Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an authorized fingerprint is given.
My question is: why?
First:
Encryption key retrieval must be:
Fingerprint recognition does not meet the above requirements, it is:
/storage/emulated/0 where pretty much all the personal files are isn't encrypted, is it? The files in /etc aren't encrypted either. In fact, I haven't found a single folder in which files are encrypted (I either can't see them or or they only contain unintelligible data). Can you name one?
/data regardless of whether I unlocked my phone. That's probably because root access is required to view the contents of /data and airdroid doesn't have root access. Anyway, "full disk encryption" sounds pretty bold for not even encrypting the data on the virtual SD card. (I suppose it's encrypted but the pattern isn't part of the key, btw., but have no idea. The key would be known to the phone. That at least would make it impossible to access the data of a sold device if a factory reset changes the key.)
Because the fingerprint is only used for authentication, while the password is also used for encryption, and these are distinct processes with very different requirements.
As you probably know, the primary function of a lockscreen is to make sure that the person accessing your device is you. This is called authentication. If someone inserts the correct pin / password / fingerprint on a lockscreen, the device knows that that person is probably you, and grants you access to the system.
Besides authentication, the screen that asks you for your password when you boot up your phone also serves a different purpose. Modern phones feature something called Disk Encryption. This means that all the user data stored on the device is protected by a encryption algorithm.
When using a properly implemented disk encryption, given just the phone's storage, no one can access your data - not even the device itself! The kind of symmetric encryption used for this purpose uses a secret key, and this key is never stored by the device, for security purposes. Instead, the device must be told the correct key in order to access your data.
Now, because of the nature of this algorithm, a secret key needs to have some important properties:
Unfortunately, it turns out that systems based on biometrics, such as a fingerprint reader, don't fulfill these properties. The amount of information provided by them is usually small and inexact.
This is the reason you need to enter your password - it's the only mechanism that we know of that properly fulfills the requirements. This is done by feeding your password through a key derivation function.
After booting up and being told your password, the phone keeps the derived encryption key in its volatile memory, so it doesn't need to ask for it again - only authenticate you. This has some disadvantages, such as making it vulnerable to a cold boot attack, but it's considered a good compromise between security and usability
AFAIK, at boot time you first have to unlock the SIM card, which requires a numeric password. Next operations just unlock the screen and for that part you have different authentication methods (not all are implemented on all devices):
All those methods are directly processed by the phone, but the first is processed by the SIM card itself, and as it is far less powerfull than the phone, it accepts only a numeric password. Of course, the phone could certainly intercept the code but it would look like a man in the middle attack, and neither phone manufacturers, nor OS providers have wanted to implement it.
Although the major concerns mentioned by others are accurate, precision and accuracy of a password is much higher than a fingerprint, I think it's worth mentioning drivers and algorithims.
That is to say, most of your hard drive space and code isn't available until you've un-ecrypted the drive, the code to read and interpret a fingerprint is almost certainly much more complex (large) than the code to read a password. Any code that is before the un-encryption is attack-able and adding that much code is a security risk in itself.
