Why do smartphones limit the amount of fingerprints that can be recorded?

Question

On my Android device, I can store up to 3 fingerprints to unlock my phone with the fingerprint scanner that is built in to the home button. On iPhones it's 5 fingerprints if I'm not mistaken. But most people have 10 fingers and I can't imagine the performance difference between checking through 10 rather than 3 hashes of fingerprints to be significant.

Is there a security reason for smartphones to limit the user to recording only 3 or 5 fingerprints?

My best guess is that allowing the user to record more fingerprints might increase the possibility of a false positive, or that maybe there is a side channel vulnerability through allowing more fingerprints to be recorded that I didn't think of.

Answer 1

No, theres no specific security reason to limit the number of fingerprints stored.

However, given that these fingerprint modules normally is a HSM, like a smart card, storing fingerprints, the number of, and the size of the secrets such a fingerprint module can store, is limited.

Note that a fingerprint template can also become quite a large, because storing a fingerprint template is not like storing a password hash in a password database. Everytime a fingerprint is read, this will give a completely different result than the previous read, because you are not putting the finger exactly as you did when you registred you, or "enrolled" yourself.

Now, the fingerprint reader needs to make a difficult calculation, on the input fingerprint image, and the template image, to come out with a conclusion if the fingerprint just read, is enough similiar to the fingerprint currently registred, to succeed authentication. This similiarity, can be expressed as a input to the authentication function, where you can select how "sensitive" the authentication should be (too sensitive = it will reject your finger too often, too weak = it may allow a unauthorized person to log in as you)

This is also the reason the fingerprint reader asks you to put your finger multiple times to enroll, because the reader uses these to calculate a optimal "sensitivity" value for your finger, that is stored inside the template.

Think like this: You take out your camera and take a photo of your house. This photo you put in your portfolio and store as "this is my house". After a couple of days, you see a house, and want to know if its your house. You take a photo of the house. As you might understand, you can't just bitwise compare these 2 images, or compare its SHA256 hash, as the images will be slightly different angles, rotation and light, even if they are a picture of the same house. If you did, "authentication" would always fail.

You need to make a complex mathematical calculation on the picture, to find out if the pictures are of the same object or not.

This means the "template" of a fingerprint reader, can get quite a large, depending on the algoritm used in the fingerprint reader.

There ARE fingerprint readers, that can encrypt a template using its internal key, and then export the template as a AEAD (Authenticated Encryption with Associated Data) that is then stored in standard unprotected memory (that it exist gigabytes of). But think of the security consequences of this. This would mean, that you could "steal" this AEAD with a enrolled fingerprint image, and later, lets say when you have sold that phone on Craigslist and the new owner has enrolled his fingerprint, just use the stolen AEAD along with your finger, to unlock the phone.

Thats why the phones must store the fingerprint templates inside secure memory, and thats why the number of fingerprint templates are limited.

Answer 2

iOS devices (and probably Android ones as well) use a dedicated hardware security module that talks to the fingerprint reader directly and compares the fingerprints on its own. The phone's OS has no control over that - it simply gets a result whether the authentication was successful and optionally the secrets that were protected by that authentication, if any.

It could be that device isn't so powerful and checking multiple fingerprints would indeed lengthen the recognition time, or, depending how accurate the reader and matching algoritm are, and how much tolerance there is (you can never scan two bit-per-bit identical images of the fingerprints, it's always a bit fuzzy so you need some tolerance, also you can't hash them either), there could indeed be a too great risk of false positives.

In the end only the people involved in developing those solution can tell us their exact motivations behind such a limit. It may just be that some engineer somewhere thought "5 fingerprints is enough" and hardcoded the limit in the HSM's firmware, or their company charges more for HSMs capable of storing extra fingerprints and the manufacturer didn't want to further increase the price of the phone.

Answer 3

I believe that it is problably because the chances that someone can get into your phone with their fingerprint is 1 in 50,000 and if it only allows 5 fingerprints there will be less of a chance for someone to falsify your fingerprint(s).