Slow biometric unlock on Pixel 11 (StrongBox operations taking ~2.2 seconds)
Hello 1password team!
I recently upgraded from a Pixel 8 to a Pixel 11 and noticed that 1Password is significantly slower to unlock using biometrics. It used to take less than a second on my Pixel 8, but now takes several seconds on the Pixel 11.
Interestingly, biometric authentication itself is very fast. The delay happens afterwards, while 1Password appears to be decrypting the key needed to unlock the vault.
A few things I've established:
- This isn't a cold-start issue. The delay also happens when locking and unlocking 1Password while the app is already open.
- Unlocking with my account password is virtually instantaneous.
- Airplane mode and restarting the phone make no difference.
- Both phones were running the same Android and 1Password versions during the migration. However, the Pixel 8's biometric unlock had been configured some time ago, whereas the Pixel 11's was newly configured.
I captured a logcat trace during biometric unlock and found something interesting:
01:12:17.177 D BiometricLogger:
Authenticated! Modality: face, latency: 314
01:12:18.972 W keystore2:
Keystore Watchdog report
Operation::finish: calling IKeyMintOperation::finish
Pending: ~500ms for r#STRONGBOX
01:12:20.685 W libbinder.Binder:
Binder transaction to
android.hardware.security.keymint.IKeyMintOperation
function: finish, took 2209ms
01:12:20.685 I keystore2:
Watchdog complete for IKeyMintOperation::finish
Pending: 2.214s for r#STRONGBOX
Here's the timeline of that unlock attempt:
| Time | Event |
|---|---|
| 01:12:16.839 | 1Password begins biometric unlock |
| 01:12:17.177 | Face successfully recognised (+338ms) |
| 01:12:18.105 | 1Password receives successful biometric result (+1.27s) |
| 01:12:18.471 | StrongBox operation begins (+1.63s) |
| 01:12:20.685 | StrongBox operation completes (+3.85s) |
| 01:12:20.788 | 1Password reports vault unlocked (+3.95s) |
The StrongBox operation consistently takes approximately 2.2 seconds across multiple attempts, accounting for most of the delay. Android's Keystore watchdog also flags the operation after 500ms.
I'm wondering whether this might be related to 1Password's recent changes to its Android secure-enclave implementation. Could newly provisioned biometric keys now be StrongBox-backed, while older installations were using TEE-backed keys? Alternatively, perhaps the Pixel 11's StrongBox implementation is simply slower at this particular operation.
Could the 1Password team investigate whether this latency is expected and whether there's an opportunity to optimise biometric unlock?
Specifically, I'd be interested in whether the team could:
- Reproduce and profile the ~2.2-second
IKeyMintOperation::finishoperation on a Pixel 11. - Confirm whether the recent secure-enclave changes introduced a different Keystore backend or key configuration.
- Investigate whether a different cryptographic operation, key configuration, or approach could reduce the latency without compromising security.
I appreciate that StrongBox is generally slower than TEE-backed Keystore, but I wouldn't expect every StrongBox operation to take over two seconds. The fact that the watchdog flags this operation makes me wonder whether there's scope for improvement.
Is this already being tracked as a performance regression? I'd be happy to provide additional diagnostics or test potential fixes if that would help.