search

oblador / react-native-keychain

:key: Keychain Access for React Native
MIT License
3.19k stars 520 forks source link

Android decrypts and gets data without fingerprint prompt #235

Open pani7 opened 5 years ago

pani7 commented 5 years ago

Hi, on ios after implementing basic example i get touchId prompt to authenticate with fingerprint to get data, but on android it just gets data and decrypts it without any prompt for fingerprint. I just get it immediately. Is this correct behavior? Should i implement fingerprint prompt for android separately with other library and then upon success auth get data from keystore?

Thanks for your help

EnricoMazzu commented 5 years ago

Hi pani7,

watching the source code i found this:

@TargetApi(Build.VERSION_CODES.M)
private KeyGenParameterSpec.Builder getKeyGenSpecBuilder(String service) {
    return new KeyGenParameterSpec.Builder(
            service,
            KeyProperties.PURPOSE_DECRYPT | KeyProperties.PURPOSE_ENCRYPT)
        .setBlockModes(ENCRYPTION_BLOCK_MODE)
        .setEncryptionPaddings(ENCRYPTION_PADDING)
        .setRandomizedEncryptionRequired(true)
        //.setUserAuthenticationRequired(true) // Will throw InvalidAlgorithmParameterException if there is no fingerprint enrolled on the device
        .setKeySize(ENCRYPTION_KEY_SIZE);
}

as you can see the setUserAuthenticationRequired is currently disabled.

I'm afraid you will have to wait the merge of this pull request: 148

Without the setUserAuthenticationRequired, you can use the generated key (that lives in keystore) without the user authentication (technically you could use the key with the device locked).

From the security perspective, The key material is relative protected (because the private key leaves out of your process memory), but with hooking an attacker was able to use this key without the user authentication.

fendorio commented 5 years ago

Running into the same issue, trying out a couple of the forks mentioned in the thread in the interim, no such luck thus far.

Anyone using a fork, or similar library for now which provides the functionality on Android?

OleksandrKucherenko commented 4 years ago

https://github.com/oblador/react-native-keychain/pull/260 - correct implementation of the biometric in lib... waiting fo it merge and global spreading :)

lancesnider commented 4 years ago

5.0.0 appears to have fixed the problem. I'm no longer running into this issue. Thanks! 🌮🌮🌮

franconob commented 3 years ago

I'm still experiencing this issue with v6.2.0 on a Xiaomi Mi 9, Android doesn't prompt for fingerprint and gets the data automatically from the keychain