New in Android Samples: Authenticating to remote servers using the Fingerprint API

1. Setting Up: Creating an asymmetric keypair

First you need to create an asymmetric key pair as follows:

KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore");

keyPairGenerator.initialize(

        new KeyGenParameterSpec.Builder(KEY_NAME,

                KeyProperties.PURPOSE_SIGN)

                .setDigests(KeyProperties.DIGEST_SHA256)

                .setAlgorithmParameterSpec(new ECGenParameterSpec("secp256r1"))

                .setUserAuthenticationRequired(true)

                .build());

keyPairGenerator.generateKeyPair();

Note that .setUserAuthenticationRequired(true) requires that the user authenticate with a registered fingerprint to authorize every use of the private key.

Then you can retrieve the created private and public keys with as follows:

KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");

keyStore.load(null);

PublicKey publicKey =

        keyStore.getCertificate(MainActivity.KEY_NAME).getPublicKey();



KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");

keyStore.load(null);

PrivateKey key = (PrivateKey) keyStore.getKey(KEY_NAME, null);

2. Registering: Enrolling the public key with your server

Second, you need to transmit the public key to your backend so that in the future the backend can verify that transactions were authorized by the user (i.e. signed by the private key corresponding to this public key).
This sample uses the fake backend implementation for reference, so it mimics the transmission of the public key, but in real life you need to transmit the public key over the network.

boolean enroll(String userId, String password, PublicKey publicKey);

3. Let’s Go: Signing transactions with a fingerprint

To allow the user to authenticate the transaction, e.g. to purchase an item, prompt the user to touch the fingerprint sensor.