setInvalidatedByBiometricEnrollment property

bool? setInvalidatedByBiometricEnrollment
getter/setter pair

Android/iOS/macOS Whether to invalidate the key when new biometrics are enrolled. Defaults to true on all platforms. Not supported on Windows.

Security Note: When true, keys become invalid if fingerprints/faces are added or removed, preventing unauthorized access if an attacker enrolls their own biometrics on a compromised device. The app must then create a new key and re-enroll its public key with the server.

Platform behaviour:

  • Android: maps to KeyGenParameterSpec.Builder .setInvalidatedByBiometricEnrollment(...). API 23 has no such setter, so keys there are always invalidated on enrollment changes.
  • iOS/macOS: selects the Secure Enclave access-control flag — .biometryCurrentSet when true, .biometryAny when false.
  • Windows: ignored — Windows Hello manages key lifetime itself.

Ignored when requireAuthentication is false: a key with no user-authentication constraint is not tied to the enrolled biometric set.

Implementation

bool? setInvalidatedByBiometricEnrollment;