Technology: how SenseCrypt PKI generates a key

The primitive

A person-bound root of trust.

SenseCrypt PKI ties a key pair to a live person instead of a stored secret.

The public key you stored keeps working, while the private key never has to exist between operations.

≥256BITS

Residual-entropy construction target

The entropy figure is a construction target, not a measurement or NIST certification.

Four disciplines in one construction

Machine learning

A high-dimensional random projection of the face embedding separates genuine and impostor margins by design.

PQC

Post-quantum cryptography

ML-DSA (FIPS 204) signatures and ML-KEM (FIPS 203) key encapsulation in SenseCrypt PKI, alongside classical secp256k1.

Zero-knowledge proofs

STARK-based proofs with a transparent setup, so there is no trusted ceremony to compromise. Used in SenseCrypt ZKP.

ECC

Soft-decision error correction

Confidence-weighted decoding tolerates the natural variation between two captures of the same face.

Fig. — generated at useSenseCrypt PKI

Private key: generated in memory for one operation, then discarded
Retained: public key

Post-quantum, precisely

Post-quantum design. Clear algorithm boundaries.

SenseCrypt PKI offers ML-DSA (FIPS 204) signatures and ML-KEM (FIPS 203) key encapsulation, alongside classical secp256k1. You choose the algorithm per key. Post-quantum protection comes from those algorithms; the never-saved private key is a separate property.

The named exceptions are classical. SenseCrypt IdP federation signs ID tokens and access tokens with ES256, and SAML assertions with RSA. The IdP's sealed face token is quantum-safe for a narrower reason: it uses only symmetric and hash primitives (AES-256-GCM, HKDF-SHA256, SHA-256).

Identity continuity

Person-bound, not device-bound.

The key belongs to the enrolled person, not to a phone or a hardware token. Key generation tolerates natural change in a face within the evaluated range; long-lived SensePrints are still refreshed and revoked through their lifecycle.

In SenseCrypt IdP, the target device (a browser, kiosk or shared terminal) needs no enrollment, while the phone methods use the enrolled phone. A lost phone is replaced through verified contact and a new device key, not by re-enrolling the face.

Capture assurance

Check for a live person before generating the key.

Each SenseCrypt PKI operation runs presentation-attack detection on the capture before the key is generated. Liveness is tested by iBeta to ISO/IEC 30107-3 Levels 1 and 2. Injection attacks are handled by separate controls.

Offline verificationA SensePrint can be carried as a printed QR. A prepared verifier checks the credential and live holder locally using trusted issuer material. Offline revocation assurance depends on the verifier’s last update.

Evaluation

Evidence you can check.

NIST

NIST FRTE since 2021

Seventh Sense's face recognition has been evaluated in NIST FRTE under Seventh Sense's own name since 2021. The report card lists the evaluated algorithm, track and dates.

Open the NIST report card

Patent

Patent-pending face tokenization

The method that turns a face into a sealed token, one that cannot be reversed into a face, is patent-pending.

Docs

Public documentation

The REST server API and the Python, Android and iOS SDKs are documented at docs.sensecrypt.com, including every SenseCrypt PKI endpoint.

Read the documentation

A signing key your face generates. Never saved.