添加/删除指纹后密钥永久失效异常

Question

当用户添加新指纹或删除任何现有指纹，然后尝试启动应用程序时，它会抛出KeyPermanentlyInvalidatedException

这是我的指纹代码：

public Boolean auth(FingerprintManager.AuthenticationCallback callback) {
try {
KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
if (store == null) {
return null;
}
Cipher cipher = accessCipher();
if (cipher == null) {
return null;
}
store.load(null);
SecretKey key = (SecretKey) store.getKey(DEFAULT_KEY_NAME, DEFAULT_STORE_PASS.toCharArray());
cipher.init(Cipher.ENCRYPT_MODE, key);
FingerprintManager manager = initManager();
if (manager == null) {
return null;
}
manager.authenticate(
generateCryptoObject(cipher),
generateCancellationSignal(),
0,
callback,
null
);
return true;
} catch (Throwable exc) {
Logger.error(TAG, exc.getLocalizedMessage(), exc);
return null;
}
}

private Cipher accessCipher() {
try {
return Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
+ KeyProperties.BLOCK_MODE_CBC + "/"
+ KeyProperties.ENCRYPTION_PADDING_PKCS7);
} catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
// Was not available.
return null;
}
}

在 onResume(( 中调用了身份验证方法。

整个 FingerPrintUtils 类：

'

public class FingerPrintUtils {
private static final String TAG = FingerPrintUtils.class.getSimpleName();
private static final String DEFAULT_KEYSTORE = "AndroidKeyStore";
private static final String DEFAULT_KEY_NAME = "myApplication";
private static final String DEFAULT_STORE_PASS = "csdgh@jkbvj@";
private static FingerPrintUtils fingerPrintUtils;
private Boolean isCancelled;
private CancellationSignal cancellationSignal;
@TargetApi(23)
public static FingerPrintUtils getInstance() {
if (fingerPrintUtils == null) {
fingerPrintUtils = new FingerPrintUtils();
}
return fingerPrintUtils;
}
@TargetApi(23)
public Boolean isFingerAuthAvailable() {
Boolean hasHarware = hasHardware();
if (hasHarware == null || !hasHarware) {
return false;
}
Boolean hasPrint = hasRegisteredPrint();
if (hasPrint == null || !hasPrint) {
return false;
}
return true;
}
@TargetApi(23)
public Boolean hasHardware() {
FingerprintManager manager = initManager();
if (manager == null) {
return null;
}
return manager.isHardwareDetected();
}
@TargetApi(23)
public Boolean hasRegisteredPrint() {
FingerprintManager manager = initManager();
if (manager == null) {
return null;
}
return manager.hasEnrolledFingerprints();
}
@TargetApi(23)
public Boolean createKey() {
try {
KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
if (store == null) {
return null;
}
KeyGenerator generator = accessKeyGen(KeyProperties.KEY_ALGORITHM_AES, DEFAULT_KEYSTORE);
if (generator == null) {
return null;
}
generator.init(new KeyGenParameterSpec.Builder(
DEFAULT_KEY_NAME,
KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT
)
.setBlockModes(KeyProperties.BLOCK_MODE_CBC)
// Require the user to authenticate with a fingerprint to authorize every use
// of the key
.setUserAuthenticationRequired(true)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7)
.build());
generator.generateKey();
return true;
} catch (Throwable exc) {
Logger.error(TAG, exc.getLocalizedMessage(), exc);
return false;
}
}
@TargetApi(23)
public Boolean keyExist() {
try {
KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
if (store == null) {
return null;
}
store.load(null);
SecretKey key = (SecretKey) store.getKey(DEFAULT_KEY_NAME, DEFAULT_STORE_PASS.toCharArray());
if (key != null) {
return true;
}
} catch (Throwable exc) {
Logger.error(TAG, exc.getLocalizedMessage(), exc);
return null;
}
return false;
}
@TargetApi(23)
public Boolean auth(FingerprintManager.AuthenticationCallback callback) {
try {
KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
if (store == null) {
return null;
}
Cipher cipher = accessCipher();
if (cipher == null) {
return null;
}
store.load(null);
SecretKey key = (SecretKey) store.getKey(DEFAULT_KEY_NAME, DEFAULT_STORE_PASS.toCharArray());
cipher.init(Cipher.ENCRYPT_MODE, key);
FingerprintManager manager = initManager();
if (manager == null) {
return null;
}
manager.authenticate(
generateCryptoObject(cipher),
generateCancellationSignal(),
0,
callback,
null
);
return true;
} catch (Throwable exc) {
Logger.error(TAG, exc.getLocalizedMessage(), exc);
return null;
}
}
@TargetApi(23)
public Boolean stop() {
if (isCancelled != null && !isCancelled) {
isCancelled = true;
cancellationSignal.cancel();
cancellationSignal = null;
return true;
}
return false;
}
@TargetApi(23)
private FingerprintManager initManager() {
Context context = BasePreferenceHelper.getCurrentContext();
if (context == null) {
return null;
}
if(Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
return null;
}
FingerprintManager manager = (FingerprintManager) context.getSystemService(Context.FINGERPRINT_SERVICE);
if (manager == null) {
return null;
}
return manager;
}
@TargetApi(23)
private Cipher accessCipher() {
try {
return Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
+ KeyProperties.BLOCK_MODE_CBC + "/"
+ KeyProperties.ENCRYPTION_PADDING_PKCS7);
} catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
// Was not available.
return null;
}
}
@TargetApi(23)
private KeyStore accessKeyStore(String storeName) {
try {
return KeyStore.getInstance(storeName);
} catch (Throwable exc) {
// Was not available.
return null;
}
}
@TargetApi(23)
private FingerprintManager.CryptoObject generateCryptoObject(Cipher cipher) {
if (cipher == null) {
throw new IllegalArgumentException("Cipher is required.");
}
return new FingerprintManager.CryptoObject(cipher);
}
@TargetApi(23)
private CancellationSignal generateCancellationSignal() {
cancellationSignal = new CancellationSignal();
isCancelled = false;
return cancellationSignal;
}
@TargetApi(23)
private KeyGenerator accessKeyGen(String algo, String storeName) {
try {
return KeyGenerator.getInstance(algo, storeName);
} catch (Throwable exc) {
// Was not available.
return null;
}
}
}

'

Answer 1

在您的FingerPrintUtils#Auth()方法中，在初始化cipher.init()时，将其放入 try catch 块中。通过从密钥库中删除密钥来处理KeyInvalidatedException，然后使用createKey()方法再次创建密钥。它肯定会起作用。

使用以下代码进行相同操作。

try
{
cipher.init(Cipher.ENCRYPT_MODE, key);
}
catch (KeyPermanentlyInvalidatedException e)
{
store.deleteEntry(DEFAULT_KEY_NAME);
createKey();
auth(callback);
return false;
}