Emma Zaman Strategic Advisor: Sovereign Identity & Compliance

Biometric authentication is not the problem. The assumption that it can stand alone is.

A fingerprint is permanent. A password can be changed. That single fact changes the entire calculus of what happens when a biometric authentication system is spoofed, compromised, or poorly implemented.

This is Vol. 13 of Zero Assumptions — Pillar 3: Hardware Root of Trust. We are looking at where biometric authentication works, where the assumptions around it fail, and why the answer is not to abandon biometrics but to anchor them to hardware that cannot be cloned.

The three spoofing realities CISOs rarely discuss

Most biometric spoofing discussions centre on fingerprint lifting from surfaces. That threat is real but it is also the least sophisticated. Here are the three that matter at enterprise scale:

• Presentation attacks: Synthetic fingerprints fabricated from latent prints, silicone casts, or high-resolution scans fool sensors that lack liveness detection. NIST's FRVT programme found false acceptance rates as high as 3–4% on some commercial sensors under presentation attack.
• Template database compromise: Biometric templates stored centrally can be stolen and used to craft matching inputs. Unlike a password, the template cannot be rotated. Once breached, it is permanently compromised.
• Software-layer bypass: On devices where biometric verification runs in software without a secure enclave or trusted execution environment, the result can be spoofed at the OS level without ever touching the sensor.

What hardware root of trust actually fixes

The answer to all three threats is the same: the biometric match must happen inside tamper-resistant hardware, and the private key must never leave that hardware. When matching is done on-device in a certified secure element, a stolen template is useless — there is no external system to fool, and no credential to extract.

This is the architecture that separates security theatre from genuine phishing-resistant authentication. The biometric is a convenience factor for unlocking the hardware key. The hardware key is the authenticator.

Feitian BioPass K49 — Biometrics Done Right

The Feitian BioPass K49 is built on exactly this architecture. Fingerprint matching happens entirely on the key itself — no biometric data is transmitted, stored on a server, or accessible by the host device.

• CC EAL6+ certified chip — the highest grade of hardware tamper resistance for physical side-channel attacks
• FIPS 140-3 Level 3 validated — required for US federal deployments, increasingly cited in EU NIS2 audit evidence
• On-device fingerprint matching — biometric never leaves the key; no server, no database, no central risk
• FIDO2 / WebAuthn + PIV — works across Microsoft Entra ID, Google Workspace, Okta, and physical access systems
• Post-quantum cryptography ready — firmware architecture supports PQC migration without hardware replacement

NeoWave Winkeo-C — sovereign biometric without the compromise

For organisations where EU sovereignty and regulatory auditability are non-negotiable, the NeoWave Winkeo-C provides FIDO2 authentication anchored to a CC EAL6+ chip with ANSSI Security Visa — the French national cybersecurity authority's highest endorsement.

• CC EAL6+ certified chip — physical side-channel resistance (DPA, EMA, fault injection) at the silicon level
• ANSSI Security Visa — directly usable as NIS2 Article 21 audit evidence; no translation required
• Manufactured in France — complete EU supply chain; no dependency on non-EU semiconductor fabrication
• FIDO2 / U2F + PIV — covers passwordless login and physical access in a single token
• True hardware entropy source — cryptographic randomness generated in silicon, not software

The framing question for your next security review: is the biometric match happening inside certified hardware, or is it happening somewhere that can be reached by an attacker?

Read Vol. 13 on ciptor.com

Mikael Rodin

Managing Director, Ciptor AB

P.S. If you are evaluating biometric authentication for a NIS2 audit or an Entra ID rollout and want to know which hardware configurations meet the evidence bar regulators are asking for, reply to this email. We have been in those rooms.