When a passphrase is used, the encryption key is not stored directly in the device. […]
When using biometrics, each reading differs, so no unique value can be used to derive a [Key Encryption Key (KEK)]. The encryption key must be stored somewhere in the device and accessible without a KEK derived from some data provided by the user.
I can unlock my phone using fingerprints or a passphrase. Assuming the fingerprint reader itself cannot be spoofed (which I know is false, but the point is to ignore that attack vector for the purposes of this question), is this configuration as insecure as having no passphrase, as a naïve reading of the above would seem to imply?
To clarify: I suspect the above is talking about using only biometrics as the unlock token. In actuality, if my device has been powered completely off (or after a timeout), biometric authentication is disabled and the passphrase must be used. This suggests that a sensible implementation is to not store the "raw" key in non-volatile memory, but only in volatile memory after the device has been unlocked using the passphrase in order to facilitate biometric authentication. Once that volatile memory goes away, the device is equally secure as if biometrics were not in use.
Does anyone know if Android security is actually implemented in this manner?