2 files changed, 17 insertions, 3 deletions
diff --git a/app/src/main/java/app/passwordstore/util/auth/BiometricAuthenticator.kt b/app/src/main/java/app/passwordstore/util/auth/BiometricAuthenticator.kt
index 9458e8f4..4aad4588 100644
--- a/app/src/main/java/app/passwordstore/util/auth/BiometricAuthenticator.kt
+++ b/app/src/main/java/app/passwordstore/util/auth/BiometricAuthenticator.kt
@@ -5,6 +5,7 @@
 package app.passwordstore.util.auth
 
 import android.app.KeyguardManager
+import android.os.Build
 import androidx.annotation.StringRes
 import androidx.biometric.BiometricManager
 import androidx.biometric.BiometricManager.Authenticators
@@ -18,8 +19,18 @@ import logcat.logcat
 object BiometricAuthenticator {
 
   private const val TAG = "BiometricAuthenticator"
-  private const val VALID_AUTHENTICATORS =
-    Authenticators.DEVICE_CREDENTIAL or Authenticators.BIOMETRIC_WEAK
+
+  /**
+   * Keystore keys that require user authentication are unlocked only by the device credential or a
+   * Class 3 (strong) biometric, so a weak biometric would pass the prompt and then fail to sign or
+   * decrypt with `User not authenticated`. Android 9 and 10 do not support combining
+   * [Authenticators.BIOMETRIC_STRONG] with [Authenticators.DEVICE_CREDENTIAL], so they keep the
+   * weak class.
+   */
+  private val VALID_AUTHENTICATORS =
+    Authenticators.DEVICE_CREDENTIAL or
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) Authenticators.BIOMETRIC_STRONG
+      else Authenticators.BIOMETRIC_WEAK
 
   /**
    * Sealed class to wrap [BiometricPrompt]'s [Int]-based return codes into more easily-interpreted
diff --git a/app/src/main/java/app/passwordstore/util/git/sshj/SshKey.kt b/app/src/main/java/app/passwordstore/util/git/sshj/SshKey.kt
index a7127ec6..99e600bf 100644
--- a/app/src/main/java/app/passwordstore/util/git/sshj/SshKey.kt
+++ b/app/src/main/java/app/passwordstore/util/git/sshj/SshKey.kt
@@ -282,7 +282,10 @@ object SshKey {
         if (requireAuthentication) {
           setUserAuthenticationRequired(true)
           if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-            setUserAuthenticationParameters(30, KeyProperties.AUTH_DEVICE_CREDENTIAL)
+            setUserAuthenticationParameters(
+              30,
+              KeyProperties.AUTH_DEVICE_CREDENTIAL or KeyProperties.AUTH_BIOMETRIC_STRONG,
+            )
           } else {
             @Suppress("DEPRECATION") setUserAuthenticationValidityDurationSeconds(30)
           }