How iOS 12 Protects Face ID and Touch ID Data

Apple designed iOS 12 with a defense-in-depth architecture to ensure that sensitive biometric information never falls into unauthorized hands. Rather than storing actual photographs of a face or direct images of a fingerprint, iOS 12 isolates biometric processing within a dedicated hardware subsystem known as the Secure Enclave. This article explains how iOS 12 secures Face ID and Touch ID data through mathematical transformation, hardware isolation, device-bound encryption, and secure authentication channels.

Mathematical Representation Over Raw Images

When a user registers a fingerprint with Touch ID or a face with Face ID, the raw scan or image is never stored.

  • Touch ID: The capacitive sensor captures a map of the print, transforms it into a mathematical template, and immediately discards the raw image data.
  • Face ID: The TrueDepth camera projects over 30,000 infrared dots to construct a 3D mesh of the face. This depth map and infrared image are converted into a mathematical sequence representing facial topography, and the original imagery is discarded.

These mathematical representations cannot be reverse-engineered into the original fingerprint image or facial portrait.

The Secure Enclave

Biometric templates are stored and evaluated exclusively within the Secure Enclave, an isolated coprocessor built directly into Apple's A-series chips.

The Secure Enclave operates on its own dedicated microkernel, isolated from the primary application processor running iOS 12. Because the memory is hardware-isolated and encrypted, the primary operating system cannot directly read, modify, or extract the contents of the Secure Enclave. Even if the iOS kernel is compromised via jailbreaking or an exploit, the biometric templates remain protected behind this hardware barrier.

Hardware-Bound Encryption Keys

Biometric data inside the Secure Enclave is encrypted using keys derived from a unique hardware identifier (UID) that is fused into the chip during manufacturing.

  • The UID is completely invisible to software, firmware, and even Apple.
  • The encryption key is tied to both this hardware UID and the user’s device passcode.
  • The data cannot be exported, decrypted on another device, or transferred across different hardware components.

Biometric data is strictly local: it is never sent to Apple servers, backed up to iCloud, or transmitted over network connections.

Verification and Authentication Flow

The matching process takes place strictly inside the Secure Enclave rather than the main operating system:

  1. When a user presents a finger or face, the sensor routes the newly captured data directly to the Secure Enclave.
  2. The Secure Enclave compares the input against the stored mathematical template.
  3. Once the comparison is complete, the Secure Enclave sends only a signed authorization token (a "yes" or "no" response) back to the application processor.
  4. Third-party apps using the LocalAuthentication API only receive confirmation that the authentication succeeded or failed; they never gain access to the underlying biometric templates.

Anti-Spoofing and Rate Limiting

To prevent brute-force and presentation attacks, iOS 12 enforces strict software and hardware rate limits:

  • Touch ID allows only five unsuccessful attempts before requiring the passcode.
  • Face ID allows only five unsuccessful attempts before falling back to the passcode.
  • If the device is restarted, has been locked for more than 48 hours, or has not been unlocked with a passcode in 156 hours, biometric authentication is disabled until the user manually inputs the passcode.
  • Face ID utilizes neural networks within the Bionic chip to confirm user attention (detecting open eyes directed at the screen) to prevent unauthorized unlocking using static photos, masks, or while the user is asleep.