Advanced Android Fingerprint Security
summary
Shows a working diary app on GitHub that encrypts entries at rest and unlocks them with fingerprint auth, using Android Keystore AES keys generated with the KeyGenerator and authenticated via fingerprintManager (API 23) inside the TEE/trusty. Demonstrates saving the IV, explains key invalidation differences between Android M and N and the risk that enrollment can permanently kill keys, offers a mitigation using a PBKDF2 recovery passphrase and examples with Realm and SQLCipher, and proves the flow by decrypting the database after fingerprint auth.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:30Background
- 5:02Android Compatibility Definition
- 12:40Initialization Vector
- 14:25Authentication
- 17:38Key Validation
- 23:41Key derivation
- 25:49Encryption
- 27:50What to keep
