Native biometric unlock

Proposal, not an available feature. No network permission or new data collection is enabled. These RFCs are locally prepared; remote review/merge awaits the owner repository.

Current architecture

OS-protected storage currently protects device pairing credentials, not the master passphrase. A UI biometric prompt alone is not cryptographic key protection.

Design under review

Wrap a device-local vault unlock secret using the OS keystore with required current-user biometric presence. Never put the master passphrase in preferences or a JavaScript bridge log. Keep a short authenticated session and invalidate wrapping material on enrollment changes, logout, master rotation and device revocation. Require the master passphrase again for export, recovery and enabling a new biometric enrollment.

Milestones

1. M1: per-platform key-wrapping contracts and threat model
2. M2: macOS/iOS and Android secure-store prototypes with enrollment/lockout tests
3. M3: Windows Hello implementation, physical-device validation and signed distribution

Required acceptance tests

• Cancelled biometric authentication never returns key material
• Enrollment change or deleted OS key falls back to the passphrase
• Biometric session cannot bypass master reauthentication for export/recovery

Limits

Web platform authenticators and Windows/macOS/Android keystores have different guarantees; do not claim hardware-backed protection where unavailable.

Any implementation must preserve local unlock/export, add KDBX/KeePassXC regressions for crypto/format changes and update privacy disclosures before new data flows begin.

← All 41 workstreams