Android CryptoObject usage in fingerprint

Question

In Android fingerprint sample code FingerprintDialog, the method that starts fingerprint hardware FingerprintManager#authenticate takes a parameter of FingerprintManager.CryptoObject. According to the documentation, it's the object associated with the call or null if none required. The description is still not clear for me. Would someone explain when I should or should not use crypto Thanks.

Answer 1

The FingerprintDialog sample provided in the Android Samples is a bit dense so let's break down what's happening:

1. Configure and generate cryptographic Keys. In this step you can specify that the Key can only be used if KeyGenParameterSpec.Builder.setAuthenticated(true).
2. Initialize a Cipher object with the cipherMode (encrypt/decrypt) and the Key generated from Step 1
3. Initialize a FingerprintCrypto.CryptoObject() with the Cipher from Step 2
4. Start the Fingerprint scanner and pass in the CryptoObject from step 3 by calling FingerprintManager.authenticate()
5. User successfully authenticates with their fingerprint. The Android OS will set the "authenticated" bit in the Key from 0 to 1.
6. Now that the key has been authenticated for use, it can be used to do any crypto operation by calling Cipher.doFinal().

If you try to modify step 4 by passing in null to FingerprintManager.authenticate(), then step 6 will fail because you have not been authenticated to use the key.

Hope that helps.