A bit late, but I hope this answer could help other developers.
I was also trying to achieve the same thing and ended up with a simple solution:
Supply a crypto object when calling .authenticate() like this:
/**
* Prerequisites:
* 1. Add
* `implementation "androidx.biometric:biometric:1.0.1"` in build.gradle
* 2. Add
* ` <uses-permission android:name="android.permission.USE_BIOMETRIC" android:requiredFeature="false"/>`
* in AndroidManifest.xml
*/
object BiometricHelper {
private const val ENCRYPTION_BLOCK_MODE = KeyProperties.BLOCK_MODE_GCM
private const val ENCRYPTION_PADDING = KeyProperties.ENCRYPTION_PADDING_NONE
private const val ENCRYPTION_ALGORITHM = KeyProperties.KEY_ALGORITHM_AES
private const val KEY_SIZE = 128
private lateinit var biometricPrompt: BiometricPrompt
fun authenticate(fragmentActivity: FragmentActivity, authCallback: BiometricPrompt.AuthenticationCallback){
try {
if (!fragmentActivity.supportFragmentManager.executePendingTransactions()) {
biometricPrompt = createBiometricPrompt(fragmentActivity, authCallback)
val promptInfo = createPromptInfo()
biometricPrompt.authenticate(
promptInfo,
cryptoObject //Providing crypto object here will block Iris and Face Scan
)
}
}
catch (e: KeyPermanentlyInvalidatedException) {
e.printStackTrace()
}
catch (e: Exception) {
e.printStackTrace()
}
}
private fun createBiometricPrompt(fragmentActivity: FragmentActivity, authCallback: BiometricPrompt.AuthenticationCallback): BiometricPrompt {
val executor = ContextCompat.getMainExecutor(fragmentActivity)
return BiometricPrompt(fragmentActivity, executor, authCallback)
}
private fun createPromptInfo(): BiometricPrompt.PromptInfo {
return BiometricPrompt.PromptInfo.Builder()
.setTitle("Authentication")
.setConfirmationRequired(false)
.setNegativeButtonText("Cancel")
.setDeviceCredentialAllowed(false) //Don't Allow PIN/pattern/password authentication.
.build()
}
//endregion
//====================================================================================
//region Dummy crypto object that is used just to block Face, Iris scan
//====================================================================================
/**
* Crypto object requires STRONG biometric methods, and currently Android considers only
* FingerPrint auth is STRONG enough. Therefore, providing a crypto object while calling
* [androidx.biometric.BiometricPrompt.authenticate] will block Face and Iris Scan methods
*/
private val cryptoObject by lazy {
getDummyCryptoObject()
}
private fun getDummyCryptoObject(): BiometricPrompt.CryptoObject {
val transformation = "$ENCRYPTION_ALGORITHM/$ENCRYPTION_BLOCK_MODE/$ENCRYPTION_PADDING"
val cipher = Cipher.getInstance(transformation)
var secKey = getOrCreateSecretKey(false)
try {
cipher.init(Cipher.ENCRYPT_MODE, secKey)
}
catch (e: KeyPermanentlyInvalidatedException) {
e.printStackTrace()
secKey = getOrCreateSecretKey(true)
cipher.init(Cipher.ENCRYPT_MODE, secKey)
}
catch (e: Exception) {
e.printStackTrace()
}
return BiometricPrompt.CryptoObject(cipher)
}
private fun getOrCreateSecretKey(mustCreateNew: Boolean): SecretKey {
val keyStore = KeyStore.getInstance("AndroidKeyStore")
keyStore.load(null)
if (!mustCreateNew) {
keyStore.getKey("dummyKey", null)?.let { return it as SecretKey }
}
val paramsBuilder = KeyGenParameterSpec.Builder("dummyKey",
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT)
paramsBuilder.apply {
setBlockModes(ENCRYPTION_BLOCK_MODE)
setEncryptionPaddings(ENCRYPTION_PADDING)
setKeySize(KEY_SIZE)
setUserAuthenticationRequired(true)
}
val keyGenParams = paramsBuilder.build()
val keyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES,
"AndroidKeyStore")
keyGenerator.init(keyGenParams)
return keyGenerator.generateKey()
}
//endregion
}
Gist
EDITED:
This solution will work only if Face scan and/or Iris scan authentications on that device are considered WEAK methods.
