Overview of Biometric Auth

OVERVIEW OF BIOMETRIC AUTH MICHAEL BAILEY PRINCIPAL ENGINEER AT AMERICAN
EXPRESS @YOGURTEARL

https://americanexpress.io/android-jobs

NOT SECURITY ADVICE Information in this talk should not be
taken as security advice.The security needs of every application are different. Consult an InfoSec professional when designing and implementing security for your application.

BIOMETRIC AUTH

“LEGACY” FINGERPRINT MANAGER APIS - API 23+ package android.hardware.fingerprint; public
class FingerprintManager { public boolean isHardwareDetected() public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) }

“LEGACY” FINGERPRINT MANAGER APIS - API 23+ <manifest xmlns:android="http:!"schemas.android.com/apk/res/android"> <uses-permission
android:name="android.permission.USE_FINGERPRINT"#$ %&manifest>

“LEGACY” FINGERPRINT MANAGER APIS - API 23+ val fp: FingerprintManager
= requireContext() .getSystemService(FingerprintManager'(class.java)

“LEGACY” FINGERPRINT MANAGER APIS - API 23+ if (Build.VERSION.SDK_INT )*
23) { val fp: FingerprintManager = requireContext() .getSystemService(FingerprintManager'(class.java) … }

class FingerprintManager { public boolean isHardwareDetected() public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } public boolean isHardwareDetected()

23) { val fp: FingerprintManager = requireContext() .getSystemService(FingerprintManager'(class.java) if (fp.isHardwareDetected) { !" Some low end devices don’t have fingerprint sensor !" or sensor can’t be used to unlock keys } } if (fp.isHardwareDetected) { !" Some low end devices don’t have fingerprint sensor !" or sensor can’t be used to unlock keys

“LEGACY” FINGERPRINT MANAGER APIS - API 23+ context.getPackageManager().hasSystemFeature(FEATURE_FINGERPRINT)

class FingerprintManager { public boolean isHardwareDetected() public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } public boolean hasEnrolledFingerprints()

23) { val fp: FingerprintManager = requireContext() .getSystemService(FingerprintManager'(class.java) if (fp.isHardwareDetected) { if (fp.hasEnrolledFingerprints()){ fp.authenticate(+,-) } else { !" tell user to go setup fingerprints in OS settings } } } if (fp.hasEnrolledFingerprints()){

“LEGACY” FINGERPRINT MANAGER APIS - API 23+ Caused by: java.lang.SecurityException:
Permission Denial: getCurrentUser() from pid=12045, uid=10028 r android.permission.INTERACT_ACROSS_USERS at android.os.Parcel.readException(Parcel.java:1620) at android.os.Parcel.readException(Parcel.java:1573) at android.hardware.fingerprint. IFingerprintService$Stub$Proxy.hasEnrolledFingerprints(IFingerpr at android.hardware.fingerprint. FingerprintManager.hasEnrolledFingerprints(FingerprintManager.ja java.lang.SecurityException: FingerprintManager.hasEnrolledFingerprints

23) { val fp: FingerprintManager = requireContext() .getSystemService(FingerprintManager'(class.java) if (fp.isHardwareDetected) { if (fp.hasEnrolledFingerprints()){ +,- } else { !" tell user to go setup fingerprints in OS settings } } } if (fp.hasEnrolledFingerprints()){ !" tell user to go setup fingerprints in OS settings

class FingerprintManager { public boolean isHardwareDetected() public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler)

if (Build.VERSION.SDK_INT )* 23) { val fp: FingerprintManager = requireContext()
.getSystemService(FingerprintManager'(class.java) if (fp.isHardwareDetected) { if (fp.hasEnrolledFingerprints()){ fp.authenticate(+,-) } else { !" tell user to go setup fingerprints in OS settings } } } fp.authenticate(+,-) “LEGACY” FINGERPRINT MANAGER APIS - API 23+

class FingerprintManager { public boolean isHardwareDetected() public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler)

FingerprintDialogKotlin https://github.com/android/security-samples/tree/master/FingerprintDialogKotlin

FingerprintDialogKotlin

android.os.CancellationSignal package android.hardware.fingerprint; public class FingerprintManager { public boolean isHardwareDetected()
public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } @Nullable CancellationSignal cancel,

android.os.CancellationSignal val cancel = CancellationSignal() fp.authenticate(+,-, cancel,+,-) cancelButton.setOnClickListener { cancel.cancel()
}

FingerprintManager.authenticate() package android.hardware.fingerprint; public class FingerprintManager { public boolean isHardwareDetected()
public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } int flags,

public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } Handler handler

CryptoObject package android.hardware.fingerprint; public class FingerprintManager { public boolean isHardwareDetected()
public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } @Nullable CryptoObject crypto

CryptoObject package android.hardware.fingerprint; public class FingerprintManager { public static final
class CryptoObject { public CryptoObject(@NonNull Signature signature) {…} public CryptoObject(@NonNull Cipher cipher) {…} public CryptoObject(@NonNull Mac mac) {…} public Signature getSignature() {…} public Cipher getCipher() {…} public Mac getMac() {…} } } public static final class CryptoObject { public CryptoObject(@NonNull Signature signature) {…} public CryptoObject(@NonNull Cipher cipher) {…} public CryptoObject(@NonNull Mac mac) {…} public java.security.Signature getSignature() {…} public javax.crypto.Cipher getCipher() {…} public javax.crypto.Mac getMac() {…} }

public boolean hasEnrolledFingerprints() public void authenticate(@Nullable CryptoObject crypto, @Nullable CancellationSignal cancel, int flags, @NonNull AuthenticationCallback callback, Handler handler) } @NonNull AuthenticationCallback callback

FingerprintManager.authenticate() package android.hardware.fingerprint; public class FingerprintManager { public static abstract
class AuthenticationCallback { public void onAuthenticationError(int errorCode, CharSequence errString) public void onAuthenticationHelp(int helpCode, CharSequence helpString) public void onAuthenticationFailed() public void onAuthenticationSucceeded(AuthenticationResult result) } } AuthenticationCallback onAuthenticationError

class AuthenticationCallback { public void onAuthenticationError(int errorCode, CharSequence errString) public void onAuthenticationHelp(int helpCode, CharSequence helpString) public void onAuthenticationFailed() public void onAuthenticationSucceeded(AuthenticationResult result) } } AuthenticationCallback onAuthenticationHelp

class AuthenticationCallback { public void onAuthenticationError(int errorCode, CharSequence errString) public void onAuthenticationHelp(int helpCode, CharSequence helpString) public void onAuthenticationFailed() public void onAuthenticationSucceeded(AuthenticationResult result) } } AuthenticationCallback onAuthenticationFailed

class AuthenticationCallback { public void onAuthenticationError(int errorCode, CharSequence errString) public void onAuthenticationHelp(int helpCode, CharSequence helpString) public void onAuthenticationFailed() public void onAuthenticationSucceeded(AuthenticationResult result) } } AuthenticationCallback onAuthenticationSucceeded(AuthenticationResult result)

FingerprintManager.authenticate() package android.hardware.fingerprint; public class FingerprintManager { public static class
AuthenticationResult { public CryptoObject getCryptoObject() } } public static class AuthenticationResult { public CryptoObject getCryptoObject() }

AndroidX FingerprintManagerCompat package androidx.core.hardware.fingerprint; public class FingerprintManagerCompat { … }
implementation "androidx.core:core:$androidx_core_version"

AndroidX FingerprintManagerCompat package androidx.core.hardware.fingerprint; public class FingerprintManagerCompat { … }
DEPRECATED implementation "androidx.core:core:$androidx_core_version"

BIOMETRIC PROMPT APIS - API 28+ package android.hardware.biometrics; public class
BiometricPrompt { public static class Builder { public Builder(Context) public Builder setTitle(CharSequence) public Builder setSubtitle(CharSequence) public Builder setDescription(CharSequence) public Builder setNegativeButton(CharSequence) public Builder setConfirmationRequired(boolean) !" API 29 public Builder setDeviceCredentialAllowed(boolean) !" API 29 public BiometricPrompt build() } public void authenticate(@NonNull CryptoObject crypto, @NonNull CancellationSignal cancel, @NonNull Executor executor, @NonNull AuthenticationCallback callback) }

BiometricPrompt { public static class Builder { public Builder(Context) public Builder setTitle(CharSequence) public Builder setSubtitle(CharSequence) public Builder setDescription(CharSequence) public Builder setNegativeButton(CharSequence) public Builder setConfirmationRequired(boolean) public Builder setDeviceCredentialAllowed(boolean) public BiometricPrompt build() } public void authenticate(@NonNull CryptoObject crypto, @NonNull CancellationSignal cancel, @NonNull Executor executor, @NonNull AuthenticationCallback callback) } public BiometricPrompt build()

BiometricPrompt { public static class Builder { public Builder(Context) public Builder setTitle(CharSequence) public Builder setSubtitle(CharSequence) public Builder setDescription(CharSequence) public Builder setNegativeButton(CharSequence) public Builder setConfirmationRequired(boolean) public Builder setDeviceCredentialAllowed(boolean) public BiometricPrompt build() } public void authenticate(@NonNull CryptoObject crypto, @NonNull CancellationSignal cancel, @NonNull Executor executor, @NonNull AuthenticationCallback callback) } @NonNull Executor executor, authenticate(

BiometricPrompt { public static class Builder { public Builder(Context) public Builder setTitle(CharSequence) public Builder setSubtitle(CharSequence) public Builder setDescription(CharSequence) public Builder setNegativeButton(CharSequence) public Builder setConfirmationRequired(boolean) public Builder setDeviceCredentialAllowed(boolean) public BiometricPrompt build() } public void authenticate(@NonNull CryptoObject crypto, @NonNull CancellationSignal cancel, @NonNull Executor executor, @NonNull AuthenticationCallback callback) } authenticate(

BiometricPrompt { public static class Builder { public Builder(Context) public Builder setTitle(CharSequence) public Builder setSubtitle(CharSequence) public Builder setDescription(CharSequence) public Builder setNegativeButton(CharSequence) public Builder setConfirmationRequired(boolean) !" API 29+ public Builder setDeviceCredentialAllowed(boolean) !" API 29+ public BiometricPrompt build() } public void authenticate(@NonNull CryptoObject crypto, @NonNull CancellationSignal cancel, @NonNull Executor executor, @NonNull AuthenticationCallback callback) }

BiometricManager { @IntDef({BIOMETRIC_SUCCESS, BIOMETRIC_ERROR_HW_UNAVAILABLE, BIOMETRIC_ERROR_NONE_ENROLLED, BIOMETRIC_ERROR_NO_HARDWARE}) @interface BiometricError {} public @BiometricError int canAuthenticate() }

BIOMETRIC PROMPT APIS if (VERSION.SDK_INT )* VERSION_CODES.Q) { val biometricManager
= this.getSystemService(BiometricManager'(class.java) when (biometricManager.canAuthenticate()) { !" Suppress biometric UI BIOMETRIC_ERROR_NO_HARDWARE, BIOMETRIC_ERROR_HW_UNAVAILABLE ./ suppressBiometrics() !" ask user to Enroll BIOMETRIC_ERROR_NONE_ENROLLED ./ startActivity(Intent(ACTION_FINGERPRINT_ENROLL)) !" Use biometrics BIOMETRIC_SUCCESS ./ { val biometricPrompt = BiometricPrompt.Builder(this) .setTitle("Login") .build() biometricPrompt.authenticate(+,-) } } }

CHALLENGES • FingerprintManager • API 23+ • No UI provided
• no Iris or Face Auth • BiometricPrompt • API 28+ • Provides a UI • BiometricManager.canAuthenticate() only API 29+

androidx.biometric - API 14+ implementation "androidx.biometric:biometric:1.0.0-rc02"

androidx.biometric - API 14+ val biometricManager = BiometricManager.from(context) when (biometricManager.canAuthenticate())
{ !" Suppress biometric UI BIOMETRIC_ERROR_NO_HARDWARE, BIOMETRIC_ERROR_HW_UNAVAILABLE ./ suppressBiometrics() !" ask user to Enroll BIOMETRIC_ERROR_NONE_ENROLLED ./ startActivity(Intent(ACTION_FINGERPRINT_ENROLL)) !" Use biometrics BIOMETRIC_SUCCESS ./ { val promptInfo = BiometricPrompt.PromptInfo.Builder() .setTitle("Login") .build() val biometricPrompt = BiometricPrompt(fragmentActivity, executor, authenticationCallback) biometricPrompt.authenticate(promptInfo, cryptoObject) } } BiometricManager.from(context)

{ !" Suppress biometric UI BIOMETRIC_ERROR_NO_HARDWARE, BIOMETRIC_ERROR_HW_UNAVAILABLE ./ suppressBiometrics() !" ask user to Enroll BIOMETRIC_ERROR_NONE_ENROLLED ./ startActivity(Intent(ACTION_FINGERPRINT_ENROLL)) !" Use biometrics BIOMETRIC_SUCCESS ./ { val promptInfo = BiometricPrompt.PromptInfo.Builder() .setTitle("Login") .build() val biometricPrompt = BiometricPrompt(fragmentActivity, executor, authenticationCallback) biometricPrompt.authenticate(promptInfo, cryptoObject) } } biometricManager.canAuthenticate()

{ !" Suppress biometric UI BIOMETRIC_ERROR_NO_HARDWARE, BIOMETRIC_ERROR_HW_UNAVAILABLE ./ suppressBiometrics() !" ask user to Enroll BIOMETRIC_ERROR_NONE_ENROLLED ./ startActivity(Intent(ACTION_FINGERPRINT_ENROLL)) !" Use biometrics BIOMETRIC_SUCCESS ./ { val promptInfo = BiometricPrompt.PromptInfo.Builder() .setTitle("Login") .build() val biometricPrompt = BiometricPrompt(fragmentActivity, executor, authenticationCallback) biometricPrompt.authenticate(promptInfo, cryptoObject) } } BiometricPrompt.PromptInfo.Builder()

{ !" Suppress biometric UI BIOMETRIC_ERROR_NO_HARDWARE, BIOMETRIC_ERROR_HW_UNAVAILABLE ./ suppressBiometrics() !" ask user to Enroll BIOMETRIC_ERROR_NONE_ENROLLED ./ startActivity(Intent(ACTION_FINGERPRINT_ENROLL)) !" Use biometrics BIOMETRIC_SUCCESS ./ { val promptInfo = BiometricPrompt.PromptInfo.Builder() .setTitle("Login") .build() val biometricPrompt = BiometricPrompt(fragmentActivity, executor, authenticationCallback) biometricPrompt.authenticate(promptInfo, cryptoObject) } } BiometricPrompt(fragmentActivity,

{ !" Suppress biometric UI BIOMETRIC_ERROR_NO_HARDWARE, BIOMETRIC_ERROR_HW_UNAVAILABLE ./ suppressBiometrics() !" ask user to Enroll BIOMETRIC_ERROR_NONE_ENROLLED ./ startActivity(Intent(ACTION_FINGERPRINT_ENROLL)) !" Use biometrics BIOMETRIC_SUCCESS ./ { val promptInfo = BiometricPrompt.PromptInfo.Builder() .setTitle("Login") .build() val biometricPrompt = BiometricPrompt(fragmentActivity, executor, authenticationCallback) biometricPrompt.authenticate(promptInfo, cryptoObject) } } biometricPrompt.authenticate(

API 23 API 29

API 28 API 28 API 28

hasSystemFeature() !" API 24 context.getPackageManager().hasSystemFeature(FEATURE_FINGERPRINT) !" API 29 context.getPackageManager().hasSystemFeature(FEATURE_IRIS) !"
API 29 context.getPackageManager().hasSystemFeature(FEATURE_FACE)

KeyGenParameterSpec val keyGenerator = KeyGenerator.getInstance(KEY_ALGORITHM_AES, "AndroidKeyStore") keyGenerator.init( Builder("BiometricKey", KeyProperties.PURPOSE_ENCRYPT or
KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setUserAuthenticationRequired(true) .setInvalidatedByBiometricEnrollment(true) !" API 24+ .build()) keyGenerator.generateKey()

KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setUserAuthenticationRequired(true) .setInvalidatedByBiometricEnrollment(true) !" API 24+ .build()) keyGenerator.generateKey() "AndroidKeyStore"

KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setUserAuthenticationRequired(true) .setInvalidatedByBiometricEnrollment(true) !" API 24+ .build()) keyGenerator.generateKey() "BiometricKey"

KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setUserAuthenticationRequired(true) .setInvalidatedByBiometricEnrollment(true) !" API 24+ .build()) keyGenerator.generateKey() .setUserAuthenticationRequired(true)

KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setUserAuthenticationRequired(true) .setInvalidatedByBiometricEnrollment(true) !" API 24+ .build()) keyGenerator.generateKey() .setInvalidatedByBiometricEnrollment(true)

KeyProperties.PURPOSE_DECRYPT) .setBlockModes(KeyProperties.BLOCK_MODE_GCM) .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE) .setUserAuthenticationRequired(true) .setInvalidatedByBiometricEnrollment(true) !" API 24+ .build()) keyGenerator.generateKey() .generateKey()

CryptoObject val keyStore: KeyStore = KeyStore.getInstance("AndroidKeyStore") keyStore.load(null)   val key
= keyStore.getKey("BiometricKey", null) as SecretKey val cipher: Cipher = Cipher.getInstance("AES/GCM/NoPadding") cipher.init(Cipher.DECRYPT_MODE, key)   val cryptoObject = BiometricPrompt.CryptoObject(cipher) "AndroidKeyStore"

= keyStore.getKey("BiometricKey", null) as SecretKey val cipher: Cipher = Cipher.getInstance("AES/GCM/NoPadding") cipher.init(Cipher.DECRYPT_MODE, key)   val cryptoObject = BiometricPrompt.CryptoObject(cipher) "BiometricKey"

= keyStore.getKey("BiometricKey", null) as SecretKey val cipher: Cipher = Cipher.getInstance("AES/GCM/NoPadding") cipher.init(Cipher.DECRYPT_MODE, key)   val cryptoObject = BiometricPrompt.CryptoObject(cipher) key key cipher cipher cryptoObject

Key Attestation https://developer.android.com/training/articles/security-key-attestation 1. Key Storage: Software, TrustedEnvironment, StrongBox 2.
User Authentication Type

FILE BUGS! https://issuetracker.google.com/issues/new?component=559537

DOCS • Authenticating to remote servers using the Fingerprint API
• https://android-developers.googleblog.com/2015/10/new-in-android-samples-authenticating.html • FingerprintManager Sample: • https://github.com/android/security-samples/tree/master/FingerprintDialogKotlin • Warning, always use CryptoObject, despite the example in this doc -> • https://developer.android.com/training/sign-in/biometric-auth • BiometricPrompt Sample: • https://android.googlesource.com/platform/frameworks/support/+/refs/ heads/androidx-master-dev/samples/BiometricDemos/

BIOMETRIC AUTH IMPORTANT TAKE AWAYS • Use androidx.biometric • Always
use CryptoObject • Consult with InfoSec Professionals

THANKS https://americanexpress.io/android-jobs

Code samples are   Copyright The Android Open Source Project
And Licensed under the Apache License, Version 2.0

Overview of Biometric Auth

Overview of Biometric Auth

More Decks by Michael Bailey

Other Decks in Programming

Featured

Transcript