Your live biometric generates post-quantum PKI key-pairs in memory. Private keys exist only during face sign or face decapsulate and are discarded afterwards. Public keys, signatures and decapsulated shared secrets go directly to relying party endpoints, without the IdP seeing them. Store public keys and use standard cryptographic libraries supporting the chosen algorithms for signature verification and key encapsulation.
Stored private signing keys require protection throughout their lifecycle. SenseCrypt PKI generates private keys from a live biometric only during face sign or face decapsulate. Public keys remain stored for verification and encapsulation. Public keys, signatures and decapsulated shared secrets go directly to relying party endpoints, without the IdP seeing them.
PKI generates the post-quantum private key from the live biometric for face sign or face decapsulate. No stored copy of that private key is retrieved. Public keys remain stored and usable without regenerating the private key. Public keys, signatures and decapsulated shared secrets go directly to relying party endpoints, without the IdP seeing them.
A live biometric generates post-quantum PKI key-pairs in memory. Store the public keys; the private keys exist only during face sign or face decapsulate operations and are never stored. Face sign produces a signature that anyone holding the public key can verify with a compatible standard library. Encapsulation also uses the stored public key; face decapsulate regenerates the private key for that operation. Public keys, signatures and decapsulated shared secrets go directly to relying party endpoints, without the IdP seeing them.
PKI: public and private key lifecycles
Explore the four stages.
Your live biometric generates PKI private keys for face sign or face decapsulate. Private keys exist only during that operation.
PKI lifecycle: generate the post-quantum key-pair in memory, use the private key for face sign or face decapsulate, then discard it. Outputs go directly to relying party endpoints, without the IdP seeing them.
Face sign uses a post-quantum private key generated in memory from the live biometric. The private key is never stored; the signature and public key remain available for independent verification. Applications must bind the signed data to the intended approval or document.
The split-verification design separates roles in establishing the enrolled person’s certificate. The person’s PKI private keys are generated in memory for face sign or face decapsulate and never stored. Public keys and certificates are retained; the CA’s issuer key has its own custody lifecycle. Public keys, signatures and decapsulated shared secrets go directly to relying party endpoints, without the IdP seeing them.
Use stored PKI public keys with standard libraries supporting ML-DSA for signature verification and ML-KEM for encapsulation. Private-key face sign and face decapsulate use the biometric operation. IdP federation remains a separate integration.