iOS 16 Hidden Album Face ID Encryption Explained

In iOS 16, Apple introduced default biometric locking for the Hidden and Recently Deleted albums in the Photos app. This feature leverages Apple’s hardware-level security architecture, specifically the Secure Enclave and Data Protection framework, to ensure that photos remain encrypted at rest and can only be decrypted once Face ID verifies the user's identity.

The Role of the Secure Enclave

Face ID verification relies on the Secure Enclave, an isolated hardware-based coprocessor separate from the primary application processor. When you attempt to open the Hidden album, the Photos app requests access via the LocalAuthentication framework.

The TrueDepth camera projects infrared dots onto your face, and the infrared camera reads the pattern to send the data directly to the Secure Enclave. The data is converted into a mathematical model and compared against the enrolled biometric profile stored within the Enclave's protected memory. The main iOS operating system never sees your biometric data; it only receives a cryptographically signed confirmation of whether the authentication succeeded or failed.

Cryptographic Key Derivation

Every file in iOS, including individual photos, is encrypted using the Data Protection API. Under this system:

  1. Per-File Keys: Each photo is encrypted on the device's flash storage using a unique Advanced Encryption Standard (AES-256) per-file key.
  2. Access Control Lists (ACL): For files inside the Hidden album, the corresponding keys in the iOS Keychain are protected with an Access Control List that explicitly demands biometric authentication (kSecAccessControlBiometryAny).
  3. Key Unwrapping: The cryptographic keys required to decrypt the album’s database and file contents remain wrapped (encrypted) by a key derived from the user’s passcode and hardware-bound keys inside the Secure Enclave.

The Verification and Decryption Process

When Face ID verifies a match:

  1. The Secure Enclave approves the operation and un緻wraps the specific biometric decryption key.
  2. This key is securely passed to the hardware AES crypto engine embedded in the system-on-chip (SoC).
  3. The AES engine decrypts the metadata and thumbnails of the Hidden album, loading them into active system memory (RAM).
  4. As individual photos are viewed, their per-file keys are decrypted on the fly to render the full-resolution images on screen.

Ephemeral Memory and Re-locking

The derived keys are never stored on persistent storage in an unencrypted state. They remain only in volatile memory for the duration of the viewing session. As soon as you navigate away from the Hidden album, lock your iPhone, or close the Photos app, iOS purges the decryption keys from memory, returning the album to its encrypted state until the Secure Enclave authorizes access again.