android - 添加/删除指纹后 key 永久失效异常

Question

当用户添加新指纹或删除任何现有指纹，然后尝试启动应用程序时，它会抛出 KeyPermanentlyInvalidatedException

这是我的指纹代码:

 public Boolean auth(FingerprintManager.AuthenticationCallback callback) {
    try {
        KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
        if (store == null) {
            return null;
        }

        Cipher cipher = accessCipher();
        if (cipher == null) {
            return null;
        }

        store.load(null);
        SecretKey key = (SecretKey) store.getKey(DEFAULT_KEY_NAME, DEFAULT_STORE_PASS.toCharArray());
        cipher.init(Cipher.ENCRYPT_MODE, key);

        FingerprintManager manager = initManager();
        if (manager == null) {
            return null;
        }

        manager.authenticate(
                generateCryptoObject(cipher),
                generateCancellationSignal(),
                0,
                callback,
                null
        );

        return true;
    } catch (Throwable exc) {
        Logger.error(TAG, exc.getLocalizedMessage(), exc);
        return null;
    }
}



private Cipher accessCipher() {
    try {
        return Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
                + KeyProperties.BLOCK_MODE_CBC + "/"
                + KeyProperties.ENCRYPTION_PADDING_PKCS7);
    } catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
        // Was not available.
        return null;
    }
}

在 onResume() 中调用了 auth 方法。

整个 FingerPrintUtils 类:

`

public class FingerPrintUtils {

    private static final String TAG = FingerPrintUtils.class.getSimpleName();
    private static final String DEFAULT_KEYSTORE = "AndroidKeyStore";
    private static final String DEFAULT_KEY_NAME = "myApplication";
    private static final String DEFAULT_STORE_PASS = "csdgh@jkbvj@";
    private static FingerPrintUtils fingerPrintUtils;

    private Boolean isCancelled;
    private CancellationSignal cancellationSignal;

    @TargetApi(23)
    public static FingerPrintUtils getInstance() {
        if (fingerPrintUtils == null) {
            fingerPrintUtils = new FingerPrintUtils();
        }
        return fingerPrintUtils;
    }

    @TargetApi(23)
    public Boolean isFingerAuthAvailable() {
        Boolean hasHarware = hasHardware();
        if (hasHarware == null || !hasHarware) {
            return false;
        }

        Boolean hasPrint = hasRegisteredPrint();
        if (hasPrint == null || !hasPrint) {
            return false;
        }
        return true;
    }

    @TargetApi(23)
    public Boolean hasHardware() {
        FingerprintManager manager = initManager();
        if (manager == null) {
            return null;
        }

        return manager.isHardwareDetected();
    }

    @TargetApi(23)
    public Boolean hasRegisteredPrint() {
        FingerprintManager manager = initManager();
        if (manager == null) {
            return null;
        }

        return manager.hasEnrolledFingerprints();
    }

    @TargetApi(23)
    public Boolean createKey() {
        try {
            KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
            if (store == null) {
                return null;
            }

            KeyGenerator generator = accessKeyGen(KeyProperties.KEY_ALGORITHM_AES, DEFAULT_KEYSTORE);
            if (generator == null) {
                return null;
            }

            generator.init(new KeyGenParameterSpec.Builder(
                    DEFAULT_KEY_NAME,
                    KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT
            )
                    .setBlockModes(KeyProperties.BLOCK_MODE_CBC)
                            // Require the user to authenticate with a fingerprint to authorize every use
                            // of the key
                    .setUserAuthenticationRequired(true)
                    .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7)
                    .build());
            generator.generateKey();
            return true;
        } catch (Throwable exc) {
            Logger.error(TAG, exc.getLocalizedMessage(), exc);
            return false;
        }
    }

    @TargetApi(23)
    public Boolean keyExist() {
        try {
            KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
            if (store == null) {
                return null;
            }

            store.load(null);
            SecretKey key = (SecretKey) store.getKey(DEFAULT_KEY_NAME, DEFAULT_STORE_PASS.toCharArray());
            if (key != null) {
                return true;
            }

        } catch (Throwable exc) {
            Logger.error(TAG, exc.getLocalizedMessage(), exc);
            return null;
        }
        return false;
    }

    @TargetApi(23)
    public Boolean auth(FingerprintManager.AuthenticationCallback callback) {
        try {
            KeyStore store = accessKeyStore(DEFAULT_KEYSTORE);
            if (store == null) {
                return null;
            }

            Cipher cipher = accessCipher();
            if (cipher == null) {
                return null;
            }

            store.load(null);
            SecretKey key = (SecretKey) store.getKey(DEFAULT_KEY_NAME, DEFAULT_STORE_PASS.toCharArray());
            cipher.init(Cipher.ENCRYPT_MODE, key);

            FingerprintManager manager = initManager();
            if (manager == null) {
                return null;
            }

            manager.authenticate(
                    generateCryptoObject(cipher),
                    generateCancellationSignal(),
                    0,
                    callback,
                    null
            );

            return true;
        } catch (Throwable exc) {
            Logger.error(TAG, exc.getLocalizedMessage(), exc);
            return null;
        }
    }

    @TargetApi(23)
    public Boolean stop() {
        if (isCancelled != null && !isCancelled) {
            isCancelled = true;
            cancellationSignal.cancel();
            cancellationSignal = null;
            return true;
        }
        return false;
    }

    @TargetApi(23)
    private FingerprintManager initManager() {
        Context context = BasePreferenceHelper.getCurrentContext();
        if (context == null) {
            return null;
        }

        if(Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
            return null;
        }

        FingerprintManager manager = (FingerprintManager) context.getSystemService(Context.FINGERPRINT_SERVICE);
        if (manager == null) {
            return null;
        }

        return manager;
    }

    @TargetApi(23)
    private Cipher accessCipher() {
        try {
            return Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
                    + KeyProperties.BLOCK_MODE_CBC + "/"
                    + KeyProperties.ENCRYPTION_PADDING_PKCS7);
        } catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
            // Was not available.
            return null;
        }
    }

    @TargetApi(23)
    private KeyStore accessKeyStore(String storeName) {
        try {
            return KeyStore.getInstance(storeName);
        } catch (Throwable exc) {
            // Was not available.
            return null;
        }
    }

    @TargetApi(23)
    private FingerprintManager.CryptoObject generateCryptoObject(Cipher cipher) {
        if (cipher == null) {
            throw new IllegalArgumentException("Cipher is required.");
        }
        return new FingerprintManager.CryptoObject(cipher);
    }

    @TargetApi(23)
    private CancellationSignal generateCancellationSignal() {
        cancellationSignal = new CancellationSignal();
        isCancelled = false;
        return cancellationSignal;
    }

    @TargetApi(23)
    private KeyGenerator accessKeyGen(String algo, String storeName) {
        try {
            return KeyGenerator.getInstance(algo, storeName);
        } catch (Throwable exc) {
            // Was not available.
            return null;
        }
    }
}

`

Answer 1

在您的FingerPrintUtils#Auth() 方法中，初始化cipher.init() 时，将其放入try catch block 。通过从 keystore 中删除 key 来处理 KeyInvalidatedException，然后使用 createKey() 方法再次创建 key 。它肯定会起作用。

同样使用下面的代码。

try
{
    cipher.init(Cipher.ENCRYPT_MODE, key);
}
catch (KeyPermanentlyInvalidatedException e)
{
    store.deleteEntry(DEFAULT_KEY_NAME);
    createKey();
    auth(callback);
    return false;
}