android生物特征识别用户指纹上的NotAuthenticationDexception

webghufk  于 2021-08-20  发布在  Java
关注(0)|答案(1)|浏览(565)

我在示例应用程序中使用secretkey进行mac签名。该键是使用生成器参数生成的

  1. setUserAuthenticationValidityDurationSeconds(10)

允许使用指纹和（取消）锁定设备pin来保护我的钥匙。
ui仅包含用于启动签名的签名按钮。
如果我通过“使用pin”使用生物识别提示，输入pin后我会收到签名（在我的示例“2bjeusxl/BOTTUEXE4VTX2RNRZEC1ZFA21FOOKBFNC=”）[注意：预期行为]。
在给定的10秒钟“validityduration”时间内再次按下sign按钮，我可以成功使用指纹进行授权[注意：预期行为]。
10秒后按下sign（签名）按钮并使用指纹进行授权[或在未事先使用pin的情况下使用指纹]会出现异常[注意：非预期行为]：

  1. android.security.keystore.UserNotAuthenticatedException: User not authenticated

因此，我的问题是：如何使用相同的secretkey来使用pin和fingerprint选项授权签名过程（或者更好地使用从androidkeystore释放密钥）？
我正在android sdk 30（目标）和（最低）23上进行测试，生物识别功能可通过“androidx.biometric:biometric:1.1.0”实现。
以下是logcat调试输出，以及我方的一些评论：

  1. >>> first start
  2. 2021-07-04 14:23:47.178 6980-6980/de.biometrics D/*** Biometric ***: sign started
  3. 2021-07-04 14:23:47.181 6980-6980/de.biometrics D/*** Biometric ***: try to load secretKey from keystore
  4. 2021-07-04 14:23:47.211 6980-6980/de.biometrics D/*** Biometric ***: generated fresh key, try to load
  5. 2021-07-04 14:23:47.223 6980-6980/de.biometrics D/*** Biometric ***: UserNotAuthenticatedException thrown, try to authenticate
  7. >>> biometric prompt, used the PIN [authType = 1]:
  8. 2021-07-04 14:24:04.089 6980-6980/de.biometrics D/*** Biometric ***: Authentication succeeded with authType 1
  9. 2021-07-04 14:24:04.089 6980-6980/de.biometrics D/*** Biometric ***: (authType: 1=PIN, 2=fingerprint)
  10. 2021-07-04 14:24:04.092 6980-6980/de.biometrics D/*** Biometric ***: try to load secretKey from keystore
  11. 2021-07-04 14:24:04.097 6980-6980/de.biometrics D/signed data: a1wbBdybQkP30XWFBj0o8fiVrS8BXlREGmDHQQQhEwg=
  13. >>> pressed "SIGN" again after 5 seconds
  14. 2021-07-04 14:24:09.725 6980-6980/de.biometrics D/*** Biometric ***: sign started
  15. 2021-07-04 14:24:09.730 6980-6980/de.biometrics D/*** Biometric ***: try to load secretKey from keystore
  16. 2021-07-04 14:24:13.421 6980-6980/de.biometrics D/*** Biometric ***: Authentication succeeded with authType 2
  17. 2021-07-04 14:24:13.422 6980-6980/de.biometrics D/*** Biometric ***: (authType: 1=PIN, 2=fingerprint)
  18. 2021-07-04 14:24:13.426 6980-6980/de.biometrics D/*** Biometric ***: try to load secretKey from keystore
  19. 2021-07-04 14:24:13.432 6980-6980/de.biometrics D/signed data: a1wbBdybQkP30XWFBj0o8fiVrS8BXlREGmDHQQQhEwg=
  21. >>> pressed "SIGN" again 21 seconds after the PIN authorization
  22. 2021-07-04 14:24:23.348 6980-6980/de.biometrics D/*** Biometric ***: sign started
  23. 2021-07-04 14:24:23.359 6980-6980/de.biometrics D/*** Biometric ***: try to load secretKey from keystore
  24. 2021-07-04 14:24:23.366 6980-6980/de.biometrics D/*** Biometric ***: UserNotAuthenticatedException thrown, try to authenticate
  25. >>> fingerprint is accepted [authType = 2]
  26. 2021-07-04 14:24:25.356 6980-6980/de.biometrics D/*** Biometric ***: Authentication succeeded with authType 2
  27. 2021-07-04 14:24:25.356 6980-6980/de.biometrics D/*** Biometric ***: (authType: 1=PIN, 2=fingerprint)
  28. 2021-07-04 14:24:25.361 6980-6980/de.biometrics D/*** Biometric ***: try to load secretKey from keystore
  29. >>> the exception is thrown on line 86:
  30. >>> mac.init(getOrCreateSecretKey(KEY_NAME_SIGN));
  31. 2021-07-04 14:24:25.377 6980-6980/de.biometrics W/System.err: android.security.keystore.UserNotAuthenticatedException: User not authenticated
  32. 2021-07-04 14:24:25.377 6980-6980/de.biometrics W/System.err:     at android.security.KeyStore.getInvalidKeyException(KeyStore.java:1346)
  33. 2021-07-04 14:24:25.378 6980-6980/de.biometrics W/System.err:     at android.security.KeyStore.getInvalidKeyException(KeyStore.java:1388)
  34. 2021-07-04 14:24:25.379 6980-6980/de.biometrics W/System.err:     at android.security.keystore.KeyStoreCryptoOperationUtils.getInvalidKeyExceptionForInit(KeyStoreCryptoOperationUtils.java:54)
  35. 2021-07-04 14:24:25.379 6980-6980/de.biometrics W/System.err:     at android.security.keystore.AndroidKeyStoreHmacSpi.ensureKeystoreOperationInitialized(AndroidKeyStoreHmacSpi.java:184)
  36. 2021-07-04 14:24:25.380 6980-6980/de.biometrics W/System.err:     at android.security.keystore.AndroidKeyStoreHmacSpi.engineInit(AndroidKeyStoreHmacSpi.java:101)
  37. 2021-07-04 14:24:25.380 6980-6980/de.biometrics W/System.err:     at javax.crypto.Mac.chooseProvider(Mac.java:443)
  38. 2021-07-04 14:24:25.380 6980-6980/de.biometrics W/System.err:     at javax.crypto.Mac.init(Mac.java:513)
  39. 2021-07-04 14:24:25.380 6980-6980/de.biometrics W/System.err:     at de.biometrics.MainActivity$1.onAuthenticationSucceeded(MainActivity.java:86)
  40. 2021-07-04 14:24:25.381 6980-6980/de.biometrics W/System.err:     at androidx.biometric.BiometricFragment$9.run(BiometricFragment.java:907)
  41. 2021-07-04 14:24:25.381 6980-6980/de.biometrics W/System.err:     at android.os.Handler.handleCallback(Handler.java:938)
  42. 2021-07-04 14:24:25.381 6980-6980/de.biometrics W/System.err:     at android.os.Handler.dispatchMessage(Handler.java:99)
  43. 2021-07-04 14:24:25.382 6980-6980/de.biometrics W/System.err:     at android.os.Looper.loop(Looper.java:223)
  44. 2021-07-04 14:24:25.384 6980-6980/de.biometrics W/System.err:     at android.app.ActivityThread.main(ActivityThread.java:7656)
  45. 2021-07-04 14:24:25.385 6980-6980/de.biometrics W/System.err:     at java.lang.reflect.Method.invoke(Native Method)
  46. 2021-07-04 14:24:25.386 6980-6980/de.biometrics W/System.err:     at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592)
  47. 2021-07-04 14:24:25.386 6980-6980/de.biometrics W/System.err:     at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)

这是完整的源代码（mainactivity.java）：
编辑：我稍微修改了createkey函数，使其更符合上的文档https://developer.android.com/training/sign-in/biometric-auth#java

  1. package de.biometrics;
  3. import android.os.Bundle;
  4. import android.security.keystore.KeyGenParameterSpec;
  5. import android.security.keystore.KeyProperties;
  6. import android.security.keystore.UserNotAuthenticatedException;
  7. import android.util.Base64;
  8. import android.util.Log;
  9. import android.view.View;
  10. import android.widget.Button;
  12. import androidx.annotation.NonNull;
  13. import androidx.appcompat.app.AppCompatActivity;
  14. import androidx.biometric.BiometricPrompt;
  15. import androidx.core.content.ContextCompat;
  17. import java.io.IOException;
  18. import java.nio.charset.StandardCharsets;
  19. import java.security.InvalidAlgorithmParameterException;
  20. import java.security.InvalidKeyException;
  21. import java.security.KeyStore;
  22. import java.security.KeyStoreException;
  23. import java.security.NoSuchAlgorithmException;
  24. import java.security.NoSuchProviderException;
  25. import java.security.UnrecoverableKeyException;
  26. import java.security.cert.CertificateException;
  27. import java.util.concurrent.Executor;
  29. import javax.crypto.KeyGenerator;
  30. import javax.crypto.Mac;
  31. import javax.crypto.SecretKey;
  33. public class MainActivity extends AppCompatActivity {
  34.     // use dependency in build.graddle:
  35.     // implementation 'androidx.biometric:biometric:1.1.0'
  37.     private static final String KEY_NAME_SIGN = "SignKey";
  38.     private static final int VALIDITY_DURATION_SECONDS = 10;
  39.     private static final String APP_TAG = "***Biometric***";
  41.     private BiometricPrompt biometricPrompt;
  42.     private BiometricPrompt.PromptInfo promptInfo;
  43.     private Executor executor;
  44.     Button btnSign;
  45.     Mac mac;
  47.     @Override
  48.     protected void onCreate(Bundle savedInstanceState) {
  49.         super.onCreate(savedInstanceState);
  50.         setContentView(R.layout.activity_main);
  52.         executor = ContextCompat.getMainExecutor(this);
  53.         btnSign = (Button) findViewById(R.id.button);
  55.         // Allows user to authenticate using either a Class 3 biometric or
  56.         // their lock screen credential (PIN, pattern, or password).
  57.         promptInfo = new BiometricPrompt.PromptInfo.Builder()
  58.                 .setTitle("Biometric login for my app")
  59.                 .setSubtitle("Log in using your biometric credential")
  60.                 // Can't call setNegativeButtonText() and
  61.                 // setAllowedAuthenticators(...|DEVICE_CREDENTIAL) at the same time.
  62.                 // .setNegativeButtonText("Use account password")
  63.                 .setAllowedAuthenticators(
  64.                         androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
  65.                                 | androidx.biometric.BiometricManager.Authenticators.DEVICE_CREDENTIAL)
  66.                 .build();
  68.         biometricPrompt = new BiometricPrompt(MainActivity.this,
  69.                 executor, new BiometricPrompt.AuthenticationCallback() {
  70.             @Override
  71.             public void onAuthenticationError(int errorCode,
  72.                                               @NonNull CharSequence errString) {
  73.                 super.onAuthenticationError(errorCode, errString);
  74.                 Log.d(APP_TAG, "Authentication succeeded!");
  75.             }
  76.             @Override
  77.             public void onAuthenticationSucceeded(
  78.                     @NonNull BiometricPrompt.AuthenticationResult result) {
  79.                 super.onAuthenticationSucceeded(result);
  80.                 int authorizationType = result.getAuthenticationType();
  81.                 Log.d(APP_TAG, "Authentication succeeded with authType " + authorizationType);
  82.                 Log.d(APP_TAG, "(authType: 1=PIN, 2=fingerprint)");
  83.                 try {
  84.                     // init mac from scratch
  85.                     mac = Mac.getInstance("HmacSHA256");
  86.                     mac.init(getOrCreateSecretKey(KEY_NAME_SIGN));
  87.                     byte[] bytes = "secret-text".getBytes(StandardCharsets.UTF_8);
  88.                     byte[] macResult = mac.doFinal(bytes);
  89.                     Log.d("signed data ", Base64.encodeToString(macResult, Base64.NO_WRAP));
  90.                 } catch (InvalidKeyException | NoSuchAlgorithmException e) {
  91.                     e.printStackTrace();
  92.                 }
  93.             }
  94.             @Override
  95.             public void onAuthenticationFailed() {
  96.                 super.onAuthenticationFailed();
  97.                 Log.d(APP_TAG, "Authentication failed");
  98.             }
  99.         });
  101.         btnSign.setOnClickListener(new View.OnClickListener() {
  102.             @Override
  103.             public void onClick(View v) {
  104.                 sign();
  105.             }
  106.         });
  107.     }
  109.     private void sign() {
  110.         // simple sign function
  111.         Log.d(APP_TAG, "sign started");
  112.         // setup the mac
  113.         try {
  114.             mac = Mac.getInstance("HmacSHA256");
  115.             mac.init(getOrCreateSecretKey(KEY_NAME_SIGN));
  116.         } catch (UserNotAuthenticatedException e) {
  117.             Log.d(APP_TAG, "UserNotAuthenticatedException thrown, try to authenticate");
  118.             biometricPrompt.authenticate(promptInfo);
  119.         } catch (NoSuchAlgorithmException | InvalidKeyException e) {
  120.             e.printStackTrace();
  121.         }
  122.         biometricPrompt.authenticate(promptInfo);
  123.     }
  125.     private SecretKey getOrCreateSecretKey(String keyName) {
  126.         SecretKey secretKey = getSecretKey(keyName);
  127.         Log.d(APP_TAG, "try to load secretKey from keystore");
  128.         if (secretKey == null) {
  129.             createSecretKey(keyName);
  130.             secretKey = getSecretKey(keyName);
  131.             Log.d(APP_TAG, "generated fresh key, try to load");
  132.         }
  133.         return secretKey;
  134.     }
  136.     private SecretKey getSecretKey(String keyName) {
  137.         KeyStore keyStore = null;
  138.         try {
  139.             keyStore = KeyStore.getInstance("AndroidKeyStore");
  140.             // Before the keystore can be accessed, it must be loaded.
  141.             keyStore.load(null);
  142.             return ((SecretKey) keyStore.getKey(keyName, null));
  143.         } catch (KeyStoreException | CertificateException | UnrecoverableKeyException | NoSuchAlgorithmException | IOException e) {
  144.             e.printStackTrace();
  145.             return null;
  146.         }
  147.     }
  149. private void createSecretKey(String keyName) {
  150.         generateSecretKey(new KeyGenParameterSpec.Builder(
  151.                 keyName,
  152.                 KeyProperties.PURPOSE_SIGN)
  153.                 .setUserAuthenticationRequired(true)
  154.                 //.setInvalidatedByBiometricEnrollment(true)
  155.                 .setUserAuthenticationValidityDurationSeconds(10)
  156.                 .build());
  157.     }// All exceptions unhandled
  159.     private void generateSecretKey(KeyGenParameterSpec keyGenParameterSpec) {
  160.         KeyGenerator keyGenerator = null;
  161.         try {
  162.             keyGenerator = KeyGenerator.getInstance(
  163.                     KeyProperties.KEY_ALGORITHM_HMAC_SHA256, "AndroidKeyStore");
  164.             keyGenerator.init(keyGenParameterSpec);
  165.             keyGenerator.generateKey();
  166.         } catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException | NoSuchProviderException e) {
  167.             e.printStackTrace();
  168.         }
  169.     }
  170. }

activity_main.xml

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android"
  3.     xmlns:app="http://schemas.android.com/apk/res-auto"
  4.     xmlns:tools="http://schemas.android.com/tools"
  5.     android:layout_width="match_parent"
  6.     android:layout_height="match_parent"
  7.     tools:context=".MainActivity">
  9.     <Button
  10.         android:id="@+id/button"
  11.         android:layout_width="wrap_content"
  12.         android:layout_height="wrap_content"
  13.         android:layout_marginStart="16dp"
  14.         android:layout_marginTop="32dp"
  15.         android:layout_marginEnd="16dp"
  16.         android:text="Sign"
  17.         app:layout_constraintEnd_toEndOf="parent"
  18.         app:layout_constraintStart_toStartOf="parent"
  19.         app:layout_constraintTop_toTopOf="parent" />
  21. </androidx.constraintlayout.widget.ConstraintLayout>

build.graddle（模块）：

  1. plugins {
  2.     id 'com.android.application'
  3. }
  5. android {
  6.     compileSdkVersion 30
  7.     buildToolsVersion "30.0.3"
  9.     defaultConfig {
  10.         applicationId "de.biometrics"
  11.         minSdkVersion 23
  12.         targetSdkVersion 30
  13.         versionCode 1
  14.         versionName "1.0"
  15.         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
  16.     }
  18.     buildTypes {
  19.         release {
  20.             minifyEnabled false
  21.             proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
  22.         }
  23.     }
  24.     compileOptions {
  25.         sourceCompatibility JavaVersion.VERSION_1_8
  26.         targetCompatibility JavaVersion.VERSION_1_8
  27.     }
  28. }
  30. dependencies {
  32.     implementation 'androidx.appcompat:appcompat:1.3.0'
  33.     implementation 'com.google.android.material:material:1.3.0'
  34.     implementation 'androidx.constraintlayout:constraintlayout:2.0.4'
  35.     testImplementation 'junit:junit:4.+'
  36.     androidTestImplementation 'androidx.test.ext:junit:1.1.3'
  37.     androidTestImplementation 'androidx.test.espresso:espresso-core:3.4.0'
  38.     implementation 'androidx.biometric:biometric:1.1.0'
  39. }

注意：这只是一个非常简化的程序，仅用于测试生物特征提示功能。

JavaandroidExceptionbiometricsandroid-biometric-prompt

1条答案

按热度按时间
6vl6ewon

6vl6ewon1#

我在回答我自己的问题，因为我的发现可能对其他人有所帮助。
到目前为止（2021年7月6日），我不知道为什么使用该选项生成secretkey

  1. .setUserAuthenticationValidityDurationSeconds(10);

无法先通过指纹释放。正如我在问题中所写的，当它首先通过pin（设备凭证）发布时，只要持续时间未过期，它就可以通过指纹使用（“身份验证”）。
无论如何，文档中还有另一个选项可用，即使用每次使用的身份验证密钥进行身份验证(https://developer.android.com/training/sign-in/biometric-auth#auth-每次使用密钥），此选项提供预期结果。
当用新代码更新代码时，不要忘记生成一个新的密钥！
使用新选项时

  1. .setUserAuthenticationParameters(0 /* duration */,
  2.    KeyProperties.AUTH_BIOMETRIC_STRONG |
  3.    KeyProperties.AUTH_DEVICE_CREDENTIAL)

您会注意到，代码需要sdk 30+才能运行。对于在sdk>23上运行的代码，可以使用

  1. .setUserAuthenticationValidityDurationSeconds(0)

使用“0”秒很重要，因为这（内部）默认为“生物特征|设备|凭证”，使用“-1”时默认为“设备|凭证”（不带指纹选项）。
下面我提供的代码用于检查正在使用的sdk并选择正确的generatekey函数：

  1. private SecretKey getOrCreateSecretKey(String keyName) {
  2.     SecretKey secretKey = getSecretKey(keyName);
  3.     Log.d(APP_TAG, "try to load secretKey from keystore");
  4.     if (secretKey == null) {
  5.         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M &
  6.                 Build.VERSION.SDK_INT < Build.VERSION_CODES.R) {
  7.             createSecretKeyApi2329(keyName);
  8.             Log.d(APP_TAG, "createSecretKeyApi2329 SDK in use:  " + Build.VERSION.SDK_INT);
  9.         }
  10.         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
  11.             createSecretKeyApi30(keyName);
  12.             Log.d(APP_TAG, "createSecretKeyApi30 SDK in use:  " + Build.VERSION.SDK_INT);
  13.         }
  14.         // as minimum SDK in build.gradle was set to 23 the version can't be below 23
  15.         if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
  16.             Log.d(APP_TAG, "SDK in use is to old, minimum SDK is 23 = M");
  17.             finish();
  18.         }
  19.         secretKey = getSecretKey(keyName);
  20.         Log.d(APP_TAG, "generated fresh key, try to load");
  21.     }
  22.     return secretKey;
  23. }
  25. @RequiresApi(api = Build.VERSION_CODES.R)
  26. private void createSecretKeyApi30(String keyName) {
  27.     generateSecretKey(new KeyGenParameterSpec.Builder(
  28.             keyName,
  29.             KeyProperties.PURPOSE_SIGN)
  30.             //.setInvalidatedByBiometricEnrollment(true)
  31.             // Accept either a biometric credential or a device credential.
  32.             // To accept only one type of credential, include only that type as the
  33.             // second argument.
  34.             // @RequiresApi(api = Build.VERSION_CODES.R)
  35.             .setUserAuthenticationParameters(0 /* duration */,
  36.                     KeyProperties.AUTH_BIOMETRIC_STRONG |
  37.                             KeyProperties.AUTH_DEVICE_CREDENTIAL)
  38.             .build());
  39. }// All exceptions unhandled
  41. //@RequiresApi(api = Build.VERSION_CODES.M)
  42. private void createSecretKeyApi2329(String keyName) {
  43.     generateSecretKey(new KeyGenParameterSpec.Builder(
  44.             keyName,
  45.             KeyProperties.PURPOSE_SIGN)
  46.             //.setInvalidatedByBiometricEnrollment(true)
  47.             // Accept either a biometric credential or a device credential.
  48.             // To accept only one type of credential, include only that type as the
  49.             // second argument.
  50.             // for SDK < 30 use .setUserAuthenticationValidityDurationSeconds(0)
  51.             // see https://cs.android.com/android/platform/superproject/+/android-11.0.0_r3:frameworks/base/keystore/java/android/security/keystore/KeyGenParameterSpec.java;l=1236-1246;drc=a811787a9642e6a9e563f2b7dfb15b5ae27ebe98
  52.             // parameter "0" defaults to AUTH_BIOMETRIC_STRONG | AUTH_DEVICE_CREDENTIAL
  53.             // parameter "-1" default to AUTH_BIOMETRIC_STRONG
  54.             .setUserAuthenticationValidityDurationSeconds(0)
  55.             .build());
  56. }// All exceptions unhandled
展开查看全部
赞(0）分享  回复(0）举报  2021-08-20
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com