authgear / authgear/authgear-server

More secure biometric implementation

Open
#3,101 2 comments 0 reactions 0 assignees View on GitHub
cooldown/enhancement security
Dominant language
Go
Stars
2k
Forks
125
Avg merge
2d 17h
Merged PRs (30d)
32

Description

- On iOS, store the newly generated keys in the Secure Enclave. https://developer.apple.com/documentation/security/certificate_key_and_trust_services/keys/protecting_keys_with_the_secure_enclave
- On Android, store the newly generated keys in Strongbox Keymaster, if it is available.
https://developer.android.com/training/articles/keystore#HardwareSecurityModule
- Make sure preexisting keys are still usable. That is, if biometric has been enabled before the update, it must still work.

The update does not effect the public API. To take effect, biometric has to be disabled, and enabled again.

Contributor guide

Open the contributing guide

Research direction

Locate the iOS and Android biometric key-generation and storage paths, then inspect how existing keys are loaded after an update. Check the platform documentation linked in the issue first; done means new keys use Secure Enclave or StrongBox when available, while preexisting keys remain usable after re-enabling biometric authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, ios
Domain
authentication, mobile, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.