BiometricPrompt iris and face prompt is not working with Crypto object authentication. #AndroidX

Question

Issue

• Biometric authentication iris and face-detection is not prompting with biometricPrompt.authenticate(**crypto**, promptInfo) call.

Source reference:

• Securing data with BiometricPrompt (19 May 2019)
• One Biometric API Over all Android (30 October 2019)
• Biometrich API

Device used for testing:

• Samsung S8 (Android OS 9)

Steps of Authentication I'm following:

• val biometricPrompt = BiometricPrompt(...)
• val promptInfo = BiometricPrompt.PromptInfo.Builder()...
• biometricPrompt.authenticate(promptInfo) (PFA: option A, B)

and there is another authentication method which take cipher object to make sure

• biometricPrompt.authenticate(crypto, promptInfo). (PFA: option C)

Everything worked just as expected with new and older API device support. Until unless realize tested application for other biometric authentication option iris and using face detection.

If I follow

• biometricPrompt.authenticate(promptInfo) then application simply display authentication option based on user preference which he has to choose from Device Setting -> Biometric preference. And perform authentication independently. (PFA: option A, B)

• But if use biometricPrompt.**authenticate**(crypto, promptInfo) then it displays only fingerprint authentication option ONLY. For other preference option iris and face-detection, it does not display anything on authenticate(..) method call. (PFA: option C)

Question

• Why other Biometric authentication is not prompting with crypto object authentication.

Arman

The Android Compatibility Definition Document states that "To allow access to keystore keys to third-party applications, device implementations: [C-0-2] MUST meet the requirements for Strong as defined in this document". It then goes on to define what a Strong biometric sensor means. It's entirely possible that the iris and face scanners in the Galaxy S8 do not meet these requirements. – Verecund

Thanks @Verecund to point this out. I was checking with sample given here and this is working with iris at least. For face-detection it is throwing BIOMETRIC_ERROR_NONE_ENROLLED. Any suggestion around this confusion ! – Arman

@Verecund couple of question if you can help, Android promised to release Android-X update for all their on-device user authentication needs. Where I already can see that Samsung S-8 with update with OS-9 is already with this capability. 1) Does that mean Samsung did own SDK/framework level solutionign ? 2) How can verify if OEM device has support for C-0-2 or C-0-3 ? Any suggestion around this ? – Arman

I believe the androidX biometrics library has a list of devices for which it will fall back to using fingerprint if the device's other biometric sensors are considered weak. I don't know in which version of the library that check was added though. See android-review.googlesource.com/c/platform/frameworks/support/+/… – Verecund

yes, must be but maintaining a list is not a good idea. Though I still need to verify feature behaviour on other OEM device. – Arman

this must be some firmware level check that identify if given biometric option is strong enough to perform authentication for/using crypto object. If that fail then it redirect control to classic (FingerPrintManager or similar from Biometric API) implementation. @Verecund – Arman

Since Google are relying on a blacklist approach themselves, it doesn't seem like they have a better solution to the problem right now. But there shouldn't be any need for you to maintain a list of your own. The idea is that the API checks for you and automatically falls back to fingerprint if the preferred biometric isn't secure enough on that device. – Verecund

this is what I understood so far, but hard to convince user when he choose iris/face-detection as an preference option from setting but fall back to Fingerprint for your application. Any finding around to programmatically identify that if sensor strong enough to support crypto based authentication ? – Arman

None that I know of, aside from maintaining a blacklist of your own and keeping it updated whenever new devices are released. – Verecund

btw, while checking with multiple device found that samsung-10 and plus devices has removed iris as authentication option(Fingerprint and Face-detection available). Though iris still available for s8 devices. All these running on Android-9 (while google released with Android-10) which is another surprising factor. – Arman

"samsung-10 and plus devices has removed iris as authentication option" I believe that was mentioned here (see comment #7). – Verecund

Answer 1

Some devices only have one form factor, some have many form factors. Which form factor your app ends up using isn't really up to you; it's up to the OEM implementation. As explained in this blog post, whether a form factor is Strong or Weak doesn't depend on your code -- the OEM decides. However, you can request that a device uses Strong authentication for your app by specifying a CryptoObject when you call authenticate().

What you are experiencing is that the OEMs of your devices decided to make Fingerprint the default for Strong biometrics. Therefore, when you pass in a CryptoObject to authenticate() those devices show the user the UI for Fingerprint.

Diadromous

Can face recognition be a strong biometric on certain devices or is it always considered weak? – Jacinda

So far it has considered as an week option but further it can be improved. – Arman

FYI (although quite late to the party) Face unlock is considered strong on some devices. The Pixel 4 for example is strong because it has the radar sensor and is not a purely optical match. – Iced

Answer 2

Face-Id is considered as WEAK authenticator. If you set .setAllowedAuthenticators(BIOMETRIC_WEAK or DEVICE_CREDENTIAL) in BiometricPrompt Info and performs any Key based crypto operations. It will throw

java.lang.IllegalArgumentException: Crypto-based authentication is not supported for Class 2 (Weak) biometrics.

For crypto-based authentication only allowed authenticators are BIOMETRIC_STRONG or DEVICE_CREDENTIAL

Refer table here: https://source.android.com/docs/security/features/biometric

Wieren