Fingerprints

What it is

Biometric security keys store fingerprint templates on the device itself. When a service asks the key for user verification, the key can accept a fingerprint touch in place of the PIN. keyroost manages these templates over the standard CTAP2 authenticatorBioEnrollment command, so enrollments are interoperable with any FIDO2 service.

Requirements

A security key with a fingerprint sensor (the Fingerprints tab only appears when the key advertises biometric support in its getInfo options — Token2's PIN+ bio keys are the ones this was developed against, but the path is standard CTAP2), and a PIN set on the key — fingerprint management is PIN-gated. If no PIN is configured, set one first in the FIDO2 tab.

Enrolling

Open the FIDO2 tab and unlock with your PIN. In the Fingerprints tab, start an enrollment and give it a name, then touch the sensor repeatedly as prompted — most keys need several touches from slightly different angles. A progress bar tracks captures; when complete, the new fingerprint appears in the list, where it can be renamed or deleted.

Command line

Each command asks for the PIN at a hidden prompt; a script passes --pin env:NAME or --pin stdin instead.

keyroostctl fido fingerprint list
keyroostctl fido fingerprint add "Right index"
keyroostctl fido fingerprint rename 0001 "Left index"
keyroostctl fido fingerprint delete 0002               # asks y/N first
keyroostctl fido fingerprint list --pin env:KR_PIN    # in a script

Troubleshooting

Timed out during enroll — touch the sensor when prompted; the key sends keep-alive frames while waiting and keyroost extends the timeout for the enrollment. A later op fails after a successful one — the key invalidates its verification token after some biometric writes; keyroost re-derives a fresh token per operation, so retry.