Skip to content

Potential fix for code scanning alert no. 2: Insecure local authentication #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mapgie merged 1 commit into from
Jun 2, 2026
Merged

Potential fix for code scanning alert no. 2: Insecure local authentication #87

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 42 additions & 2 deletions app/src/main/java/com/mapgie/goflo/ui/screens/auth/LockScreen.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,12 @@ import androidx.compose.ui.unit.dp
import com.mapgie.goflo.ui.theme.ComfortaaFamily
import androidx.core.content.ContextCompat
import androidx.fragment.app.FragmentActivity
import android.security.keystore.KeyGenParameterSpec
import android.security.keystore.KeyProperties
import java.security.KeyStore
import javax.crypto.Cipher
import javax.crypto.KeyGenerator
import javax.crypto.SecretKey

@Composable
fun LockScreen(
Expand Down Expand Up @@ -172,18 +178,52 @@ private fun PadKey(label: String, onClick: () -> Unit) {
}
}

private const val LOCK_SCREEN_KEY_ALIAS = "goflo_lock_screen_biometric_key"

private fun getOrCreateSecretKey(): SecretKey {
val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
(keyStore.getKey(LOCK_SCREEN_KEY_ALIAS, null) as? SecretKey)?.let { return it }

val keyGenerator = KeyGenerator.getInstance(
KeyProperties.KEY_ALGORITHM_AES,
"AndroidKeyStore"
)
val keySpec = KeyGenParameterSpec.Builder(
LOCK_SCREEN_KEY_ALIAS,
KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT
)
.setBlockModes(KeyProperties.BLOCK_MODE_CBC)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7)
.setUserAuthenticationRequired(true)
.setInvalidatedByBiometricEnrollment(true)
.build()
keyGenerator.init(keySpec)
return keyGenerator.generateKey()
}

private fun getCipher(): Cipher {
return Cipher.getInstance(
"${KeyProperties.KEY_ALGORITHM_AES}/${KeyProperties.BLOCK_MODE_CBC}/${KeyProperties.ENCRYPTION_PADDING_PKCS7}"
)
}

private fun showBiometricPrompt(activity: FragmentActivity, onSuccess: () -> Unit) {
val canAuthenticate = BiometricManager.from(activity)
.canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG)
if (canAuthenticate != BiometricManager.BIOMETRIC_SUCCESS) return

val secretKey = getOrCreateSecretKey()
val cipher = getCipher().apply { init(Cipher.ENCRYPT_MODE, secretKey) }

val executor = ContextCompat.getMainExecutor(activity)
val prompt = BiometricPrompt(
activity,
executor,
object : BiometricPrompt.AuthenticationCallback() {
override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
onSuccess()
if (result.cryptoObject?.cipher != null) {
onSuccess()
}
}
}
)
Expand All @@ -192,5 +232,5 @@ private fun showBiometricPrompt(activity: FragmentActivity, onSuccess: () -> Uni
.setSubtitle("Use your biometric credential")
.setNegativeButtonText("Use PIN")
.build()
prompt.authenticate(info)
prompt.authenticate(info, BiometricPrompt.CryptoObject(cipher))
}
Loading