A biometric template is a mathematical representation of distinctive fingerprint, face, iris, or voice features. During registration, a device creates the template and stores it in protected hardware such as a trusted execution environment, Secure Enclave, or TPM. Authentication compares newly captured measurements with the stored template rather than comparing raw biometric data. section 15.1.5 section 15.4
Fingerprint comparison
Imagine recording only the measurements of ridges and curves from a fingerprint instead of keeping the fingerprint itself. A later scan is accepted when its measurements closely resemble the stored template, not when every detail is identical. section 15.1.5
Figure 15.1 Biometric authenticatation is a three-step process. First, a user registers their data. Then the user tries to authenticate and be verified by the system.
Use the three-step flow to connect template creation during registration with later authentication and verification. section 15.1.5
Treat biometric templates as long-lived authentication data:
- Protect templates in secure hardware because stolen biometric characteristics cannot be changed like passwords. section 15.1.5 section 15.4
- Account for spoofing and presentation attacks, including fake fingerprints, masks, photos, videos, and AI-generated data. section 15.4
