What it is
Biometric security keys store fingerprint templates on the device itself. When a
service asks the key for user verification, the key can accept a
fingerprint touch in place of the PIN. keyroost manages these templates over the
standard CTAP2 authenticatorBioEnrollment command, so enrollments are
interoperable with any FIDO2 service.
Templates never leave the key. keyroost only sends enroll / rename / delete commands and reads back template IDs and names; the biometric data stays on the secure element.
Requirements
A security key with a fingerprint sensor (the Fingerprints tab only appears when the
key advertises biometric support in its getInfo options — Token2's PIN+ bio
keys are the ones this was developed against, but the path is standard CTAP2), and a
PIN set on the key — fingerprint management is PIN-gated. If no PIN is
configured, set one first in the FIDO2 tab.
Enrolling
Open the FIDO2 tab and unlock with your PIN. In the Fingerprints tab, start an enrollment and give it a name, then touch the sensor repeatedly as prompted — most keys need several touches from slightly different angles. A progress bar tracks captures; when complete, the new fingerprint appears in the list, where it can be renamed or deleted.
Command line
keyroostctl fido fingerprint-list --pin-env KR_PIN
keyroostctl fido fingerprint-enroll --pin-env KR_PIN --name "Right index"
keyroostctl fido fingerprint-rename --pin-env KR_PIN --template-id 0001 --name "Left index"
keyroostctl fido fingerprint-delete --pin-env KR_PIN --template-id 0002Troubleshooting
Timed out during enroll — touch the sensor when prompted; the key sends keep-alive frames while waiting and keyroost extends the timeout for the enrollment. A later op fails after a successful one — the key invalidates its verification token after some biometric writes; keyroost re-derives a fresh token per operation, so retry.