Nowadays, many mobile phones have supported unlocking through fingerprint recognition. However, both iOS and Android require users to enter the password after the device is rebooted, even though an authorized fingerprint is given.

My question is: why?

First:


password is used to get access to the full disk encryption key
fingerprint is used to unlock the screen (of an already "decrypted" device)


Encryption key retrieval must be:


accurate - on each entry, the device must transform the password through a key-derivation function into the one and only correct encryption key, otherwise the device won't be able to decrypt the data
secure - derived through a one-way function, not "unlocked" by comparing data provided by a user with a pattern stored on the device


Fingerprint recognition does not meet the above requirements, it is:


fuzzy - on each press the sensor provides the device an approximate image of a part of a fingerprint which is matched at a certain accuracy; on each verification attempt the actual data differs due to different position, skew, press strength
non-secure - recognition is performed by comparing the actual fingerprint with the data stored on the device - this data must be both readable and modifiable which makes it vulnerable to an attacker

