memory, so it doesn't need to ask for it again - only authenticate you. This has some disadvantages, such as making it vulnerable to a cold boot attack, but it's considered a good compromise between security and usability

  • I think to be accurate you'd have to say that the password is used for both authentication and encryption, not just encryption. – ErikE Aug 22 '16 at 17:04
  • @ErikE That's a good point, I've changed the introductory sentence – goncalopp Aug 24 '16 at 21:30
2

AFAIK, at boot time you first have to unlock the SIM card, which requires a numeric password. Next operations just unlock the screen and for that part you have different authentication methods (not all are implemented on all devices):

  • numeric or alphanumeric password
  • fingerprint
  • gesture
  • nothing (screen is unlocked by simply moving a finger on it)

All those methods are directly processed by the phone, but the first is processed by the SIM card itself, and as it is far less powerfull than the phone, it accepts only a numeric password. Of course, the phone could certainly intercept the code but it would look like a man in the middle attack, and neither phone manufacturers, nor OS providers have wanted to implement it.

  • 1
    I would think that SIM locks are far less common (and less useful) than device encryption. – Matthew Read Aug 22 '16 at 16:25
  • @MatthewRead, depends on location. Around here, all SIMs default to requiring PIN on start while most phones do not default to encrypted. Therefore SIM locks are vastly more common. – Jan Hudec Aug 23 '16 at 6:48
  • 1
    An unlocked SIM card would allow a thief to use your account to pass any phone call if he has another phone from the same provider. – Serge Ballesta Aug 24 '16 at 15:38
-1

Although the major concerns mentioned by others are accurate, precision and accuracy of a password is much higher than a fingerprint, I think it's worth mentioning drivers and algorithims.

That is to say, most of your hard drive space and code isn't available until you've un-ecrypted the drive, the code to read and interpret a fingerprint is almost certainly much more complex (large) than the code to read a password. Any code that is before the un-encryption is attack-able and adding that much code is a security risk in itself.

protected by Community Aug 20 '16 at 17:18

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.