Expo - Secure Environment

Powered by  

Getting Started  |  Usage  |  Contributing  |  License

---

An Expo Module with support for cryptographic operations using the device's Secure Environment (HSM, SE, etc.) locked behing biometric authentication.

Currently supports Android API 30+ and the minimum supported version of iOS for Expo.

Getting Started

First, install the module using your package manager.

npm install @animo-id/expo-secure-environment

Then prebuild the application so the Expo Module wrapper can be added as native dependency:

npx expo prebuild

You now have the Secure Environment module installed and configured.

Usage

You can now import @animo-id/expo-secure-environment in your application.

Supported cryptographic algorithms

Key algorithm: Secp256r1

Signature algorithm: ECDSA with SHA256

Create a key pair

import { generateKeypair } from "@animo-id/expo-secure-environment";

const myId = "keypair-id";

// Make sure it is backed by biometrics
generateKeypair(myId, true);

Get the public bytes by the id

Returns the compressed form of a P-256 public key (and not the DER-encoded SubjectPublicKeyInfo):

import {
    generateKeypair,
    getPublicBytesForKeyId,
} from "@animo-id/expo-secure-environment";

const myId = "keypair-id";

// Make sure it is backed by biometrics
generateKeypair(myId, true);

const publicBytes: Uint8Array = getPublicBytesForKeyId(myId);

Sign data

Returns the raw signature (and not a DER-Encoded ECDA-Sig-Value):

import {
    generateKeypair,
    sign
} from "@animo-id/expo-secure-environment";

const myId = "keypair-id";

// Make sure it is backed by biometrics
generateKeypair(myId, true);

// Make sure that when we sign we pass the third argument as true to indicate we would like to use biometrics
const signature = sign(myId, new Uint8Array(10).fill(7), true);

Contributing

Is there something you'd like to fix or add? Great, we love community contributions! To get involved, please follow our contribution guidelines.

License

This repository is licensed under the Apache 2.0 license.