RedMadRobot / PINkman

PINkman is a library to help implementing an authentication by a PIN code in a secure manner. The library derives hash from the user's PIN using Argon2 function and stores it in an encrypted file. The file is encrypted with the AES-256 algorithm in the GCM mode and keys are stored in the AndroidKeystore.
MIT License
85 stars 11 forks source link

Add module with biometrics #14

Closed osipxd closed 3 years ago

osipxd commented 4 years ago

It would be great to be able to enable biometric authentication "with one line of code". I have not thought about the API yet.

Fi5t commented 3 years ago

Nice idea. I'll think about it try to implement it as a separate module.

Fi5t commented 3 years ago

@osipxd, I thought about it a lot and decided that any biometric operations are not the responsibility of this library. If you want "one shot" biometric implementation, I highly recommended paying your attention to the androidx.biometric:biometric-ktx package. Using it, you'll be able to do things like that:

    val cryptoObject = BiometricPrompt.CryptoObject(cipher)
    val payload = "A message to encrypt".toByteArray(Charset.defaultCharset())

    // Construct AuthPrompt with localized Strings to be displayed to UI.
    val authPrompt = Class3BiometricAuthPrompt.Builder(title, negativeButtonText).apply {
        setSubtitle(subtitle)
        setDescription(description)
        setConfirmationRequired(true)
    }.build()

    try {
        val authResult = authPrompt.authenticate(AuthPromptHost(this), cryptoObject)

        // Encrypt a payload using the result of crypto-based auth.
        val encryptedPayload = authResult.cryptoObject?.cipher?.doFinal(payload)

        // Use the encrypted payload somewhere interesting.
        sendEncryptedPayload(encryptedPayload)
    } catch (e: AuthPromptErrorException) {
        // Handle irrecoverable error during authentication.
        // Possible values for AuthPromptErrorException.errorCode are listed in the @IntDef,
        // androidx.biometric.BiometricPrompt.AuthenticationError.
    } catch (e: AuthPromptFailureException) {
        // Handle auth failure due biometric credentials being rejected.
    }

Details here