Security

Security & TPM

Trusted Platform Module (TPM) 2.0

Linux Hello supports TPM 2.0 for securing the encryption key used to protect your biometric data.

How it Works

1. Detection: On startup, the system checks for /dev/tpm0 and tpm2-tools.
2. Storage: If available, the master encryption key (Fernet 256-bit) is stored in the TPM NV RAM (Index 0x1500000).
3. Fallback: If TPM is not available, the key is stored in ~/.local/share/face-auth/.encryption_key with strict 0600 permissions.

Enabling TPM

Install the required tools:

• Fedora: sudo dnf install tpm2-tools
• Ubuntu/Debian: sudo apt install tpm2-tools
• Arch: sudo pacman -S tpm2-tools

No configuration is needed; Linux Hello will auto-detect and migrate if possible (migration logic depends on current implementation version).

Data Encryption

• Face Data: 128-dimensional face embeddings are stored in sqlite.
• Encryption: The embedding vector blobs are encrypted using Fernet (AES-128-CBC + HMAC-SHA256).
• Privacy: No raw images of your face are stored.

Authentication Security

Face recognition is convenient but not perfect.

• Spoofing: Standard 2D cameras can be fooled by high-quality photos or screens.
• Liveness: Experimental liveness detection is available (require_liveness: true in config) helping mitigate this, but it may impact convenience.
• Fallback: Always ensure you have a strong password.

Recommendation: Use the balanced or secure security modes in config.yaml.