Android supports fingerprint api from Android 6.0 (Marshmallow) SDK 23
To use this feature in your app, first add the USE_FINGERPRINT permission in your manifest.
<uses-permission
android:name="android.permission.USE_FINGERPRINT" />
Here the procedure to follow
First you need to create a symmetric key in the Android Key Store using KeyGenerator which can be only be used after the user has authenticated with fingerprint and pass a KeyGenParameterSpec.
KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore");
keyPairGenerator.initialize(
new KeyGenParameterSpec.Builder(KEY_NAME,
KeyProperties.PURPOSE_SIGN)
.setDigests(KeyProperties.DIGEST_SHA256)
.setAlgorithmParameterSpec(new ECGenParameterSpec("secp256r1"))
.setUserAuthenticationRequired(true)
.build());
keyPairGenerator.generateKeyPair();
By setting KeyGenParameterSpec.Builder.setUserAuthenticationRequired to true, you can permit the use of the key only after the user authenticate it including when authenticated with the user's fingerprint.
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
PublicKey publicKey =
keyStore.getCertificate(MainActivity.KEY_NAME).getPublicKey();
KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
keyStore.load(null);
PrivateKey key = (PrivateKey) keyStore.getKey(KEY_NAME, null);
Then start listening to a fingerprint on the fingerprint sensor by calling FingerprintManager.authenticate with a Cipher initialized with the symmetric key created. Or alternatively you can fall back to server-side verified password as an authenticator.
Create and initialise the FingerprintManger
from fingerprintManger.class
getContext().getSystemService(FingerprintManager.class)
To authenticate use FingerprintManger
api and create subclass using
FingerprintManager.AuthenticationCallback
and override the methods
onAuthenticationError
onAuthenticationHelp
onAuthenticationSucceeded
onAuthenticationFailed
To Start
To startListening the fingerPrint event call authenticate method with crypto
fingerprintManager
.authenticate(cryptoObject, mCancellationSignal, 0 , this, null);
Cancel
to stop listenting the scanner call
android.os.CancellationSignal;
Once the fingerprint (or password) is verified, the FingerprintManager.AuthenticationCallback#onAuthenticationSucceeded() callback is called.
@Override
public void onAuthenticationSucceeded(AuthenticationResult result) {
}