Android: Fingerprint authentication not implemented yet

[alexanderjarvis]

It's possible to get if the device supports fingerprint authentication with getSupportedBiometryType() but the keychain item doesn't use the fingerprint authentication (or provide options for doing so).

Looking at

react-native-keychain/android/src/main/java/com/oblador/keychain/cipherStorage/CipherStorageKeystoreAESCBC.java

Line 71 in c4b2b4d

//.setUserAuthenticationRequired(true) // Will throw InvalidAlgorithmParameterException if there is no fingerprint enrolled on the device

The code is commented out. I've tried playing with this feature and uncommenting the code and even passing if the device supports fingerprint auth as an extra argument to encrypt.

However I can't get it working and there's nothing in the logs to suggest what is wrong.

[oblador]

@alexanderjarvis It's on the todo, but I'm afraid my Android skills are somewhat lacking and the scope of work is fairly big. Storing it with fingerprint encryption isn't that hard, but unlocking it is a pretty big task as it involves a fair bit of UI and logic on how to handle retries etc which iOS neatly just handles for you. I'd be eternally grateful for help with this and could brief anybody willing to take a stab at it of the complexities involved.

[alexanderjarvis]

@oblador thanks for your reply. It's a shame that unlocking it is not so straightforward. If I get some time I may look at doing it and create a PR.

[pcoltau]

I would recommend that we don't add any UI to this library, but simply notify (through an event?) the app when authentication is needed and then wait for the app to tell us if that was successful or not and then proceed.

[FlaviooLima]

Hope to see this implemented soon :)
With this implemented this package can go to the 🌔 🚀 🚀 🚀 🚀

[oblador]

Any takers to help out with this? 🙏

[jacksontbryan]

React native touch id has done some work around fingerprint.

https://github.com/naoufal/react-native-touch-id/tree/master/android

Could this work be leveraged to accelerate this feature?

[cladjules]

Let me try to add some native code to Android. See how we could link that up easily and PR.

[LinusU]

API Level 28 introduces a complete dialog for this: https://developer.android.com/reference/android/hardware/biometrics/BiometricPrompt

Here is a compat lib: https://github.com/fython/BiometricPromptCompat

I of course found all of this just after implementing it myself 😭 😂

@oblador what do you think about shipping with this dialog? I could possibly whip up a PR, need this in an app I'm working on...

[cladjules]

@oblador @LinusU I have started some work around it, using the current API (FingerPrintManager), which doesn't offer a native UI for it, you have to implement your own.

At least the logic is there, the only problem, for now, is, you have to put your fingerprint to Encode as well as to Decode the keychain.
I have seen some scenario, where the encoding doesn't require your fingerprint.
https://github.com/cladjules/react-native-keychain

I believe it's a matter of using a different algorithm.

[LinusU]

I have a working implementation of UI + logic here: https://github.com/LinusU/react-native-biopass

It's using RSA so that it doesn't require a fingerprint to encode, only to decode.

I'd be interested in PRing that up to this repo if we want to include the UI part here. That way I would get iOS support without implementing it myself ☺️

[cladjules]

@LinusU That's really good.

I managed to merge some of your code into my PR.
You can now encrypt without using fingerprint and decrypt using it.
https://github.com/cladjules/react-native-keychain

At least, there is now a separate cipherStorage so it's easier to manage and in a different file.

I will try and add the BiometricPromptCompat so it uses both Compat and BiometricPrompt code.

[LinusU]

I will try and add the BiometricPromptCompat so it uses both Compat and BiometricPrompt code.

That's awesome!

Let me know if you need any help ☺️

[Jyrno42]

Since I needed this asap I took the modifications by @cladjules and rebased them to master. Then I did a naive integration with BiometricPromptCompat. Feel free to use it (or not use it).

Note: I also bumped the ENCRYPTION_KEY_SIZE to 512 for CipherStorageKeystoreRSAECB since I need to store more than 53 characters.

E: added note