在我的应用中,当用户在初始设置 [指纹注册] 中扫描他们的手指时,我会保存一个加密版本的用户访问代码。当用户稍后尝试解锁应用程序时,我将尝试使用指纹 API [指纹验证] 解密此访问代码。
然而,在解密时,Cipher.doFinal
会抛出以下异常:
javax.crypto.BadPaddingException
at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:482)
at javax.crypto.Cipher.doFinal(Cipher.java:1502)
(...)
Caused by: android.security.KeyStoreException: Invalid argument
at android.security.KeyStore.getKeyStoreException(KeyStore.java:940)
at android.security.keystore.KeyStoreCryptoOperationChunkedStreamer.doFinal(KeyStoreCryptoOperationChunkedStreamer.java:224)
at android.security.keystore.AndroidKeyStoreCipherSpiBase.engineDoFinal(AndroidKeyStoreCipherSpiBase.java:473)
... 12 more
指纹扫描仪显示在一个
DialogFragment
中。无论是正在注册指纹还是验证指纹,以下函数都会按照构造函数的顺序调用。初始化密钥库:
private void initializeKeystore() {
try {
mKeyStore = KeyStore.getInstance(KEY_STORE_NAME); //AndroidKeyStore
} catch (KeyStoreException e) {
mKeyStore = null;
}
try {
mKeyGenerator = KeyGenerator.getInstance(KeyProperties.KEY_ALGORITHM_AES, KEY_STORE_NAME);
} catch (NoSuchAlgorithmException | NoSuchProviderException e) {
mKeyGenerator = null;
}
}
创建一个密钥:
private void createKey() {
if (mKeyGenerator != null) {
try {
mKeyStore.load(null);
KeyGenParameterSpec.Builder builder = new KeyGenParameterSpec.Builder(KEY_NAME,
KeyProperties.PURPOSE_ENCRYPT | KeyProperties.PURPOSE_DECRYPT)
.setBlockModes(KeyProperties.BLOCK_MODE_CBC)
.setUserAuthenticationRequired(true)
.setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_PKCS7);
mKeyGenerator.init(builder.build());
mKeyGenerator.generateKey();
} catch (NoSuchAlgorithmException | InvalidAlgorithmParameterException |
CertificateException | IOException e) {
mKeyGenerator = null;
}
}
}
创建加密对象:
private void createCipher() {
try {
mCipher = Cipher.getInstance(KeyProperties.KEY_ALGORITHM_AES + "/"
+ KeyProperties.BLOCK_MODE_CBC + "/"
+ KeyProperties.ENCRYPTION_PADDING_PKCS7);
} catch (NoSuchAlgorithmException | NoSuchPaddingException e) {
mCipher = null;
}
}
当指纹扫描API成功验证用户身份时,以下代码按顺序调用:
@Nullable Cipher getCipher(@NonNull final FingerprintStore ivStore) {
if (mKeyStore != null && mKeyGenerator != null && mCipher != null) {
try {
mKeyStore.load(null);
SecretKey key = (SecretKey)mKeyStore.getKey(KEY_NAME, null);
switch (mEncryptionMode) {
case MODE_ENCRYPT:
mCipher.init(Cipher.ENCRYPT_MODE, key);
ivStore.writeIv(mCipher.getParameters().getParameterSpec(IvParameterSpec.class).getIV());
break;
case MODE_DECRYPT:
byte[] iv = ivStore.readIv();
mCipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(iv));
break;
}
return mCipher;
} catch (KeyStoreException | CertificateException | UnrecoverableKeyException | IOException
| NoSuchAlgorithmException | InvalidKeyException | InvalidAlgorithmParameterException
| InvalidParameterSpecException | NullPointerException e) {
return null;
}
}
return null;
}
使用上一次调用返回的Cipher实例:
@Nullable byte[] encryptOrDecrypt(@NonNull Cipher cipher, @NonNull byte[] subject) {
try {
return cipher.doFinal(subject);
} catch (BadPaddingException | IllegalBlockSizeException e) {
e.printStackTrace();
return null;
}
}
使用doFinal
加密数据时运行良好,但在解密时会抛出异常。我已检查了初始化向量和加密数据的byte[]
,发现它们正确地被存储到磁盘(Base64编码),并成功地读回内存。