Secure Biometric Key Auth - Overview (O11)

Stable version 1.0.0 (Compatible with OutSystems 11)

Uploaded

on 24 Jul (7 hours ago)

0.0

(0 ratings)

Details

Secure Biometric Key Auth is a high-security Cordova plugin designed for iOS and Android. It generates hardware-backed, non-exportable asymmetric Elliptic Curve key pairs (EC P-256) directly inside the Secure Enclave (iOS) and Hardware TEE / StrongBox (Android). These keys serve as digital device certificates for secure biometric enrollment and passwordless authentication flows. Private keys are protected behind native biometrics (Face ID, Touch ID, or BiometricPrompt) and never leave the hardware coprocessor under any circumstances.

This mobile plugin provides hardware-backed cryptographic key generation and payload signing using iOS Secure Enclave and Android KeyStore. It allows mobile apps to generate Elliptic Curve (NIST P-256) key pairs protected by native biometrics (Face ID, Touch ID, or Fingerprint) and sign server-generated challenges for secure, passwordless authentication without ever exposing private keys.

Initial Login
1. Mobile App > Server: First Login (Username + Password)
2. Server Action: Validates credentials.
3. Server > Mobile App: Authenticated.
Biometric Enrollment
1. Mobile App Action: Calls createKeyPair(). Generates an Elliptic Curve (NIST P-256) key inside iOS Secure Enclave or Android KeyStore. Private key remains non-exportable on chip.
2. Mobile App > Server: Register Public Key (ssPublicKey in Base64: iOS ANSI X9.63 / Android DER).
3. Server Action: Stores public key associated with the user/device record.
4. Server > Mobile App: Enrollment Confirmed.
Subsequent Biometric Login
1. Mobile App > Server: Request Login Challenge.
2. Server Action: Generates a unique, single-use Nonce (GUID / random Base64) with expiration time.
3. Server > Mobile App: Returns Challenge (ssChallengeText).
4. Mobile App Action: Prompts user for biometrics (Face ID / Fingerprint) to unlock key. Calls signChallenge(). Private key signs challenge outputting Base64 ASN.1 DER signature (ssSignature).
5. Mobile App > Server: Sends ssChallengeText & ssSignature.
6. Server Action: Executes MssVerifyECDSASignature (Integration Studio C# Extension):
  1. Converts DER signature to IEEE P1363 (64-byte $r, s$).
  2. Extracts $X, Y$ coordinates from public key.
  3. Verifies signature using .NET ECDsa.Create().
  4. Immediately invalidates/deletes the Nonce.
7. Server > Mobile App: <Your logic to log user in>.