Android: BIOMETRY_ANY fails with face recognition (CryptoFailedException: User not authenticated)

[gvamvoukas]

Description

Hi, I’ve updated react-native-keychain to the latest version and I’m facing an issue on Android related to biometric authentication.

In previous versions, we were using accessControl: ACCESS_CONTROL.BIOMETRY_ANY.

On Android, this triggered only fingerprint authentication and worked correctly.

After updating, ACCESS_CONTROL.BIOMETRY_ANY now allows both fingerprint and face recognition. When the user selects face recognition, the operation fails with the following error:

com.oblador.keychain.exceptions.CryptoFailedException: Wrapped error: User not authenticated

Fingerprint authentication works as expected.

We also tried using accessControl: ACCESS_CONTROL.BIOMETRY_ANY_OR_DEVICE_PASSCODE.

This works correctly with only fingerprint but enables device passcode fallback, which we do not want.

Steps to reproduce

Use react-native-keychain with accessControl set to ACCESS_CONTROL.BIOMETRY_ANY.
When prompted for authentication, select face recognition.
Observe the error indicating that the user is not authenticated.
If fingerprint is selected instead, the operation succeeds.

Snack or a link to a repository

no link

React Native Keychain version

10.0.0

React Native version

0.83.1

Platforms

Android

Workflow

React Native (without Expo)

Architecture

Fabric (New Architecture)

[tiagomelilo]

Same issue here. Any solution?

[krutkowski86]

Is it possible to disable face recognition in Android? We're also having this problem after updating from version 8 to 10.

[sahityaPasnoor]

This is fixed on master by a057429 (#759, "prevent weak biometrics prompt from displaying on Android"), which adds a useBiometry -> BIOMETRIC_STRONG branch to getPromptInfo.

Root cause for anyone hitting this: without that branch, allowedAuthenticators is left null for the biometric-only access controls, so androidx.biometric falls back to its BIOMETRIC_WEAK default and a Class 2 sensor (Samsung and Motorola face recognition) can satisfy the prompt. But the Keystore keys the library generates request AUTH_BIOMETRIC_STRONG (CipherStorageKeystoreAesGcm.getKeyGenSpecBuilder, CipherStorageKeystoreRsaEcb.getKeyGenSpecBuilder), and authenticate() is called without a CryptoObject — so the prompt succeeds and the subsequent decrypt fails with UserNotAuthenticatedException, surfacing as CryptoFailedException: Wrapped error: User not authenticated. Class 3 face (Pixel 8+) and fingerprint are unaffected.

The fix has been unreleased since June 2025 — v10.0.0 (March 2025) is still latest on npm, with 11 commits on master since.

@oblador @DorianMazur — would a patch release containing a057429 be possible? @DorianMazur tagging you since you authored both that fix and the 10.0.0 release; apologies for the direct ping.

Until then this can be carried locally with patch-package, applying the same change from a057429. Note that BIOMETRY_ANY_OR_DEVICE_PASSCODE does work around it (it takes the usePasscode && useBiometry branch, which already sets BIOMETRIC_STRONG or DEVICE_CREDENTIAL) but, as @gvamvoukas notes above, at the cost of enabling device-passcode fallback.

Happy to help test a release candidate on Samsung hardware (Galaxy S25, Class 2 face + Class 3 fingerprint).