setInvalidatedByBiometricEnrollment 不会抛出添加或删除指纹的异常答案

【问题标题】：setInvalidatedByBiometricEnrollment does not throw exception with fingerprint added or removedsetInvalidatedByBiometricEnrollment 不会抛出添加或删除指纹的异常
【发布时间】：2022-06-13 10:32:36
【问题描述】：

如果在应用设置生物识别后删除任何当前指纹或添加新指纹，我想删除凭据。

像这样创建密钥：

private Key getKey(String KEY_ALIAS) throws GeneralSecurityException, IOException {
  KeyStore.SecretKeyEntry secretKeyEntry = (KeyStore.SecretKeyEntry) getKeyStore().getEntry(KEY_ALIAS, null);
  if (secretKeyEntry != null) {
    return secretKeyEntry.getSecretKey();
  } else if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
    KeyGenerator generator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, ANDROID_KEY_STORE);
    generator.init(new KeyGenParameterSpec.Builder(
      KEY_ALIAS,
      KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
      .setBlockModes(KeyProperties.BLOCK_MODE_GCM)
      .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
      .setInvalidatedByBiometricEnrollment(true)
      .setRandomizedEncryptionRequired(false)
      .build()
    );
    return generator.generateKey();
  } else {
    return getAESKey(KEY_ALIAS);
  }
}

解密如下：

private String decryptString(String stringToDecrypt, String KEY_ALIAS) throws GeneralSecurityException, IOException {
  Log.d("biometric", "decryptString");

  byte[] encryptedData = Base64.decode(stringToDecrypt, Base64.DEFAULT);

  Cipher cipher;
  if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
    cipher = Cipher.getInstance(TRANSFORMATION);
    try {
      cipher.init(Cipher.DECRYPT_MODE, getKey(KEY_ALIAS), new GCMParameterSpec(128, FIXED_IV));
    } catch (InvalidKeyException e) {
      this.deleteCredentials();
      e.printStackTrace();
    }
  } else {
    cipher = Cipher.getInstance(AES_MODE, "BC");
    try {
      cipher.init(Cipher.DECRYPT_MODE, getKey(KEY_ALIAS));
    } catch (InvalidKeyException e) {
      this.deleteCredentials();
      e.printStackTrace();
    }
  }
  byte[] decryptedData = cipher.doFinal(encryptedData);
  return new String(decryptedData, "UTF-8");
}

但即使使用 try 和 catch 块包装 cipher.init 也不会引发任何异常。我正在 Emulator SDK 30 上进行测试。

cipher.init(Cipher.DECRYPT_MODE, getKey(KEY_ALIAS), new GCMParameterSpec(128, FIXED_IV));

参考：Key permanently invalidated Exception after adding/removing fingerprint

【问题讨论】：

标签： android android-biometric

【解决方案1】：

setInvalidatedByBiometricEnrollment 标志仅适用于需要用户身份验证的密钥：

设置此密钥是否应在生物识别注册时失效。 这仅适用于需要用户身份验证的密钥（请参阅 setUserAuthenticationRequired(boolean)），并且如果未设置有效的有效持续时间（请参阅 setUserAuthenticationValidityDurationSeconds(int)，这意味着该密钥仅对生物识别身份验证有效。

来源：https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder#setInvalidatedByBiometricEnrollment(boolean)

【讨论】：