3 ms·

> I can also understand parts pairing for Face ID for security Can someone elaborate on why parts pairing is needed for biometrics? In my understanding the bi

> I can also understand parts pairing for Face ID for security Can someone elaborate on why parts pairing is needed for biometrics? In my understanding the biometrics module can simply send raw "image" data to the CPU which then performs validation/authentication. Hardware authentication seems to be only necessary if one plans to send some precomputed data. But I don't understand the very reason behind that. To save power you don't want to run biometrics recognition all the time anyway. If the recognition task is so computationally taxing that even the very powerful CPU present in smartphone cannot provide required hard real time guarantees and therefore an ASIC/FPGA/DSP is needed, well... Apple makes custom hardware anyway, so there is no apparent penalty in embedding biometrics accelerator right into the CPU anyway.

wilg 3y ago
Biometrics need to be evaluated on a separate computer for security reasons. Sending them to the main CPU is a non-starter. When you do this, the parts must be securely linked otherwise you can swap the biometric system with one that is already unlocked. And, they want to ensure the Face ID dot projection and image captures come from a real camera and projector system, not some device that spoofs them. And in reverse, to prevent intercepting and capturing biometric data.
- friendzis 3y ago
  > Biometrics need to be evaluated on a separate computer for security reasons. But why? What's the algorithm/architecture here? I am genuinely curios here. I guess we can generalize finger/face readers as multichannel cameras. What do you gain by computing a "hash" of the data (and the associated machinery to send that hash securely) versus simply sending raw data for evaluation at CPU level? In the end the CPU has to trust the data sent by peripheral anyway. I understand the use of separate compute unit when extraction of secrets must be protected, but in this case it is the CPU that protects those secrets anyway.
  - justincormack 3y ago
    The validation is done outside the CPU I believe too, that’s certainly what happens with the fingerprint reader. I think the process is documented in the secure enclave white paper
- yennies 3y ago
  >otherwise you can swap the biometric system with one that is already unlocked. But isn't the data on the device actually encrypted with the bio key? So swapping out new bio data => new key => can't decrypt original data. Or do you mean it just means you get a working device (but all stored data is lost)?

wilg 3y ago

Biometrics need to be evaluated on a separate computer for security reasons. Sending them to the main CPU is a non-starter. When you do this, the parts must be securely linked otherwise you can swap the biometric system with one that is already unlocked. And, they want to ensure the Face ID dot projection and image captures come from a real camera and projector system, not some device that spoofs them. And in reverse, to prevent intercepting and capturing biometric data.

friendzis 3y ago
> Biometrics need to be evaluated on a separate computer for security reasons. But why? What's the algorithm/architecture here? I am genuinely curios here. I guess we can generalize finger/face readers as multichannel cameras. What do you gain by computing a "hash" of the data (and the associated machinery to send that hash securely) versus simply sending raw data for evaluation at CPU level? In the end the CPU has to trust the data sent by peripheral anyway. I understand the use of separate compute unit when extraction of secrets must be protected, but in this case it is the CPU that protects those secrets anyway.
- justincormack 3y ago
  The validation is done outside the CPU I believe too, that’s certainly what happens with the fingerprint reader. I think the process is documented in the secure enclave white paper
yennies 3y ago
>otherwise you can swap the biometric system with one that is already unlocked. But isn't the data on the device actually encrypted with the bio key? So swapping out new bio data => new key => can't decrypt original data. Or do you mean it just means you get a working device (but all stored data is lost)?