A successful biometric dialog and biometric authorization of key use provide different security properties. That distinction matters for sensitive actions.
Evaluation approach
Design key-use conditions and CryptoObject flows together. Decide explicitly whether device credentials are an allowed fallback.
Application example
Opening an encrypted document can depend on successful use of the appropriate key rather than a returned boolean.
Limits and considerations
Biometrics do not establish server-side account permissions. Amounts and destinations still require back-end validation.
Key operations versus screen approval
Changing a dialog result differs from completing an authorized cryptographic operation. Do not base acceptance solely on the interface. Evaluate key policy, protected data and server decisions with separate evidence.
Checks and decisions
- Define key policy
- Test enrollment changes
- Assess fallback
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.