Security at your fingertips
CC Attribution - ShareAlike 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal and non-commercial purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Schweiger, Frederik
Android Marshmallow has introduced a lot of fresh features and the new permission system is by far not the only new security enhancement. Most of you already use their finger to unlock the smartphone and may have heard about this new fingerprint API - but have you ever played with it? And once we’re there: Do you know about the newly introduced improvements in the keystore API? No? Then this talk is definitely for you! Still hesitating? Just remember that security and a good user experience is something we cannot know enough about. With just a few simple steps you can learn how to increase the security of your app, making authentication easier and your users happier - all at once. And to be honest: in the end that’s all we want, right?
 Hello, everyone. Welcome to my talk, security at your fingertips. Dive into Marshmallow's new fingerprint and key store APIs. I think some of you, or at least some of you, have like a new phone in their pockets, which is like running Android Marshmallow or later. So I think it's kind of interesting for you. And yeah, let me start with the obligatory about me slide. So yeah, that's me as product. I'm for extra idea. I'm a computer science student sitting there at 30,000 feet at the edge of a plane. And if I'm not like doing skydiving, I'm mostly like going to work as a student employee with the mobile guys here at Trivago. And when I'm not doing anything of both, you will probably find me at university. So yeah, cryptography. Cryptography is such a cool sounding word. But unfortunately, so many people are getting it wrong. And not for nothing like broken or no cryptography is is one of the top 10. Yeah, mobile risk for 2014. And in 2014 and 2015. And it wasn't really like in the in the top 10, it was always in the top top three or top four. And yeah, handle on your on your heart, whoever use like the Android key store provider, or some encryption in their app like to store user data or user information user passwords. Yeah, at least a few of you. So the question I want to answer in this talk is how can I like as an Android developer, yeah, store my user sensitive information securely in my app. So and this is like an elementary problem. Each of us will have or already got. So if you want to secure information like log and data or like tokens or whatever. And until now there was not a better reliable way to do this. And but fortunately, there is like the Android key store. But well, what does it do? Yeah, it stores keys, the secure way. And but let's start at the beginning. Most of us provide like system services to securely store these authentication keys. And there's no need for the for developers to implement them by their selves. So Android 1.6 have like a credential storage for VPN and Wi Fi. But unfortunately, this whole storage wasn't accessible by apps themselves. So public key infrastructure was was done by like via the settings app. But unfortunately, if you want to build an app by your own, it wasn't possible like to use any certificate in placed inside this store. Android 4.0 finally introduced like the public key chain API, which made possible like to install this this type of certificates. And it's it was no possible like to access the system credential store. And unfortunately, all these keys were like system wide shared. So if you want to have an application, which only used like an app private key, so only for your private server and you didn't want another company or another app to use this certificate, this wasn't possible. And additional to that, this wasn't the nicest solution because in the end you just had like an intent, you were able to fire. And then they popped up the system dialogue where you could select this this whatever like, yeah, certificates and all this kind of stuff. And if you think about like this, that not every every user is like has has a technical background. It's not the best user experience for them. So in Android 4.1, they finally introduced like the key master also it's that there was a huge change like under the hood in the art and wrote architecture. And for four or three, finally introduced like the Android key store. And the Android key store is not like another Android specific API like the key chain. It's more based on the the JCI architecture. So you can use all the all Java Java. Yeah, API is to yeah, work with with the key store. And yeah, this key stores finally supports like hard part back credential storage, like entrusted environments. And the first device was the next fear and X4. And these app private keys were now possible through this input implementation. Unfortunately, this implementation wasn't so clear to every developer. And sometimes the key data got wiped or it was broken when the user changed like their lock pattern or the passwords or whatever. And then the key data was corrupted and the people warned you as a developer wasn't weren't able to to use this certificate anymore. And now finally, Android six and Android and improve this drastically and they changed everything under the hood and reimplemented it. I think there was a completely rewrite inside like the key key master and key store thing. And yeah, this talk will focus on on the JCI key store provider. And yeah, so maybe someone of you has already worked with the key store API. I don't know. So you may know like the key pair generator spec class. So if so, you can like forget about it because it's deprecated since API level 23. And it's now called the key and parameter spec class. So the key game parameter spec class implements the algorithm parameter spec for the key pair generator or the key generator. And in the end, the key generator and key pair generator are just generator classes, engine classes, which are capable of generating private and the related public key material utilizing the algorithm they were initialized with. And the whole thing is instantiated by the key game parameter spec builder. Yeah. And this builder determines like the authorized use of the key. If user authentication is required or not. And what operations are authorized like signing decrypting or encrypting and with what parameters like only particular padding schemes or digits and the key keys validity, validity start and then dates. So let's just dive into a short example on how this works to generate like the symmetric key. We have like the key generator class, which will be instantiated with the yeah, key property, key algorithm, a yes, and the Android key store. And after that, we have, we create the key camera, camera, key in parameter spec builder class. And we pass our alias of the key and our purposes. If you want to encrypt or decrypt key material, it's very important to have like to specify all the purposes you want to like if you want to decrypt or encrypt or to sign. Because if you want to use that key, the key store implementation only lets you use the key for this specified purpose. And here is how everything works. It's just a simple builder pattern. So you can set like the key size to 256 bits, the block mode and the encryption padding. So it's like all this encryption specific stuff. And after all, you just say key generator dot in it with the build a build and key generator dot generate key and the key is generated. And now we would have like the my awesome secret key or one stored inside our key store. The equivalent for like an RSA key would look like this. It's just like the same except that we have like the key property for key algorithm RSA and the key property purpose sign and like a calendar for start and end date because every key inside the key store needs like a valid certificate and it creates it by its own, but you can replace it with a sign certificate from the certificate authority later. So yeah. So after that we successfully created my awesome secret key 01. And if you want to encrypt something, it's super like straightforward. We again, we have like we try to get an instance to the key store with the Android key store provider. And after that, we have this all relict of the Java cryptography API where we have to call dot load, even if we don't have like an input stream or whatever to load it with. But yeah, this is like the API of the JCA. And then we get the secret key from the key store and instantiate a cypher. So we say secret key key store, get key my awesome secret key. And yeah, after that we get the instance to our cypher with the parameters we specified in our builder. And after that we can simply like initialize the cypher and encrypt and yeah, decrypt the plain text and finally have this encrypted bytes area there. The same, it's more or less the same for like decrypting all the stuff. It's just changed like the last row where we are initializing the cypher with the decrypt mode. And the secret key ends the initial initialization vector which was generated when we like encrypted our bytes. And after that we say just cypher to final and we have the decrypted bytes again there. So the key advantages of the new key store are it's like an OS provider safe for all the key material like keys and certificates. And we have like a hardware backed cryptography API. And we have the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store, the key store and the key store and the key store. And we have the hardware backed cryptography and for secure storage and a trusted execution environment. So even if your device is like compromised by a hacker or you have like a security security security, it doesn't matter. All the key material isn't able to be like extracted from the device because it never leaves the device. And now we can reliably and securely create and store app private keys which was able like from Android 4.3 and our boards. But now they improve the whole API and the reliability of the thing. And yeah, they added support for some different like algorithms. You can look at that at the Android documentation for RSA like elliptic curves, IES and HMAC keys. So yeah, trust on here, trust on there and trust on everywhere. It's like currently 80 to 90% of all the devices already have like this trusted execution environment from Qualcomm. They call the trust zone. It's currently used for like digital rights management to play this kind of media. And the cool thing is that actually like 80 to 90% are already like having this kind of chip or in this case, I think it's just like a different privilege level in the CPU. And the cool part is that this is a requirement of Android N. So every device which will be shipped with Android N has like a trust zone enabled CPU. So you can store all your key material inside it in a secure way. But as we all know, like the authentication is a bad user experience and we want to get over it. So we're living in 2016 and Google is already like inventing self-driving cars and bringing the internet out to everyone with balloons. And finally, they introduced fingerprint support on Android. But let's start there at the beginning. Authentication is annoying and is time consuming. Comes up too often and almost 50% of all Android users do not have a lock screen enabled because of that. Because if you just like pull out your pocket, you just want to check your whatever the weather or just your bank account balance, you always have to authenticate in every app. And this is what the users dislike. And the cool part of it, you can now integrate the authentication process inside like with the unlock process of the device. So if I pull out my device out of my pocket, I can check with the key store if the user recently authenticated. And if it says yes, I can just like skip the login screen or the authentication screen in my app. So this is a really great way to improve the user experience there. So yeah, with these two methods, if you use it on the builder I just shown to you, you can just set user authentication required and set user authentication valid duration seconds to something. So if you're just saying, yeah, let's say 15 seconds or 30 seconds. When you're just like in this time span, you can just get the key material, which was created like in the key store without like authenticating again. And that's pretty cool. I show you how it works. You just have your build a pattern there and you add this to parameters. And after that, you can in this try and catch clause where you usually would like initialize and decrypt your data. You have like another catch clause and you can catch the user not authenticated exception there. And then you can say, yeah, the user is not authenticated. So let's do something there. So we could like show the user an authentication screen from the from the operating system. And this is called the rate confirmed device credential intent. And you can also like customize this whole thing. And this looks like this. And in your in this app is by the way a demo app you can download on GitHub today. And this is how it looks like if you want to encrypt or decrypt something and you're not authenticated, we get like this default lock screen behavior where the user can authenticate with their pattern, the password, or like with fingerprint. So you already have like the fingerprint option in built in there. If you don't want to build your own user interface. So and in on activity result, you check if the result is okay. And yeah, if the system says the user recently authenticated, you just try it again, try it again to get the key initialize the cipher and then try to encrypt or decrypt the data again. And then it should work without throwing the user an authenticated exception. So in the end, authentication just got easier because you don't even have to show like the authentication screen, which I just told you, you can just like pull the pull the phone out of your pocket and go in and go inside your app and skip all that just imagine it if you if you're like a bank and you want. Yeah, have like very user sensitive information like bank account information or how much money you just spend the last night or whatever. And this is pretty cool because the user has like an intent to just check your the his or her like bank account balance or whatever, and he can just pull out his or her phone and go directly to the app without authenticating again. And authentication just got stronger because authentication is now tied like to absolute. So we can authenticate the with the users and have the key store there. And all this credential verification is now that does not happen in the in this secure environment or like trusted execution environment. So all this encryption stuff happens directly inside the ship. And even if the system is compromised, yeah, you can't interfere with it. So but if you want to do like a more easier way, or you want to implement your own user interface, there's also the fingerprint authentication. And the cool thing about fingerprint authentication is that the authentication is now a lot easier for the users and it's even more faster. And we have this consistent authentication flow in your own app if you provide your own user interface. And what's cool is that on Nexus devices with the fingerprint reader with next imprint. Yeah, these lock screen adaption for secure lock screen went from like 50% to over 90%. So many more users are currently like using a lock screen and device encryption by because of the fingerprint reader. And this is pretty cool because it's fast and the users like to interact with it. And by the way, keep in mind if the device doesn't have like a fingerprint sensor yet, there's also the smart lock feature from Google, which currently reduces of this lock screen or authentication problems by 50%. So only every second time there you have to authenticate on your mobile phone. Yeah, when the user has enabled smart lock like this detection, if you're wearing your phone with you or you're just having Android Wear Watch connected to your phone. So, but the key concept of like fingerprint authentication is that you can build your own dialogues for it and you can adapt it to your authentication flow and the user doesn't have to leave your app. So you can simply click the proceed to checkout or buy or whatever button sign in button and then your dialogue or whatever shows up or doesn't need to be a dialogue. You could also like implemented in your activity. And then you can just like tap the sensor and then you're authenticated. So make it really easy. Use fingerprints. What do you need is like a fingerprint reader, a device running Android Marshmallow later and the user who is set up. Yeah, a secure lock screen and of course enrolls and fingerprints. But this thing is optional because we can always force the users to enroll one. So yeah, fingerprint manager. This is like the class you have to use if you want to implement fingerprint access on your phone. It's like a system level service like any any other service and coordinates all the access to to the fingerprint mechanisms. And yeah, you need to use the permission. Use fingerprint in your Android Android manifest. And fortunately, it's not like a critical permission so you don't have to prompt the user to allow access to your fingerprint. And yeah, this is pretty cool. So in the end, yeah, you just like have the code like this, the fingerprint manager and say get system service. And then you're done. You have a reference to the fingerprint manager. And the fingerprint manager also provides methods to check for device compatibility, like is hardware detected or has enrolled some fingerprints. And if not, you can always say, yeah, please go back and check to check the settings and enroll some fingerprints. Or when when he does when the device doesn't have like fingerprints or a fingerprint sensor, then you can always say, yeah, unfortunately, you don't have it, but we could you could also like use the lock screen approach there. And this cost is also available as a competition. So if you're running Android, like 22, LL, API level 22 or 21, you could use the competent class. And then it says, yeah, there's no fingerprint manager or fingerprint reading available because the API level is like 23 or higher. So yeah, the fingerprint manager. The most important method there is the authenticate method method. And it's like the last of those three. You can like check the device, compatibility and authenticate. And the first thing you have to pass over is the crypto object, the cancel signal, which is nullable some flags, which should be always or should be always null zero. A fingerprint manager authentication callback, which you have to implement and handler. And the handler is used for where like the fingerprint callbacks are called on which. So, so yeah, the fingerprint manager crypto object is more or less a wrapper class for the crypto object supported by the fingerprint manager and has just this three simple methods like get cypher get Mac or signature. So it's pretty straightforward there. And the authentication callback provides like the whole callback structure and you have these methods you can like implement the authentication succeeded where you get like this authentication result. And this result simply gets you contains like this fingerprint manager crypto object where you can get your cypher from or whatever. And the others other three methods like on authentication help with the different codes are called when you're just like when the user just swiped or tapped the whole sensor for a too short time or there's another error like dirty sensor. And authentication error is called when there's just an error or the whole. Yeah, authentication stopped and on authentication failed is called when the user just used like a different finger, whatever. So the finger wasn't like, yeah, recognized. So how does work on the authentication succeeded, you can simply like get the crypto object from the results and then the cypher and work with it there. So if you'll just like set the authentication required to your to your key in the key store and you say the duration seconds or set the duration seconds to zero, then you always have to use your fingerprint to authenticate. This is pretty powerful. And yeah, good work, good way to to useless this new method to authenticate the user with you within your app. So the best practices for a great user experience are yeah, the keys to use the key store to check if the user authenticated recently. So you don't have to show an authentication screen again. On if the fingerprint sensor is available, I would always recommend it to you to use it because the users like it a lot. And as you've seen, the adaption of the secure lock screen just went from 50% to over 90%. And it's a quick and fast way of like securely authenticating. And if you don't want to like implement your own authentication user interface and all this kind of stuff, you could always like use the confirm device credential intent, which you can fire and which looks like yeah, this standard lock screen on your Android phone. So it's pretty cool there. So in the end, yeah, we have this short demo here. Yeah, I already showed you shown to you. You can download it on GitHub so you can play through all the different kinds of scenarios there like that you don't need any user authentication if you want to just like store your information securely created like a certificate or whatever. And another one to like enable fingerprint or that the user has to use the fingerprint sensor to unlock the app or another one with the like 15 second interval. But it's completely custom customizable. So you could also use like, yeah, I want to use 30 seconds or up to five minutes or whatever. Yeah, you need so you can see you can always like authenticate with the fingerprint if you have enrolled one. So yeah, the further reading I have here is like the developer training, of course, and what's very interesting if you want to do a more like deep dive into the soul stuff, that's the source that Android.com security or already also a great book is Android Security Internals by Nikolai Alancoff. Unfortunately, this covers only like Android for a far and lower, but definitely a good read. So yeah, thanks everyone for for coming today. And if you have any questions, you can always ping me like on Twitter or on Facebook. And yeah, that's it. If you have any questions or simply ask the questions right now. Yeah, that's what I wanted to say. Thank you, Fred Rick. Who wants the microphone? Yep. Hi, thank you. First question is about what about the solution from other manufacturers like LG, I think have something and for sure something for the not before the devices built before marshmallow. Do they have the same patterns? Do they use the same solutions? How to handle all these cases? Can we combine? Yeah, actually, actually, unfortunately, I don't know like how this works like pre-marshmallow because it's like, as you said, like manufacturers specific. And I actually I can tell you how this works on like Samsung or like an AG device. But yeah, since like marshmallow, all the manufacturers should like implement this API, the fingerprint API and in the key store API. And in the end, yeah, it's up to the manufacturer to to to implement all this security features. So yeah, unfortunately, yeah, it's currently like API level 23 and up. So yeah. Did you see any how fast is the performance of the GCA implementation because before marshmallow with us pretty slow like orders of magnitude slower than if you used open SSL in the K is this now changed. Do they now use hardware accelerated crypto or not? What's the status? And actually, I haven't looked like into into like comparing the speeds or like of the old and the new implementation. So I can tell you that. But I talked to some people at this is Google I O and they told me that yeah, they've done like a completely rewrite of these like key store demon and and the key store API. So I think for me, what I experienced is it's pretty fast and straightforward. So maybe you just try it out and check check back. Hi. Thanks for an amazing talk. So basically, my question is so all those flows that require like fingerprint authentication. So so suppose we test them with with UI test with this press or something. Are there really tools or any approaches to to integrate those those screen flows into UI testing? Yeah, actually, I don't think that there are great like solutions to test like this authentication flow. But actually, I have to admit that I haven't like looked into like specific testing purposes there. So there may be. But actually what I found there wasn't like to be very testable because it it like depends on on the on the phone and because we have like this deep integration with the hardware there there to to to anchor. And the decrypt the material and like fetching it from the from the trust execution environment. So yeah, I unfortunately I can't tell you that because I haven't looked into it. Thank you.
 Hello, everyone. Welcome to my talk, security at your fingertips. Dive into Marshmallow's  new fingerprint and key store APIs. I think some of you, or at least some of you, have  like a new phone in their pockets, which is like running Android Marshmallow or later.  So I think it's kind of interesting for you. And yeah, let me start with the obligatory  about me slide. So yeah, that's me as product. I'm for extra idea. I'm a computer science  student sitting there at 30,000 feet at the edge of a plane. And if I'm not like doing  skydiving, I'm mostly like going to work as a student employee with the mobile guys here  at Trivago. And when I'm not doing anything of both, you will probably find me at university.  So yeah, cryptography. Cryptography is such a cool sounding word. But unfortunately, so  many people are getting it wrong. And not for nothing like broken or no cryptography  is is one of the top 10. Yeah, mobile risk for 2014. And in 2014 and 2015. And it wasn't  really like in the in the top 10, it was always in the top top three or top four. And yeah,  handle on your on your heart, whoever use like the Android key store provider, or some  encryption in their app like to store user data or user information user passwords. Yeah,  at least a few of you. So the question I want to answer in this talk is how can I like as  an Android developer, yeah, store my user sensitive information securely in my app. So and this  is like an elementary problem. Each of us will have or already got. So if you want to  secure information like log and data or like tokens or whatever. And until now there was  not a better reliable way to do this. And but fortunately, there is like the Android key  store. But well, what does it do? Yeah, it stores keys, the secure way. And but let's  start at the beginning. Most of us provide like system services to securely store these  authentication keys. And there's no need for the for developers to implement them by  their selves. So Android 1.6 have like a credential storage for VPN and Wi Fi. But unfortunately,  this whole storage wasn't accessible by apps themselves. So public key infrastructure was  was done by like via the settings app. But unfortunately, if you want to build an app by  your own, it wasn't possible like to use any certificate in placed inside this store. Android  4.0 finally introduced like the public key chain API, which made possible like to install  this this type of certificates. And it's it was no possible like to access the system credential  store. And unfortunately, all these keys were like system wide shared. So if you want to  have an application, which only used like an app private key, so only for your private  server and you didn't want another company or another app to use this certificate, this  wasn't possible. And additional to that, this wasn't the nicest solution because in the  end you just had like an intent, you were able to fire. And then they popped up the system  dialogue where you could select this this whatever like, yeah, certificates and all this  kind of stuff. And if you think about like this, that not every every user is like has  has a technical background. It's not the best user experience for them. So in Android 4.1,  they finally introduced like the key master also it's that there was a huge change like  under the hood in the art and wrote architecture. And for four or three, finally introduced  like the Android key store. And the Android key store is not like another Android specific  API like the key chain. It's more based on the the JCI architecture. So you can use all  the all Java Java. Yeah, API is to yeah, work with with the key store. And yeah, this key  stores finally supports like hard part back credential storage, like entrusted environments.  And the first device was the next fear and X4. And these app private keys were now possible  through this input implementation. Unfortunately, this implementation wasn't so clear to every  developer. And sometimes the key data got wiped or it was broken when the user changed  like their lock pattern or the passwords or whatever. And then the key data was corrupted  and the people warned you as a developer wasn't weren't able to to use this certificate anymore.  And now finally, Android six and Android and improve this drastically and they changed  everything under the hood and reimplemented it. I think there was a completely rewrite  inside like the key key master and key store thing. And yeah, this talk will focus on on  the JCI key store provider. And yeah, so maybe someone of you has already worked with the  key store API. I don't know. So you may know like the key pair generator spec class. So if so,  you can like forget about it because it's deprecated since API level 23. And it's now called the  key and parameter spec class. So the key game parameter spec class implements the algorithm  parameter spec for the key pair generator or the key generator. And in the end, the key generator  and key pair generator are just generator classes, engine classes, which are capable of generating  private and the related public key material utilizing the algorithm they were initialized  with. And the whole thing is instantiated by the key game parameter spec builder. Yeah. And this  builder determines like the authorized use of the key. If user authentication is required or  not. And what operations are authorized like signing decrypting or encrypting and with what  parameters like only particular padding schemes or digits and the key keys validity, validity  start and then dates. So let's just dive into a short example on how this works to generate  like the symmetric key. We have like the key generator class, which will be instantiated with the  yeah, key property, key algorithm, a yes, and the Android key store. And after that, we have, we  create the key camera, camera, key in parameter spec builder class. And we pass our alias of the  key and our purposes. If you want to encrypt or decrypt key material, it's very important to  have like to specify all the purposes you want to like if you want to decrypt or encrypt or to  sign. Because if you want to use that key, the key store implementation only lets you use the key  for this specified purpose. And here is how everything works. It's just a simple builder  pattern. So you can set like the key size to 256 bits, the block mode and the encryption padding.  So it's like all this encryption specific stuff. And after all, you just say key generator dot  in it with the build a build and key generator dot generate key and the key is generated. And now we  would have like the my awesome secret key or one stored inside our key store. The equivalent for  like an RSA key would look like this. It's just like the same except that we have like the key  property for key algorithm RSA and the key property purpose sign and like a calendar for start and end  date because every key inside the key store needs like a valid certificate and it creates it by its  own, but you can replace it with a sign certificate from the certificate authority later. So yeah. So  after that we successfully created my awesome secret key 01. And if you want to encrypt something, it's  super like straightforward. We again, we have like we try to get an instance to the key store with the  Android key store provider. And after that, we have this all relict of the Java cryptography API  where we have to call dot load, even if we don't have like an input stream or whatever to load it with. But  yeah, this is like the API of the JCA. And then we get the secret key from the key store and instantiate a  cypher. So we say secret key key store, get key my awesome secret key. And yeah, after that we get the  instance to our cypher with the parameters we specified in our builder. And after that we can  simply like initialize the cypher and encrypt and yeah, decrypt the plain text and finally have this  encrypted bytes area there. The same, it's more or less the same for like decrypting all the stuff. It's  just changed like the last row where we are initializing the cypher with the decrypt mode. And the secret  key ends the initial initialization vector which was generated when we like encrypted our  bytes. And after that we say just cypher to final and we have the decrypted bytes again there. So the key  advantages of the new key store are it's like an OS provider safe for all the key material like keys and  certificates. And we have like a hardware backed cryptography API. And we have the key store, the  key store, the key store, the key store, the key store, the key store, the key store, the key store, the  key store, the key store, the key store, the key store, the key store, the key store, the key store  and the key store and the key store. And we have the hardware backed cryptography and for secure storage and a  trusted execution environment. So even if your device is like compromised by a hacker or you have like  a security security security, it doesn't matter. All the key material isn't able to be like extracted from the device because it never leaves the device. And now we can  reliably and securely create and store app private keys which was able like from Android 4.3 and  our boards. But now they improve the whole API and the reliability of the thing. And yeah, they added support for some different  like algorithms. You can look at that at the Android documentation for RSA like elliptic curves, IES and HMAC keys. So yeah, trust on  here, trust on there and trust on everywhere. It's like currently 80 to 90% of all the devices already have like this  trusted execution environment from Qualcomm. They call the trust zone. It's currently used for like digital rights management to play this kind of  media. And the cool thing is that actually like 80 to 90% are already like having this kind of chip or in this case, I think it's just like a different  privilege level in the CPU. And the cool part is that this is a requirement of Android N. So every device which will be shipped with Android N has like a trust  zone enabled CPU. So you can store all your key material inside it in a secure way. But as we all know, like the authentication is a bad user  experience and we want to get over it. So we're living in 2016 and Google is already like inventing self-driving cars and bringing the internet out to  everyone with balloons. And finally, they introduced fingerprint support on Android. But let's start there at the beginning.  Authentication is annoying and is time consuming. Comes up too often and almost 50% of all Android users do not have a lock screen enabled because of that.  Because if you just like pull out your pocket, you just want to check your whatever the weather or just your bank account balance, you always have to authenticate in every app.  And this is what the users dislike. And the cool part of it, you can now integrate the authentication process inside like with the unlock process of the device.  So if I pull out my device out of my pocket, I can check with the key store if the user recently authenticated. And if it says yes, I can just like skip the login screen or the authentication screen in my app.  So this is a really great way to improve the user experience there. So yeah, with these two methods, if you use it on the builder I just shown to you, you can just set user authentication required and set user authentication valid duration seconds to something.  So if you're just saying, yeah, let's say 15 seconds or 30 seconds. When you're just like in this time span, you can just get the key material, which was created like in the key store without like authenticating again.  And that's pretty cool. I show you how it works. You just have your build a pattern there and you add this to parameters.  And after that, you can in this try and catch clause where you usually would like initialize and decrypt your data. You have like another catch clause and you can catch the user not authenticated exception there.  And then you can say, yeah, the user is not authenticated. So let's do something there. So we could like show the user an authentication screen from the from the operating system.  And this is called the rate confirmed device credential intent. And you can also like customize this whole thing. And this looks like this.  And in your in this app is by the way a demo app you can download on GitHub today. And this is how it looks like if you want to encrypt or decrypt something and you're not authenticated, we get like this default lock screen behavior where the user can authenticate with their pattern, the password, or like with fingerprint.  So you already have like the fingerprint option in built in there. If you don't want to build your own user interface. So and in on activity result, you check if the result is okay.  And yeah, if the system says the user recently authenticated, you just try it again, try it again to get the key initialize the cipher and then try to encrypt or decrypt the data again.  And then it should work without throwing the user an authenticated exception.  So in the end, authentication just got easier because you don't even have to show like the authentication screen, which I just told you, you can just like pull the pull the phone out of your pocket and go in and go inside your app and skip all that just imagine it if you if you're like a bank and you want.  Yeah, have like very user sensitive information like bank account information or how much money you just spend the last night or whatever.  And this is pretty cool because the user has like an intent to just check your the his or her like bank account balance or whatever, and he can just pull out his or her phone and go directly to the app without authenticating again.  And authentication just got stronger because authentication is now tied like to absolute. So we can authenticate the with the users and have the key store there.  And all this credential verification is now that does not happen in the in this secure environment or like trusted execution environment.  So all this encryption stuff happens directly inside the ship. And even if the system is compromised, yeah, you can't interfere with it.  So but if you want to do like a more easier way, or you want to implement your own user interface, there's also the fingerprint authentication.  And the cool thing about fingerprint authentication is that the authentication is now a lot easier for the users and it's even more faster.  And we have this consistent authentication flow in your own app if you provide your own user interface.  And what's cool is that on Nexus devices with the fingerprint reader with next imprint.  Yeah, these lock screen adaption for secure lock screen went from like 50% to over 90%.  So many more users are currently like using a lock screen and device encryption by because of the fingerprint reader.  And this is pretty cool because it's fast and the users like to interact with it.  And by the way, keep in mind if the device doesn't have like a fingerprint sensor yet, there's also the smart lock feature from Google,  which currently reduces of this lock screen or authentication problems by 50%.  So only every second time there you have to authenticate on your mobile phone.  Yeah, when the user has enabled smart lock like this detection, if you're wearing your phone with you or you're just having Android Wear Watch connected to your phone.  So, but the key concept of like fingerprint authentication is that you can build your own dialogues for it and you can adapt it to your authentication flow and the user doesn't have to leave your app.  So you can simply click the proceed to checkout or buy or whatever button sign in button and then your dialogue or whatever shows up or doesn't need to be a dialogue.  You could also like implemented in your activity.  And then you can just like tap the sensor and then you're authenticated.  So make it really easy.  Use fingerprints.  What do you need is like a fingerprint reader, a device running Android Marshmallow later and the user who is set up.  Yeah, a secure lock screen and of course enrolls and fingerprints.  But this thing is optional because we can always force the users to enroll one.  So yeah, fingerprint manager.  This is like the class you have to use if you want to implement fingerprint access on your phone.  It's like a system level service like any any other service and coordinates all the access to to the fingerprint mechanisms.  And yeah, you need to use the permission.  Use fingerprint in your Android Android manifest.  And fortunately, it's not like a critical permission so you don't have to prompt the user to allow access to your fingerprint.  And yeah, this is pretty cool.  So in the end, yeah, you just like have the code like this, the fingerprint manager and say get system service.  And then you're done.  You have a reference to the fingerprint manager.  And the fingerprint manager also provides methods to check for device compatibility, like is hardware detected or has enrolled some fingerprints.  And if not, you can always say, yeah, please go back and check to check the settings and enroll some fingerprints.  Or when when he does when the device doesn't have like fingerprints or a fingerprint sensor, then you can always say, yeah, unfortunately, you don't have it, but we could you could also like use the lock screen approach there.  And this cost is also available as a competition.  So if you're running Android, like 22, LL, API level 22 or 21, you could use the competent class.  And then it says, yeah, there's no fingerprint manager or fingerprint reading available because the API level is like 23 or higher.  So yeah, the fingerprint manager.  The most important method there is the authenticate method method.  And it's like the last of those three.  You can like check the device, compatibility and authenticate.  And the first thing you have to pass over is the crypto object, the cancel signal, which is nullable some flags, which should be always or should be always null zero.  A fingerprint manager authentication callback, which you have to implement and handler.  And the handler is used for where like the fingerprint callbacks are called on which.  So, so yeah, the fingerprint manager crypto object is more or less a wrapper class for the crypto object supported by the fingerprint manager and has just this three simple methods like get cypher get Mac or signature.  So it's pretty straightforward there.  And the authentication callback provides like the whole callback structure and you have these methods you can like implement the authentication succeeded where you get like this authentication result.  And this result simply gets you contains like this fingerprint manager crypto object where you can get your cypher from or whatever.  And the others other three methods like on authentication help with the different codes are called when you're just like when the user just swiped or tapped the whole sensor for a too short time or there's another error like dirty sensor.  And authentication error is called when there's just an error or the whole. Yeah, authentication stopped and on authentication failed is called when the user just used like a different finger, whatever.  So the finger wasn't like, yeah, recognized.  So how does work on the authentication succeeded, you can simply like get the crypto object from the results and then the cypher and work with it there.  So if you'll just like set the authentication required to your to your key in the key store and you say the duration seconds or set the duration seconds to zero, then you always have to use your fingerprint to authenticate.  This is pretty powerful. And yeah, good work, good way to to useless this new method to authenticate the user with you within your app.  So the best practices for a great user experience are yeah, the keys to use the key store to check if the user authenticated recently.  So you don't have to show an authentication screen again.  On if the fingerprint sensor is available, I would always recommend it to you to use it because the users like it a lot.  And as you've seen, the adaption of the secure lock screen just went from 50% to over 90%.  And it's a quick and fast way of like securely authenticating.  And if you don't want to like implement your own authentication user interface and all this kind of stuff, you could always like use the confirm device credential intent, which you can fire and which looks like yeah, this standard lock screen on your Android phone.  So it's pretty cool there.  So in the end, yeah, we have this short demo here. Yeah, I already showed you shown to you.  You can download it on GitHub so you can play through all the different kinds of scenarios there like that you don't need any user authentication if you want to just like store your information securely created like a certificate or whatever.  And another one to like enable fingerprint or that the user has to use the fingerprint sensor to unlock the app or another one with the like 15 second interval.  But it's completely custom customizable.  So you could also use like, yeah, I want to use 30 seconds or up to five minutes or whatever.  Yeah, you need so you can see you can always like authenticate with the fingerprint if you have enrolled one.  So yeah, the further reading I have here is like the developer training, of course, and what's very interesting if you want to do a more like deep dive into the soul stuff, that's the source that Android.com security or already also a great book is Android Security Internals by Nikolai Alancoff.  Unfortunately, this covers only like Android for a far and lower, but definitely a good read.  So yeah, thanks everyone for for coming today.  And if you have any questions, you can always ping me like on Twitter or on Facebook.  And yeah, that's it.  If you have any questions or simply ask the questions right now.  Yeah, that's what I wanted to say.  Thank you, Fred Rick.  Who wants the microphone?  Yep.  Hi, thank you.  First question is about what about the solution from other manufacturers like LG, I think have something and for sure something for the not before the devices built before marshmallow.  Do they have the same patterns?  Do they use the same solutions?  How to handle all these cases?  Can we combine?  Yeah, actually, actually, unfortunately, I don't know like how this works like pre-marshmallow because it's like, as you said, like manufacturers specific.  And I actually I can tell you how this works on like Samsung or like an AG device.  But yeah, since like marshmallow, all the manufacturers should like implement this API, the fingerprint API and in the key store API.  And in the end, yeah, it's up to the manufacturer to to to implement all this security features.  So yeah, unfortunately, yeah, it's currently like API level 23 and up.  So yeah.  Did you see any how fast is the performance of the GCA implementation because before marshmallow with us pretty slow like orders of magnitude slower than if you used open SSL in the K is this now changed.  Do they now use hardware accelerated crypto or not?  What's the status?  And actually, I haven't looked like into into like comparing the speeds or like of the old and the new implementation.  So I can tell you that.  But I talked to some people at this is Google I O and they told me that yeah, they've done like a completely rewrite of these like key store demon and and the key store API.  So I think for me, what I experienced is it's pretty fast and straightforward.  So maybe you just try it out and check check back.  Hi.  Thanks for an amazing talk.  So basically, my question is so all those flows that require like fingerprint authentication.  So so suppose we test them with with UI test with this press or something.  Are there really tools or any approaches to to integrate those those screen flows into UI testing?  Yeah, actually, I don't think that there are great like solutions to test like this authentication flow.  But actually, I have to admit that I haven't like looked into like specific testing purposes there.  So there may be.  But actually what I found there wasn't like to be very testable because it it like depends on on the on the phone and because we have like this deep integration with the hardware there there to to to anchor.  And the decrypt the material and like fetching it from the from the trust execution environment.  So yeah, I unfortunately I can't tell you that because I haven't looked into it.  Thank you.
_droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_0_263.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_264_479.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_480_551.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_552_731.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_732_3395.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_3396_3995.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_3996_5531.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_5532_6899.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_6900_7151.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_7152_8267.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_8268_8879.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_8880_9275.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_9276_18695.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_18696_18743.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_18744_18983.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_18984_19055.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_19056_19151.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_19152_19211.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_19212_19307.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_19308_19367.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_19368_19451.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_19452_22991.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_22992_23399.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_23400_27755.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_27756_28043.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_28044_28259.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_28260_28799.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_28800_28883.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_28884_36143.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_36144_37619.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_37620_37823.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_37824_39863.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_39864_40079.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_40080_40259.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_40260_41663.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_41664_45035.png _droidconDE__Frederik_Schweiger___Security_at_your_UIyfKBf-ais_45036_45065.png