加密共享首选项是用户身份验证必需的无法正常工作

Question

我正在使用EncryptedSharedPreferences来存储加密的数据。

val biometricManager = BiometricManager.from(this)
val hasFingerprint = biometricManager.canAuthenticate() == BiometricManager.BIOMETRIC_SUCCESS
val advanceSpec = KeyGenParameterSpec.Builder(
"master_key",
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
).apply {
setBlockModes(KeyProperties.BLOCK_MODE_GCM)
setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
setKeySize(256)
if(hasFingerprint){
setUserAuthenticationRequired(true)
setUserAuthenticationValidityDurationSeconds(1)
if(Build.VERSION.SDK_INT >= Build.VERSION_CODES.N){
setInvalidatedByBiometricEnrollment(false)
}
if(Build.VERSION.SDK_INT >= Build.VERSION_CODES.P){
setIsStrongBoxBacked(true)
setUserConfirmationRequired(true)
}
}
}.build()
val masterKey = MasterKeys.getOrCreate(advanceSpec)
val preferences = EncryptedSharedPreferences.create(
"TestPreferences",
masterKey,
applicationContext,
EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
)

实际上，我错过了BiometricPrompt部分。我认为调用setUserAuthenticationRequired(true)会自动处理身份验证用户。但我们必须自己展示生物识别提示。isUserAuthenticationRequired仅确保仅在用户获得授权时激活密钥。

val biometricPrompt = BiometricPrompt(
activity,
ContextCompat.getMainExecutor(activity),
object: BiometricPrompt.AuthenticationCallback() {
override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
super.onAuthenticationSucceeded(result)
createSharedPreferences()
}
}
)
biometricPrompt.authenticate(promptInfo)

但是，有一个问题。它只在创建EncryptedSharedPreferences时抛出 UserNotAuthenticatedException。之后，我们可以根据需要执行读写操作。它没有考虑到setUserAuthenticationValidityDurationSeconds(1).

Answer 1

我找到了它不需要身份验证 1 秒的原因。这是因为，一旦加密的共享首选项被激活，它就会加载用于加密和解密内存中的数据的密钥，然后这些密钥用于访问文件中的数据。您可以在类EncryptedSharedPreference读取代码。这是很明显的。

KeysetHandle daeadKeysetHandle = new AndroidKeysetManager.Builder()
.withKeyTemplate(prefKeyEncryptionScheme.getKeyTemplate())
.withSharedPref(context, KEY_KEYSET_ALIAS, fileName)
.withMasterKeyUri(KEYSTORE_PATH_URI + masterKeyAlias)
.build().getKeysetHandle();
KeysetHandle aeadKeysetHandle = new AndroidKeysetManager.Builder()
.withKeyTemplate(prefValueEncryptionScheme.getKeyTemplate())
.withSharedPref(context, VALUE_KEYSET_ALIAS, fileName)
.withMasterKeyUri(KEYSTORE_PATH_URI + masterKeyAlias)
.build().getKeysetHandle();
DeterministicAead daead = daeadKeysetHandle.getPrimitive(DeterministicAead.class);
Aead aead = aeadKeysetHandle.getPrimitive(Aead.class);
return new EncryptedSharedPreferences(fileName, masterKeyAlias,
context.getSharedPreferences(fileName, Context.MODE_PRIVATE), aead, daead);