问BiometricManager.canAuthenticate(BIOMETRIC_STRONG) == BIOMETRIC_SUCCESS但KeyPairGenerator.initialize() => java.lang.IllegalStateException on API 29

EN

fun canAuthenticate(context: Context): Boolean {
        return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
            BiometricManager.from(context)
                .canAuthenticate(BIOMETRIC_STRONG or DEVICE_CREDENTIAL) == BIOMETRIC_SUCCESS
        } else {
            BiometricManager.from(context)
                .canAuthenticate(BIOMETRIC_STRONG) == BIOMETRIC_SUCCESS // <----- this returns true!
        }
    }

private fun initializeKeyPairGenerator(withStrongBox: Boolean = true): KeyPairGenerator {
    val keyPairGenerator = KeyPairGenerator.getInstance(keyGenAlgorithm, provider)

    try {
        val parameterSpec = createParameterSpec(withStrongBox)
        keyPairGenerator.initialize(parameterSpec) // <-------- It throws the exception here
    } catch (e: Exception) {
        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P && e is StrongBoxUnavailableException) {
            val parameterSpec = createParameterSpec(false)
            keyPairGenerator.initialize(parameterSpec)
        } else {
            throw Exception("Cannot create key", e)
        }
    }

    return keyPairGenerator
}

private fun createParameterSpec(withStrongBox: Boolean): KeyGenParameterSpec {
    val purposes = KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
    return KeyGenParameterSpec.Builder(alias, purposes)
        .run {
            setAlgorithmParameterSpec(ECGenParameterSpec(ecCurveName))
            setDigests(KeyProperties.DIGEST_SHA256)
            setSignaturePaddings(KeyProperties.SIGNATURE_PADDING_RSA_PSS)
            setBlockModes(encryptionBlockMode)
            setEncryptionPaddings(encryptionPadding)

            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
                setIsStrongBoxBacked(withStrongBox)
            }

            if (restricted) {
                setUserAuthenticationRequired(true)
            }
            build()
        }
}

private fun createParameterSpec(withStrongBox: Boolean): KeyGenParameterSpec {
    val purposes = KeyProperties.PURPOSE_SIGN or KeyProperties.PURPOSE_VERIFY
    return KeyGenParameterSpec.Builder(alias, purposes)
        .run {
            setAlgorithmParameterSpec(ECGenParameterSpec(ecCurveName))
            setDigests(KeyProperties.DIGEST_SHA256)
            setSignaturePaddings(KeyProperties.SIGNATURE_PADDING_RSA_PSS)
            setBlockModes(encryptionBlockMode)
            setEncryptionPaddings(encryptionPadding)

            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
                setIsStrongBoxBacked(withStrongBox)
            }

            if (restricted) {
                setUserAuthenticationRequired(true)

                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
                    setUserAuthenticationParameters(
                        0 /* duration */,
                        KeyProperties.AUTH_BIOMETRIC_STRONG or KeyProperties.AUTH_DEVICE_CREDENTIAL
                    )
                }
                else { // API <= Q
                    // parameter "0" defaults to AUTH_BIOMETRIC_STRONG | AUTH_DEVICE_CREDENTIAL
                    // parameter "-1" default to AUTH_BIOMETRIC_STRONG
                    // source: https://cs.android.com/android/platform/superproject/+/android-11.0.0_r3:frameworks/base/keystore/java/android/security/keystore/KeyGenParameterSpec.java;l=1236-1246;drc=a811787a9642e6a9e563f2b7dfb15b5ae27ebe98
                    setUserAuthenticationValidityDurationSeconds(10) // <-- Allow device credential authentication
                }
            }

            build()
        }
}

val signature: Signature
    get() = Signature.getInstance(signAlgorithm)
        .apply {
            val privateKey = asymmetricKeyPair.privateKey
            initSign(privateKey) <--- Throws an exception 
        }

private fun triggerBiometricPrompt() {
    val bio = BiometricAuthenticator()
    val intent = bio.createConfirmDeviceCredentialIntent(activity)
    activity.startActivityForResult(intent, 0)
}

override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
    if (IdNowMethodCallHandler.handler.onActivityResult(requestCode, resultCode, data)) {
        return
    }

    if (resultCode == Activity.RESULT_OK) {
        handler.signWithRestrictedKey(handler.methodCall, handler.methodResult) // <-- The result gets handled here
    }

    super.onActivityResult(requestCode, resultCode, data)
}

private fun authenticate(
    activity: FragmentActivity,
    promptInfo: BiometricPrompt.PromptInfo = createPromptInfo(),
    signature: Signature?,
    onError: (Int, CharSequence) -> Unit,
    onSuccess: (BiometricPrompt.AuthenticationResult) -> Unit,
) {
    val callback = object : BiometricPrompt.AuthenticationCallback() {
        override fun onAuthenticationError(errorCode: Int, errString: CharSequence) = onError(errorCode, errString)

        override fun onAuthenticationFailed() {
            // Called when a biometric (e.g. fingerprint, face, etc.) is presented but not recognized as belonging to the user.
            // We want to omit it because the fingerprint maybe just failed to be read in which case the user retries.
            // Also, after multiple attempts, the user can use credentials instead.
        }

        override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) = onSuccess(result)
    }
    val executor = ContextCompat.getMainExecutor(activity)
    val prompt = BiometricPrompt(activity, executor, callback)

    if (signature == null) {
        prompt.authenticate(promptInfo) // TODO: We never do this since signature is never null.
    } else {
        prompt.authenticate(promptInfo, BiometricPrompt.CryptoObject(signature)) // <-- Another prompt is shown here to authenticate 
    }
}

fun createPromptInfo(
    title: String = "Authorize", 
    subtitle: String = "Please, authorise yourself", 
    description: String = "This is needed to perform cryptographic operations.", 
): BiometricPrompt.PromptInfo {
    val builder = BiometricPrompt.PromptInfo.Builder()
        .setTitle(title)
        .setSubtitle(subtitle)
        .setDescription(description)
        .setConfirmationRequired(true)

    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
        builder.apply {
            setAllowedAuthenticators(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)
        }
    } else {
        builder.setNegativeButtonText("Cancel")
    }

    return builder.build()
}