diff options
| author | Danilo M. <danix@danix.xyz> | 2026-11-02 18:01:43 +0100 |
|---|---|---|
| committer | Danilo M. <danix@danix.xyz> | 2026-11-02 18:01:43 +0100 |
| commit | 95ebfbe95e733456dff4c53ced3cf2e17ae991c1 (patch) | |
| tree | 50e43d78a5b065554302aef7be5e098715ee1dfb /app/src/main/java/org/slf4j/impl | |
| parent | 253f82e2dcb06619b54aca0cc4afc39735810e4c (diff) | |
| download | HardenedPass-95ebfbe95e733456dff4c53ced3cf2e17ae991c1.tar.gz HardenedPass-95ebfbe95e733456dff4c53ced3cf2e17ae991c1.zip | |
fix(ssh): unlock screen-lock protected SSH keys with a fingerprint
A Keystore SSH key generated with "Protect with screen lock credential"
was bound to AUTH_DEVICE_CREDENTIAL only, while the unlock prompt also
accepted biometrics. A fingerprint passed the prompt, then signing the
SSH auth request threw UserNotAuthenticatedException, sshj logged "User
not authenticated" and the clone failed with "Socket closed".
Bind new keys to AUTH_DEVICE_CREDENTIAL or AUTH_BIOMETRIC_STRONG, and
allow only strong biometrics in the prompt on Android 11+, since weak
ones never unlock Keystore keys (the androidx MasterKey keys already
use credential or strong biometric). Android 9 and 10 cannot combine
BIOMETRIC_STRONG with DEVICE_CREDENTIAL, so they keep the weak class.
Existing protected keys still need the PIN until regenerated.
Verified on the emulator (Class 3 fingerprint): a protected ECDSA key
unlocked with a fingerprint authenticates and clones over SSH.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'app/src/main/java/org/slf4j/impl')
0 files changed, 0 insertions, 0 deletions