BiometricPrompt iris and face prompt is not working with Crypto object authentication. #AndroidX

Question

Issue

• Biometric authentication iris and face-detection is not prompting with biometricPrompt.authenticate(**crypto**, promptInfo) call.

Source reference:

• Securing data with BiometricPrompt (19 May 2019)
• One Biometric API Over all Android (30 October 2019)
• Biometrich API

Device used for testing:

• Samsung S8 (Android OS 9)

Steps of Authentication I'm following:

• val biometricPrompt = BiometricPrompt(...)
• val promptInfo = BiometricPrompt.PromptInfo.Builder()...
• biometricPrompt.authenticate(promptInfo) (PFA: option A, B)

and there is another authentication method which take cipher object to make sure

• biometricPrompt.authenticate(crypto, promptInfo). (PFA: option C)

Everything worked just as expected with new and older API device support. Until unless realize tested application for other biometric authentication option iris and using face detection.

If I follow

• biometricPrompt.authenticate(promptInfo) then application simply display authentication option based on user preference which he has to choose from Device Setting -> Biometric preference. And perform authentication independently. (PFA: option A, B)

• But if use biometricPrompt.**authenticate**(crypto, promptInfo) then it displays only fingerprint authentication option ONLY. For other preference option iris and face-detection, it does not display anything on authenticate(..) method call. (PFA: option C)

Question

• Why other Biometric authentication is not prompting with crypto object authentication.

Answer 1

Face-Id is considered as WEAK authenticator. If you set .setAllowedAuthenticators(BIOMETRIC_WEAK or DEVICE_CREDENTIAL) in BiometricPrompt Info and performs any Key based crypto operations. It will throw

java.lang.IllegalArgumentException: Crypto-based authentication is not supported for Class 2 (Weak) biometrics.

For crypto-based authentication only allowed authenticators are BIOMETRIC_STRONG or DEVICE_CREDENTIAL

Refer table here: https://source.android.com/docs/security/features/biometric

Answer 2

Some devices only have one form factor, some have many form factors. Which form factor your app ends up using isn't really up to you; it's up to the OEM implementation. As explained in this blog post, whether a form factor is Strong or Weak doesn't depend on your code -- the OEM decides. However, you can request that a device uses Strong authentication for your app by specifying a CryptoObject when you call authenticate().

What you are experiencing is that the OEMs of your devices decided to make Fingerprint the default for Strong biometrics. Therefore, when you pass in a CryptoObject to authenticate() those devices show the user the UI for Fingerprint.