Using Touch ID on iOS to encrypt data

Question

What I'm trying to do

Basically what I'm trying to do is figure out a way to encrypt data using Touch ID.

Sadly I've not found a way to create an encryptionKey with Touch ID, since the LAContext API only returns a aye/nay response.

---

Why I'm trying it

I'm implementing different log in methods in an app. The supported log in methods are a password, PIN-code and Touch ID. The user is free to choose whatever log in method he/she wants.
Only the password however, is send to the server which will authenticate the user. As such, only the password is stored in the keychain.

The encryptionKey, used to first encrypt and then store the password in the keychain, is created using whatever method the user chose as log in method.
If the user chose to use a PIN-code, the encryptionKey is derived from that PIN-code, the same can be said when the user chose a password as log in method.

---

My question is:

How can I fit Touch ID in this picture?

I've searched on the internet, but only found what I already feared.
Since iOS only returns a true or false from the Secure Enclave, it's impossible to create an encryptionKey.

I know the keychain is encrypted by itself, but for security reasons (please don't elaborate on this) I need an encrypted password stored in the keychain.

---

EDIT:

The reason behind storing data encrypted in the keychain is because the keychain can be breached by jailbreaking a device. And since the app I'm working on allows users to view (mostly) corporate sensitive data, I need to take even jailbreaking into consideration.

Answer 1

Use the kSecAccessControlTouchIDCurrentSet or kSecAccessControlTouchIDAny keychain access control attributes to protect your encryption key in the keychain. Using this API will fail if the user does not have Touch ID enabled (or the device does not support it), and using kSecAccessControlTouchIDCurrentSet will fail if the user modifies the set of fingerprints. In case of failure, you can then fallback to your normal authentication UI, such as pin code or password entry.

See the WWDC 2014 711 Keychain and Authentication with Touch ID talk and WWDC 2015 706 Security and Your Apps for more information.

As a general note, do not store data in the keychain. You should only store passwords, encryption keys or credentials, and use those to decrypt data stored on the disk.