Four Unlock Modes & Hardware Secure Enclave Face ID

Forcing every user onto a single rigid unlock gesture creates public shoulder-surfing risks or muscle-memory lockouts. Vaultron supports four unlock modes backed by 600,000-round PBKDF2-HMAC-SHA512 and optional Apple Secure Enclave hardware key wrapping.

6+ Digit Numeric PIN

Fast one-handed numeric entry with exponential backoff delays after failed attempts and optional 14-day PIN rehearsal reminders when Face ID is active.

Full Alphanumeric Passphrase

High-entropy ASCII or Unicode passphrases normalized via NFKD canonicalization for maximum offline brute-force resistance on archival .vaultbackup exports.

5x5 Pattern Grid

25-node spatial pattern lock requiring at least 6 unique dots and at least 1 direction change, with automatic colinear dot bridging and deterministic PBKDF2 serialization.

Optional Secure Enclave Face ID / Touch ID

Wraps Slot 2 using a non-exportable Secure Enclave NIST P-256 keypair (113-byte ECIES AES-GCM envelope bound to biometryCurrentSet). Disable biometrics in one tap before travel.

Implementation Details

Key Derivation Function PBKDF2-HMAC-SHA512, 600,000 iterations, 256-bit CSPRNG salt per slot

Biometric Hardware Binding Secure Enclave P-256 ECIES (eciesEncryptionCofactorVariableIVX963SHA256AESGCM)

Biometric Enrollment Change Adding or changing a Face ID / Touch ID enrollment invalidates Slot 2 in silicon automatically

PIN Memory Rehearsal Configurable 7 to 30 day reminder (14 days default) prevents forgotten passcodes when using Face ID

Questions & Answers

Why does Vaultron make Face ID optional rather than removing biometrics?

Typing a passcode or drawing a visible pattern on a crowded train or under overhead cameras exposes your credential to shoulder-surfing. Hardware Secure Enclave Face ID prevents visual capture during everyday use, while a single toggle disables Slot 2 whenever legal or border coercion is a concern.

Can someone who knows my iPhone unlock passcode open Vaultron?

Never. Unlike Apple Photos Hidden Album, Vaultron derives its Master Vault Key from a separate credential that iOS never shares with your device unlock code.