PM-3194 Fix biometrics button to be shown on upgrade when no UserKey is present yet

- returning null from a task thats not async throws

src/Android/MainApplication.cs

@@ -156,9 +156,9 @@ namespace Bit.Droid
                 messagingService, broadcasterService);
             var autofillHandler = new AutofillHandler(stateService, messagingService, clipboardService,
                 platformUtilsService, new LazyResolve<IEventService>());
-            var biometricService = new BiometricService(stateService);
             var cryptoFunctionService = new PclCryptoFunctionService(cryptoPrimitiveService);
             var cryptoService = new CryptoService(stateService, cryptoFunctionService);
+            var biometricService = new BiometricService(stateService, cryptoService);
             var passwordRepromptService = new MobilePasswordRepromptService(platformUtilsService, cryptoService);
 
             ServiceContainer.Register<ISynchronousStorageService>(preferencesStorage);

src/Android/Services/BiometricService.cs

@@ -2,6 +2,7 @@
 using System.Threading.Tasks;
 using Android.OS;
 using Android.Security.Keystore;
+using Bit.App.Services;
 using Bit.Core.Abstractions;
 using Bit.Core.Services;
 using Java.Security;
@@ -9,10 +10,8 @@ using Javax.Crypto;
 
 namespace Bit.Droid.Services
 {
-    public class BiometricService : IBiometricService
+    public class BiometricService : BaseBiometricService
     {
-        private readonly IStateService _stateService;
-
         private const string KeyName = "com.8bit.bitwarden.biometric_integrity";
 
         private const string KeyStoreName = "AndroidKeyStore";
@@ -24,14 +23,14 @@ namespace Bit.Droid.Services
 
         private readonly KeyStore _keystore;
 
-        public BiometricService(IStateService stateService)
+        public BiometricService(IStateService stateService, ICryptoService cryptoService)
+            : base(stateService, cryptoService)
         {
-            _stateService = stateService;
             _keystore = KeyStore.GetInstance(KeyStoreName);
             _keystore.Load(null);
         }
 
-        public async Task<bool> SetupBiometricAsync(string bioIntegritySrcKey = null)
+        public override async Task<bool> SetupBiometricAsync(string bioIntegritySrcKey = null)
         {
             if (Build.VERSION.SdkInt >= BuildVersionCodes.M)
             {
@@ -41,7 +40,7 @@ namespace Bit.Droid.Services
             return true;
         }
 
-        public async Task<bool> IsSystemBiometricIntegrityValidAsync(string bioIntegritySrcKey = null)
+        public override async Task<bool> IsSystemBiometricIntegrityValidAsync(string bioIntegritySrcKey = null)
         {
             if (Build.VERSION.SdkInt < BuildVersionCodes.M)
             {

src/App/Pages/Accounts/LockPageViewModel.cs

@@ -33,13 +33,12 @@ namespace Bit.App.Pages
         private readonly WeakEventManager<int?> _secretEntryFocusWeakEventManager = new WeakEventManager<int?>();
         private readonly IPolicyService _policyService;
         private readonly IPasswordGenerationService _passwordGenerationService;
-        private IDeviceTrustCryptoService _deviceTrustCryptoService;
-        private readonly ISyncService _syncService;
+
         private string _email;
         private string _masterPassword;
         private string _pin;
         private bool _showPassword;
-        private PinLockEnum _pinStatus;
+        private PinLockType _pinStatus;
         private bool _pinEnabled;
         private bool _biometricEnabled;
         private bool _biometricIntegrityValid = true;
@@ -65,8 +64,6 @@ namespace Bit.App.Pages
             _watchDeviceService = ServiceContainer.Resolve<IWatchDeviceService>();
             _policyService = ServiceContainer.Resolve<IPolicyService>();
             _passwordGenerationService = ServiceContainer.Resolve<IPasswordGenerationService>();
-            _deviceTrustCryptoService = ServiceContainer.Resolve<IDeviceTrustCryptoService>();
-            _syncService = ServiceContainer.Resolve<ISyncService>();
 
             PageTitle = AppResources.VerifyMasterPassword;
             TogglePasswordCommand = new Command(TogglePassword);
@@ -164,17 +161,17 @@ namespace Bit.App.Pages
 
         public async Task InitAsync()
         {
-            _pinStatus = await _vaultTimeoutService.IsPinLockSetAsync();
+            _pinStatus = await _vaultTimeoutService.GetPinLockTypeAsync();
 
-            var ephemeralPinSet = await _stateService.GetUserKeyPinEphemeralAsync()
+            var ephemeralPinSet = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync()
                 ?? await _stateService.GetPinProtectedKeyAsync();
-            PinEnabled = (_pinStatus == PinLockEnum.Transient && ephemeralPinSet != null) ||
-                      _pinStatus == PinLockEnum.Persistent;
+            PinEnabled = (_pinStatus == PinLockType.Transient && ephemeralPinSet != null) ||
+                      _pinStatus == PinLockType.Persistent;
 
-            BiometricEnabled = await _vaultTimeoutService.IsBiometricLockSetAsync() && await _cryptoService.HasEncryptedUserKeyAsync();
+            BiometricEnabled = await _vaultTimeoutService.IsBiometricLockSetAsync() && await _biometricService.CanUseBiometricsUnlockAsync();
 
             // Users with key connector and without biometric or pin has no MP to unlock with
-            _usingKeyConnector = await _keyConnectorService.GetUsesKeyConnector();
+            _usingKeyConnector = await _keyConnectorService.GetUsesKeyConnectorAsync();
             if (_usingKeyConnector && !(BiometricEnabled || PinEnabled))
             {
                 await _vaultTimeoutService.LogOutAsync();
@@ -260,15 +257,15 @@ namespace Bit.App.Pages
                 {
                     EncString userKeyPin = null;
                     EncString oldPinProtected = null;
-                    if (_pinStatus == PinLockEnum.Persistent)
+                    if (_pinStatus == PinLockType.Persistent)
                     {
-                        userKeyPin = await _stateService.GetUserKeyPinAsync();
+                        userKeyPin = await _stateService.GetPinKeyEncryptedUserKeyAsync();
                         var oldEncryptedKey = await _stateService.GetPinProtectedAsync();
                         oldPinProtected = oldEncryptedKey != null ? new EncString(oldEncryptedKey) : null;
                     }
-                    else if (_pinStatus == PinLockEnum.Transient)
+                    else if (_pinStatus == PinLockType.Transient)
                     {
-                        userKeyPin = await _stateService.GetUserKeyPinEphemeralAsync();
+                        userKeyPin = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync();
                         oldPinProtected = await _stateService.GetPinProtectedKeyAsync();
                     }
 
@@ -276,7 +273,7 @@ namespace Bit.App.Pages
                     if (oldPinProtected != null)
                     {
                         userKey = await _cryptoService.DecryptAndMigrateOldPinKeyAsync(
-                            _pinStatus == PinLockEnum.Transient,
+                            _pinStatus == PinLockType.Transient,
                             Pin,
                             _email,
                             kdfConfig,
@@ -300,7 +297,7 @@ namespace Bit.App.Pages
                     {
                         Pin = string.Empty;
                         await AppHelpers.ResetInvalidUnlockAttemptsAsync();
-                        await SetKeyAndContinueAsync(userKey);
+                        await SetUserKeyAndContinueAsync(userKey);
                     }
                 }
                 catch
@@ -322,20 +319,20 @@ namespace Bit.App.Pages
             else
             {
                 var masterKey = await _cryptoService.MakeMasterKeyAsync(MasterPassword, _email, kdfConfig);
-                var storedKeyHash = await _cryptoService.GetPasswordHashAsync();
+                var storedKeyHash = await _cryptoService.GetMasterKeyHashAsync();
                 var passwordValid = false;
                 MasterPasswordPolicyOptions enforcedMasterPasswordOptions = null;
 
                 if (storedKeyHash != null)
                 {
                     // Offline unlock possible
-                    passwordValid = await _cryptoService.CompareAndUpdatePasswordHashAsync(MasterPassword, masterKey);
+                    passwordValid = await _cryptoService.CompareAndUpdateKeyHashAsync(MasterPassword, masterKey);
                 }
                 else
                 {
                     // Online unlock required
                     await _deviceActionService.ShowLoadingAsync(AppResources.Loading);
-                    var keyHash = await _cryptoService.HashPasswordAsync(MasterPassword, masterKey, HashPurpose.ServerAuthorization);
+                    var keyHash = await _cryptoService.HashMasterKeyAsync(MasterPassword, masterKey, HashPurpose.ServerAuthorization);
                     var request = new PasswordVerificationRequest();
                     request.MasterPasswordHash = keyHash;
 
@@ -344,8 +341,8 @@ namespace Bit.App.Pages
                         var response = await _apiService.PostAccountVerifyPasswordAsync(request);
                         enforcedMasterPasswordOptions = response.MasterPasswordPolicy;
                         passwordValid = true;
-                        var localKeyHash = await _cryptoService.HashPasswordAsync(MasterPassword, masterKey, HashPurpose.LocalAuthorization);
-                        await _cryptoService.SetPasswordHashAsync(localKeyHash);
+                        var localKeyHash = await _cryptoService.HashMasterKeyAsync(MasterPassword, masterKey, HashPurpose.LocalAuthorization);
+                        await _cryptoService.SetMasterKeyHashAsync(localKeyHash);
                     }
                     catch (Exception e)
                     {
@@ -367,7 +364,7 @@ namespace Bit.App.Pages
 
                     var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(masterKey);
                     await _cryptoService.SetMasterKeyAsync(masterKey);
-                    await SetKeyAndContinueAsync(userKey);
+                    await SetUserKeyAndContinueAsync(userKey);
 
                     // Re-enable biometrics
                     if (BiometricEnabled & !BiometricIntegrityValid)
@@ -465,24 +462,23 @@ namespace Bit.App.Pages
             await _stateService.SetBiometricLockedAsync(!success);
             if (success)
             {
-                await DoContinueAsync();
+                var userKey = await _cryptoService.GetBiometricUnlockKeyAsync();
+                await SetUserKeyAndContinueAsync(userKey);
             }
         }
 
-        private async Task SetKeyAndContinueAsync(UserKey key)
+        private async Task SetUserKeyAndContinueAsync(UserKey key)
         {
             var hasKey = await _cryptoService.HasUserKeyAsync();
             if (!hasKey)
             {
                 await _cryptoService.SetUserKeyAsync(key);
             }
-            await _deviceTrustCryptoService.TrustDeviceIfNeededAsync();
             await DoContinueAsync();
         }
 
         private async Task DoContinueAsync()
         {
-            _syncService.FullSyncAsync(false).FireAndForget();
             await _stateService.SetBiometricLockedAsync(false);
             _watchDeviceService.SyncDataToWatchAsync().FireAndForget();
             _messagingService.Send("unlocked");

src/App/Pages/Accounts/LoginApproveDevicePage.xaml

@@ -1,76 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" ?>
-<pages:BaseContentPage 
-    xmlns="http://xamarin.com/schemas/2014/forms"
-    xmlns:x="http://schemas.microsoft.com/winfx/2009/xaml"
-    x:Class="Bit.App.Pages.LoginApproveDevicePage"
-    xmlns:pages="clr-namespace:Bit.App.Pages"
-    xmlns:u="clr-namespace:Bit.App.Utilities"
-    x:DataType="pages:LoginApproveDeviceViewModel"
-    x:Name="_page"
-    Title="{Binding PageTitle}">
-    
-    <ContentPage.BindingContext>
-        <pages:LoginApproveDeviceViewModel />
-    </ContentPage.BindingContext>
-
-    <StackLayout Padding="10, 10">
-        <StackLayout Padding="5, 10" Orientation="Horizontal">
-            <StackLayout HorizontalOptions="FillAndExpand">
-                <Label
-                    StyleClass="text-md"
-                    Text="{u:I18n RememberThisDevice}"/>
-                <Label
-                    StyleClass="box-sub-label"
-                    Text="{u:I18n TurnOffUsingPublicDevice}"/>
-            </StackLayout>
-            <Switch
-                Scale="0.8"
-                IsToggled="{Binding RememberThisDevice}"
-                VerticalOptions="Center"/>
-        </StackLayout>
-        <StackLayout Margin="0, 20, 0, 0">
-            <Button
-                x:Name="_continue"
-                Text="{u:I18n Continue}" 
-                StyleClass="btn-primary"
-                Command="{Binding ContinueCommand}"
-                IsVisible="{Binding ContinueEnabled}"/>
-            <Button
-                x:Name="_approveWithMyOtherDevice"
-                Text="{u:I18n ApproveWithMyOtherDevice}" 
-                StyleClass="btn-primary"
-                Command="{Binding ApproveWithMyOtherDeviceCommand}"
-                IsVisible="{Binding ApproveWithMyOtherDeviceEnabled}"/>
-            <Button
-                x:Name="_requestAdminApproval"
-                Text="{u:I18n RequestAdminApproval}" 
-                StyleClass="box-button-row"
-                Command="{Binding RequestAdminApprovalCommand}"
-                IsVisible="{Binding RequestAdminApprovalEnabled}"/>
-            <Button
-                x:Name="_approveWithMasterPassword"
-                Text="{u:I18n ApproveWithMasterPassword}" 
-                StyleClass="box-button-row"
-                Command="{Binding ApproveWithMasterPasswordCommand}"
-                IsVisible="{Binding ApproveWithMasterPasswordEnabled}"/>
-            <Label
-                Text="{Binding LoggingInAsText}"
-                StyleClass="text-sm"
-                Margin="0,40,0,0"
-                AutomationId="LoggingInAsLabel"
-                />
-            <Label
-                Text="{u:I18n NotYou}"
-                StyleClass="text-md"
-                HorizontalOptions="Start"
-                TextColor="{DynamicResource HyperlinkColor}"
-                AutomationId="NotYouLabel">
-                <Label.GestureRecognizers>
-                    <TapGestureRecognizer Tapped="Cancel_Clicked" />
-                </Label.GestureRecognizers>
-            </Label>
-        </StackLayout>
-    </StackLayout>
-</pages:BaseContentPage>
-
-

src/App/Pages/Accounts/LoginApproveDevicePage.xaml.cs

@@ -1,62 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Threading.Tasks;
-using Bit.App.Models;
-using Bit.App.Utilities;
-using Bit.Core.Enums;
-using Bit.Core.Utilities;
-using Xamarin.Forms;
-
-namespace Bit.App.Pages
-{
-    public partial class LoginApproveDevicePage : BaseContentPage
-    {
-
-        private readonly LoginApproveDeviceViewModel _vm;
-        private readonly AppOptions _appOptions;
-
-        public LoginApproveDevicePage(AppOptions appOptions = null)
-        {
-            InitializeComponent();
-            _vm = BindingContext as LoginApproveDeviceViewModel;
-            _vm.LogInWithMasterPasswordAction = () => StartLogInWithMasterPassword().FireAndForget();
-            _vm.LogInWithDeviceAction = () => StartLoginWithDeviceAsync().FireAndForget();
-            _vm.RequestAdminApprovalAction = () => RequestAdminApprovalAsync().FireAndForget();
-            _vm.CloseAction = () => { Navigation.PopModalAsync(); };
-            _vm.Page = this;
-            _appOptions = appOptions;
-        }
-
-        protected override void OnAppearing()
-        {
-            _vm.InitAsync();
-        }
-
-        private void Cancel_Clicked(object sender, EventArgs e)
-        {
-            if (DoOnce())
-            {
-                _vm.CloseAction();
-            }
-        }
-
-        private async Task StartLogInWithMasterPassword()
-        {
-            var page = new LockPage(_appOptions);
-            await Navigation.PushModalAsync(new NavigationPage(page));
-        }
-
-        private async Task StartLoginWithDeviceAsync()
-        {
-            var page = new LoginPasswordlessRequestPage(_vm.Email, AuthRequestType.AuthenticateAndUnlock, _appOptions);
-            await Navigation.PushModalAsync(new NavigationPage(page));
-        }
-
-        private async Task RequestAdminApprovalAsync()
-        {
-            var page = new LoginPasswordlessRequestPage(_vm.Email, AuthRequestType.AdminApproval, _appOptions);
-            await Navigation.PushModalAsync(new NavigationPage(page));
-        }
-    }
-}
-

src/App/Pages/Accounts/LoginApproveDeviceViewModel.cs

@@ -1,132 +0,0 @@
-using System;
-using System.Threading.Tasks;
-using System.Windows.Input;
-using Bit.App.Abstractions;
-using Bit.App.Resources;
-using Bit.App.Utilities.AccountManagement;
-using Bit.Core.Abstractions;
-using Bit.Core.Enums;
-using Bit.Core.Models.Request;
-using Bit.Core.Services;
-using Bit.Core.Utilities;
-using Xamarin.CommunityToolkit.ObjectModel;
-using Xamarin.Essentials;
-using Xamarin.Forms;
-
-namespace Bit.App.Pages
-{
-    public class LoginApproveDeviceViewModel : BaseViewModel
-    {
-        private bool _rememberThisDevice;
-        private bool _approveWithMyOtherDeviceEnabled;
-        private bool _requestAdminApprovalEnabled;
-        private bool _approveWithMasterPasswordEnabled;
-        private bool _continueEnabled;
-        private string _email;
-        private readonly IStateService _stateService;
-        private readonly IApiService _apiService;
-        private IDeviceTrustCryptoService _deviceTrustCryptoService;
-
-        public ICommand ApproveWithMyOtherDeviceCommand { get; }
-        public ICommand RequestAdminApprovalCommand { get; }
-        public ICommand ApproveWithMasterPasswordCommand { get; }
-        public ICommand ContinueCommand { get; }
-
-        public Action LogInWithMasterPasswordAction { get; set; }
-        public Action LogInWithDeviceAction { get; set; }
-        public Action RequestAdminApprovalAction { get; set; }
-        public Action CloseAction { get; set; }
-
-        public LoginApproveDeviceViewModel()
-        {
-            _stateService = ServiceContainer.Resolve<IStateService>();
-            _apiService = ServiceContainer.Resolve<IApiService>();
-            _deviceTrustCryptoService = ServiceContainer.Resolve<IDeviceTrustCryptoService>();
-
-            PageTitle = AppResources.LoggedIn;
-
-            ApproveWithMyOtherDeviceCommand = new AsyncCommand(() => SetDeviceTrustAndInvokeAsync(LogInWithDeviceAction),
-                onException: ex => HandleException(ex),
-                allowsMultipleExecutions: false);
-
-            RequestAdminApprovalCommand = new AsyncCommand(() => SetDeviceTrustAndInvokeAsync(RequestAdminApprovalAction),
-                onException: ex => HandleException(ex),
-                allowsMultipleExecutions: false);
-
-            ApproveWithMasterPasswordCommand = new AsyncCommand(() => SetDeviceTrustAndInvokeAsync(LogInWithMasterPasswordAction),
-                onException: ex => HandleException(ex),
-                allowsMultipleExecutions: false);
-
-            ContinueCommand = new AsyncCommand(InitAsync,
-                onException: ex => HandleException(ex),
-                allowsMultipleExecutions: false);
-        }
-
-        public string LoggingInAsText => string.Format(AppResources.LoggingInAsX, Email);
-
-        public bool RememberThisDevice
-        {
-            get => _rememberThisDevice;
-            set => SetProperty(ref _rememberThisDevice, value);
-        }
-
-        public bool ApproveWithMyOtherDeviceEnabled
-        {
-            get => _approveWithMyOtherDeviceEnabled;
-            set => SetProperty(ref _approveWithMyOtherDeviceEnabled, value);
-        }
-
-        public bool RequestAdminApprovalEnabled
-        {
-            get => _requestAdminApprovalEnabled;
-            set => SetProperty(ref _requestAdminApprovalEnabled, value);
-        }
-
-        public bool ApproveWithMasterPasswordEnabled
-        {
-            get => _approveWithMasterPasswordEnabled;
-            set => SetProperty(ref _approveWithMasterPasswordEnabled, value);
-        }
-
-        public bool ContinueEnabled
-        {
-            get => _continueEnabled;
-            set => SetProperty(ref _continueEnabled, value);
-        }
-
-        public string Email
-        {
-            get => _email;
-            set => SetProperty(ref _email, value, additionalPropertyNames:
-                new string[] {
-                    nameof(LoggingInAsText)
-                });
-        }
-
-        public async Task InitAsync()
-        {
-            try
-            {
-                Email = await _stateService.GetRememberedEmailAsync();
-                var decryptOptions = await _stateService.GetAccountDecryptionOptions();
-                RequestAdminApprovalEnabled = decryptOptions?.TrustedDeviceOption?.HasAdminApproval ?? false;
-                ApproveWithMasterPasswordEnabled = decryptOptions?.HasMasterPassword ?? false;
-                ApproveWithMyOtherDeviceEnabled = decryptOptions?.TrustedDeviceOption?.HasLoginApprovingDevice ?? false;
-            }
-            catch (Exception ex)
-            {
-                HandleException(ex);
-            }
-
-            // TODO: Change this expression to, Appear if the browser is trusted and shared the key with the app
-            ContinueEnabled = !RequestAdminApprovalEnabled && !ApproveWithMasterPasswordEnabled && !ApproveWithMyOtherDeviceEnabled;
-        }
-
-        private async Task SetDeviceTrustAndInvokeAsync(Action action)
-        {
-            await _deviceTrustCryptoService.SetShouldTrustDeviceAsync(RememberThisDevice);
-            await Device.InvokeOnMainThreadAsync(action);
-        }
-    }
-}
-

src/App/Pages/Accounts/LoginPage.xaml.cs

@@ -4,7 +4,6 @@ using Bit.App.Models;
 using Bit.App.Utilities;
 using Bit.Core;
 using Bit.Core.Abstractions;
-using Bit.Core.Enums;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Xamarin.CommunityToolkit.ObjectModel;
@@ -136,7 +135,7 @@ namespace Bit.App.Pages
 
         private async Task StartLoginWithDeviceAsync()
         {
-            var page = new LoginPasswordlessRequestPage(_vm.Email, AuthRequestType.AuthenticateAndUnlock, _appOptions);
+            var page = new LoginPasswordlessRequestPage(_vm.Email, _appOptions);
             await Navigation.PushModalAsync(new NavigationPage(page));
         }
 

src/App/Pages/Accounts/LoginPasswordlessRequestPage.xaml

@@ -21,17 +21,17 @@
         <StackLayout
             Padding="7, 0, 7, 20">
             <Label
-                Text="{Binding Tittle}"
+                Text="{u:I18n LogInInitiated}"
                 FontSize="Title"
                 FontAttributes="Bold"
                 Margin="0,14,0,21"
                 AutomationId="LogInInitiatedLabel" />
             <Label
-                Text="{Binding SubTittle}"
+                Text="{u:I18n ANotificationHasBeenSentToYourDevice}"
                 FontSize="Small"
                 Margin="0,0,0,10"/>
             <Label
-                Text="{Binding Description}"
+                Text="{u:I18n PleaseMakeSureYourVaultIsUnlockedAndTheFingerprintPhraseMatchesOnTheOtherDevice}"
                 FontSize="Small"
                 Margin="0,0,0,24"/>
             <Label
@@ -45,7 +45,6 @@
                 AutomationId="FingerprintPhraseValue" />
             <Label
                 Text="{u:I18n ResendNotification}"
-                IsVisible="{Binding ResendNotificationVisible}"
                 StyleClass="text-md"
                 HorizontalOptions="Start"
                 Margin="0,40,0,0"
@@ -59,7 +58,7 @@
                 Orientation="Horizontal"
                 Margin="0,30,0,0">
                 <Label
-                    Text="{Binding OtherOptions}"
+                    Text="{u:I18n NeedAnotherOption}"
                     FontSize="Small"
                     VerticalTextAlignment="End"/>
                 <Label

src/App/Pages/Accounts/LoginPasswordlessRequestPage.xaml.cs

@@ -3,7 +3,6 @@ using System.Collections.Generic;
 using System.Threading.Tasks;
 using Bit.App.Models;
 using Bit.App.Utilities;
-using Bit.Core.Enums;
 using Xamarin.Forms;
 
 namespace Bit.App.Pages
@@ -13,14 +12,13 @@ namespace Bit.App.Pages
         private LoginPasswordlessRequestViewModel _vm;
         private readonly AppOptions _appOptions;
 
-        public LoginPasswordlessRequestPage(string email, AuthRequestType authRequestType, AppOptions appOptions = null)
+        public LoginPasswordlessRequestPage(string email, AppOptions appOptions = null)
         {
             InitializeComponent();
             _appOptions = appOptions;
             _vm = BindingContext as LoginPasswordlessRequestViewModel;
             _vm.Page = this;
             _vm.Email = email;
-            _vm.AuthRequestType = authRequestType;
             _vm.StartTwoFactorAction = () => Device.BeginInvokeOnMainThread(async () => await StartTwoFactorAsync());
             _vm.LogInSuccessAction = () => Device.BeginInvokeOnMainThread(async () => await LogInSuccessAsync());
             _vm.UpdateTempPasswordAction = () => Device.BeginInvokeOnMainThread(async () => await UpdateTempPasswordAsync());

src/App/Pages/Accounts/LoginPasswordlessRequestViewModel.cs

@@ -1,7 +1,6 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Net.Http;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -13,7 +12,6 @@ using Bit.Core;
 using Bit.Core.Abstractions;
 using Bit.Core.Enums;
 using Bit.Core.Models.Domain;
-using Bit.Core.Models.Response;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Xamarin.CommunityToolkit.ObjectModel;
@@ -34,9 +32,6 @@ namespace Bit.App.Pages
         private IPlatformUtilsService _platformUtilsService;
         private IEnvironmentService _environmentService;
         private ILogger _logger;
-        private IDeviceTrustCryptoService _deviceTrustCryptoService;
-        private readonly ICryptoFunctionService _cryptoFunctionService;
-        private readonly ICryptoService _cryptoService;
 
         protected override II18nService i18nService => _i18nService;
         protected override IEnvironmentService environmentService => _environmentService;
@@ -49,7 +44,6 @@ namespace Bit.App.Pages
         private string _email;
         private string _requestId;
         private string _requestAccessCode;
-        private AuthRequestType _authRequestType;
         // Item1 publicKey, Item2 privateKey
         private Tuple<byte[], byte[]> _requestKeyPair;
 
@@ -63,9 +57,6 @@ namespace Bit.App.Pages
             _i18nService = ServiceContainer.Resolve<II18nService>();
             _stateService = ServiceContainer.Resolve<IStateService>();
             _logger = ServiceContainer.Resolve<ILogger>();
-            _deviceTrustCryptoService = ServiceContainer.Resolve<IDeviceTrustCryptoService>();
-            _cryptoFunctionService = ServiceContainer.Resolve<ICryptoFunctionService>();
-            _cryptoService = ServiceContainer.Resolve<ICryptoService>();
 
             PageTitle = AppResources.LogInWithAnotherDevice;
 
@@ -86,70 +77,6 @@ namespace Bit.App.Pages
         public ICommand CreatePasswordlessLoginCommand { get; }
         public ICommand CloseCommand { get; }
 
-        public string Tittle
-        {
-            get
-            {
-                switch (_authRequestType)
-                {
-                    case AuthRequestType.AuthenticateAndUnlock:
-                        return AppResources.LogInInitiated;
-                    case AuthRequestType.AdminApproval:
-                        return AppResources.AdminApprovalRequested;
-                    default:
-                        return string.Empty;
-                };
-            }
-        }
-
-        public string SubTittle
-        {
-            get
-            {
-                switch (_authRequestType)
-                {
-                    case AuthRequestType.AuthenticateAndUnlock:
-                        return AppResources.ANotificationHasBeenSentToYourDevice;
-                    case AuthRequestType.AdminApproval:
-                        return AppResources.YourRequestHasBeenSentToYourAdmin;
-                    default:
-                        return string.Empty;
-                };
-            }
-        }
-
-        public string Description
-        {
-            get
-            {
-                switch (_authRequestType)
-                {
-                    case AuthRequestType.AuthenticateAndUnlock:
-                        return AppResources.PleaseMakeSureYourVaultIsUnlockedAndTheFingerprintPhraseMatchesOnTheOtherDevice;
-                    case AuthRequestType.AdminApproval:
-                        return AppResources.YouWillBeNotifiedOnceApproved;
-                    default:
-                        return string.Empty;
-                };
-            }
-        }
-
-        public string OtherOptions
-        {
-            get
-            {
-                switch (_authRequestType)
-                {
-                    case AuthRequestType.AuthenticateAndUnlock:
-                        return AppResources.NeedAnotherOption;
-                    case AuthRequestType.AdminApproval:
-                        return AppResources.TroubleLoggingIn;
-                    default:
-                        return string.Empty;
-                };
-            }
-        }
-
         public string FingerprintPhrase
         {
             get => _fingerprintPhrase;
@@ -162,21 +89,6 @@ namespace Bit.App.Pages
             set => SetProperty(ref _email, value);
         }
 
-        public AuthRequestType AuthRequestType
-        {
-            get => _authRequestType;
-            set => SetProperty(ref _authRequestType, value, additionalPropertyNames: new string[]
-            {
-                nameof(Tittle),
-                nameof(SubTittle),
-                nameof(Description),
-                nameof(OtherOptions),
-                nameof(ResendNotificationVisible)
-            });
-        }
-
-        public bool ResendNotificationVisible => AuthRequestType == AuthRequestType.AuthenticateAndUnlock;
-
         public void StartCheckLoginRequestStatus()
         {
             try
@@ -207,22 +119,14 @@ namespace Bit.App.Pages
 
         private async Task CheckLoginRequestStatus()
         {
-            if (string.IsNullOrEmpty(_requestId))
+            if (string.IsNullOrEmpty(_requestId) || string.IsNullOrEmpty(_requestAccessCode))
             {
                 return;
             }
 
             try
             {
-                PasswordlessLoginResponse response = null;
-                if (await _stateService.IsAuthenticatedAsync())
-                {
-                    response = await _authService.GetPasswordlessLoginRequestByIdAsync(_requestId);
-                }
-                else
-                {
-                    response = await _authService.GetPasswordlessLoginResquestAsync(_requestId, _requestAccessCode);
-                }
+                var response = await _authService.GetPasswordlessLoginResponseAsync(_requestId, _requestAccessCode);
 
                 if (response.RequestApproved == null || !response.RequestApproved.Value)
                 {
@@ -234,12 +138,6 @@ namespace Bit.App.Pages
                 var authResult = await _authService.LogInPasswordlessAsync(Email, _requestAccessCode, _requestId, _requestKeyPair.Item2, response.Key, response.MasterPasswordHash);
                 await AppHelpers.ResetInvalidUnlockAttemptsAsync();
 
-                if (authResult == null && await _stateService.IsAuthenticatedAsync())
-                {
-                    await HandleLoginCompleteAsync();
-                    return;
-                }
-
                 if (await HandleCaptchaAsync(authResult.CaptchaSiteKey, authResult.CaptchaNeeded, CheckLoginRequestStatus))
                 {
                     return;
@@ -255,7 +153,8 @@ namespace Bit.App.Pages
                 }
                 else
                 {
-                    await HandleLoginCompleteAsync();
+                    _syncService.FullSyncAsync(true).FireAndForget();
+                    LogInSuccessAction?.Invoke();
                 }
             }
             catch (Exception ex)
@@ -265,66 +164,22 @@ namespace Bit.App.Pages
             }
         }
 
-        private async Task HandleLoginCompleteAsync()
-        {
-            await _stateService.SetPendingAdminAuthRequestAsync(null);
-            _syncService.FullSyncAsync(true).FireAndForget();
-            LogInSuccessAction?.Invoke();
-        }
-
         private async Task CreatePasswordlessLoginAsync()
         {
             await Device.InvokeOnMainThreadAsync(() => _deviceActionService.ShowLoadingAsync(AppResources.Loading));
 
-            PasswordlessLoginResponse response = null;
-            var pendingRequest = await _stateService.GetPendingAdminAuthRequestAsync();
-            if (pendingRequest != null && _authRequestType == AuthRequestType.AdminApproval)
+            var response = await _authService.PasswordlessCreateLoginRequestAsync(_email);
+            if (response != null)
             {
-                response = await _authService.GetPasswordlessLoginRequestByIdAsync(pendingRequest.Id);
-                if (response == null || (response.IsAnswered && !response.RequestApproved.Value))
-                {
-                    // handle pending auth request not valid remove it from state
-                    await _stateService.SetPendingAdminAuthRequestAsync(null);
-                    pendingRequest = null;
-                }
-                else
-                {
-                    // Derive pubKey from privKey in state to avoid MITM attacks
-                    // Also generate FingerprintPhrase locally for the same reason
-                    var derivedPublicKey = await _cryptoFunctionService.RsaExtractPublicKeyAsync(pendingRequest.PrivateKey);
-                    response.FingerprintPhrase = string.Join("-", await _cryptoService.GetFingerprintAsync(Email, derivedPublicKey));
-                    response.RequestKeyPair = new Tuple<byte[], byte[]>(derivedPublicKey, pendingRequest.PrivateKey);
-                }
+                FingerprintPhrase = response.FingerprintPhrase;
+                _requestId = response.Id;
+                _requestAccessCode = response.RequestAccessCode;
+                _requestKeyPair = response.RequestKeyPair;
             }
 
-            if (response == null)
-            {
-                response = await _authService.PasswordlessCreateLoginRequestAsync(_email, AuthRequestType);
-            }
-
-            await HandlePasswordlessLoginAsync(response, pendingRequest == null && _authRequestType == AuthRequestType.AdminApproval);
             await _deviceActionService.HideLoadingAsync();
         }
 
-        private async Task HandlePasswordlessLoginAsync(PasswordlessLoginResponse response, bool createPendingAdminRequest)
-        {
-            if (response == null)
-            {
-                throw new ArgumentNullException(nameof(response));
-            }
-
-            if (createPendingAdminRequest)
-            {
-                var pendingAuthRequest = new PendingAdminAuthRequest { Id = response.Id, PrivateKey = response.RequestKeyPair.Item2 };
-                await _stateService.SetPendingAdminAuthRequestAsync(pendingAuthRequest);
-            }
-
-            FingerprintPhrase = response.FingerprintPhrase;
-            _requestId = response.Id;
-            _requestAccessCode = response.RequestAccessCode;
-            _requestKeyPair = response.RequestKeyPair;
-        }
-
         private void HandleException(Exception ex)
         {
             Xamarin.Essentials.MainThread.InvokeOnMainThreadAsync(async () =>

src/App/Pages/Accounts/LoginSsoPage.xaml.cs

@@ -29,8 +29,6 @@ namespace Bit.App.Pages
             _vm.SsoAuthSuccessAction = () => Device.BeginInvokeOnMainThread(async () => await SsoAuthSuccessAsync());
             _vm.UpdateTempPasswordAction =
                 () => Device.BeginInvokeOnMainThread(async () => await UpdateTempPasswordAsync());
-            _vm.StartDeviceApprovalOptionsAction =
-                () => Device.BeginInvokeOnMainThread(async () => await StartDeviceApprovalOptionsAsync());
             _vm.CloseAction = async () =>
             {
                 await Navigation.PopModalAsync();
@@ -108,17 +106,10 @@ namespace Bit.App.Pages
             await Navigation.PushModalAsync(new NavigationPage(page));
         }
 
-        private async Task StartDeviceApprovalOptionsAsync()
-        {
-            var page = new LoginApproveDevicePage();
-            await Navigation.PushModalAsync(new NavigationPage(page));
-        }
-
         private async Task SsoAuthSuccessAsync()
         {
             RestoreAppOptionsFromCopy();
             await AppHelpers.ClearPreviousPage();
-
             if (await _vaultTimeoutService.IsLockedAsync())
             {
                 Application.Current.MainPage = new NavigationPage(new LockPage(_appOptions));

src/App/Pages/Accounts/LoginSsoPageViewModel.cs

@@ -9,7 +9,6 @@ using Bit.Core.Abstractions;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Domain;
-using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Xamarin.CommunityToolkit.ObjectModel;
 using Xamarin.Essentials;
@@ -30,8 +29,6 @@ namespace Bit.App.Pages
         private readonly IStateService _stateService;
         private readonly ILogger _logger;
         private readonly IOrganizationService _organizationService;
-        private readonly IDeviceTrustCryptoService _deviceTrustCryptoService;
-        private readonly ICryptoService _cryptoService;
 
         private string _orgIdentifier;
 
@@ -48,8 +45,7 @@ namespace Bit.App.Pages
             _stateService = ServiceContainer.Resolve<IStateService>("stateService");
             _logger = ServiceContainer.Resolve<ILogger>("logger");
             _organizationService = ServiceContainer.Resolve<IOrganizationService>();
-            _deviceTrustCryptoService = ServiceContainer.Resolve<IDeviceTrustCryptoService>();
-            _cryptoService = ServiceContainer.Resolve<ICryptoService>();
+
 
             PageTitle = AppResources.Bitwarden;
             LogInCommand = new AsyncCommand(LogInAsync, allowsMultipleExecutions: false);
@@ -65,7 +61,6 @@ namespace Bit.App.Pages
         public Action StartTwoFactorAction { get; set; }
         public Action StartSetPasswordAction { get; set; }
         public Action SsoAuthSuccessAction { get; set; }
-        public Action StartDeviceApprovalOptionsAction { get; set; }
         public Action CloseAction { get; set; }
         public Action UpdateTempPasswordAction { get; set; }
 
@@ -202,7 +197,6 @@ namespace Bit.App.Pages
             try
             {
                 var response = await _authService.LogInSsoAsync(code, codeVerifier, REDIRECT_URI, orgId);
-                var decryptOptions = await _stateService.GetAccountDecryptionOptions();
                 await AppHelpers.ResetInvalidUnlockAttemptsAsync();
                 await _stateService.SetRememberedOrgIdentifierAsync(OrgIdentifier);
                 await _deviceActionService.HideLoadingAsync();
@@ -218,31 +212,9 @@ namespace Bit.App.Pages
                 {
                     UpdateTempPasswordAction?.Invoke();
                 }
-                else if (decryptOptions?.TrustedDeviceOption != null)
-                {
-                    // If user doesn't have a MP, but has reset password permission, they must set a MP
-                    if (!decryptOptions.HasMasterPassword &&
-                        decryptOptions.TrustedDeviceOption.HasManageResetPasswordPermission)
-                    {
-                        StartSetPasswordAction?.Invoke();
-                    }
-                    else if (response.ForcePasswordReset)
-                    {
-                        UpdateTempPasswordAction?.Invoke();
-                    }
-                    else if (await _deviceTrustCryptoService.IsDeviceTrustedAsync())
-                    {
-                        _syncService.FullSyncAsync(true).FireAndForget();
-                        SsoAuthSuccessAction?.Invoke();
-                    }
-                    else
-                    {
-                        StartDeviceApprovalOptionsAction?.Invoke();
-                    }
-                }
                 else
                 {
-                    _syncService.FullSyncAsync(true).FireAndForget();
+                    var task = Task.Run(async () => await _syncService.FullSyncAsync(true));
                     SsoAuthSuccessAction?.Invoke();
                 }
             }

src/App/Pages/Accounts/RegisterPageViewModel.cs

@@ -178,11 +178,8 @@ namespace Bit.App.Pages
             Email = Email.Trim().ToLower();
             var kdfConfig = new KdfConfig(KdfType.PBKDF2_SHA256, Constants.Pbkdf2Iterations, null, null);
             var newMasterKey = await _cryptoService.MakeMasterKeyAsync(MasterPassword, Email, kdfConfig);
-            var (newUserKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(
-                newMasterKey,
-                await _cryptoService.MakeUserKeyAsync()
-            );
-            var hashedPassword = await _cryptoService.HashPasswordAsync(MasterPassword, newMasterKey);
+            var (newUserKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(newMasterKey);
+            var hashedPassword = await _cryptoService.HashMasterKeyAsync(MasterPassword, newMasterKey);
             var (newPublicKey, newProtectedPrivateKey) = await _cryptoService.MakeKeyPairAsync(newUserKey);
             var request = new RegisterRequest
             {

src/App/Pages/Accounts/RemoveMasterPasswordPageViewModel.cs

@@ -30,14 +30,14 @@ namespace Bit.App.Pages
 
         public async Task Init()
         {
-            Organization = await _keyConnectorService.GetManagingOrganization();
+            Organization = await _keyConnectorService.GetManagingOrganizationAsync();
         }
 
         public async Task MigrateAccount()
         {
             await _deviceActionService.ShowLoadingAsync(AppResources.Loading);
 
-            await _keyConnectorService.MigrateUser();
+            await _keyConnectorService.MigrateUserAsync();
             await _syncService.FullSyncAsync(true);
 
             await _deviceActionService.HideLoadingAsync();

src/App/Pages/Accounts/SetPasswordPageViewModel.cs

@@ -166,13 +166,12 @@ namespace Bit.App.Pages
             var kdfConfig = new KdfConfig(KdfType.PBKDF2_SHA256, Constants.Pbkdf2Iterations, null, null);
             var email = await _stateService.GetEmailAsync();
             var newMasterKey = await _cryptoService.MakeMasterKeyAsync(MasterPassword, email, kdfConfig);
-            var masterPasswordHash = await _cryptoService.HashPasswordAsync(MasterPassword, newMasterKey, HashPurpose.ServerAuthorization);
-            var localMasterPasswordHash = await _cryptoService.HashPasswordAsync(MasterPassword, newMasterKey, HashPurpose.LocalAuthorization);
+            var masterPasswordHash = await _cryptoService.HashMasterKeyAsync(MasterPassword, newMasterKey, HashPurpose.ServerAuthorization);
+            var localMasterPasswordHash = await _cryptoService.HashMasterKeyAsync(MasterPassword, newMasterKey, HashPurpose.LocalAuthorization);
 
-            var (newUserKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(newMasterKey,
-                await _cryptoService.GetUserKeyAsync() ?? await _cryptoService.MakeUserKeyAsync());
+            var (newUserKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(newMasterKey);
 
-            var keys = await _cryptoService.MakeKeyPairAsync(newUserKey);
+            var (newPublicKey, newProtectedPrivateKey) = await _cryptoService.MakeKeyPairAsync(newUserKey);
             var request = new SetPasswordRequest
             {
                 MasterPasswordHash = masterPasswordHash,
@@ -185,8 +184,8 @@ namespace Bit.App.Pages
                 OrgIdentifier = OrgIdentifier,
                 Keys = new KeysRequest
                 {
-                    PublicKey = keys.Item1,
-                    EncryptedPrivateKey = keys.Item2.EncryptedString
+                    PublicKey = newPublicKey,
+                    EncryptedPrivateKey = newProtectedPrivateKey.EncryptedString
                 }
             };
 
@@ -196,10 +195,11 @@ namespace Bit.App.Pages
                 // Set Password and relevant information
                 await _apiService.SetPasswordAsync(request);
                 await _stateService.SetKdfConfigurationAsync(kdfConfig);
+                await _cryptoService.SetUserKeyAsync(newUserKey);
                 await _cryptoService.SetMasterKeyAsync(newMasterKey);
-                await _cryptoService.SetPasswordHashAsync(localMasterPasswordHash);
+                await _cryptoService.SetMasterKeyHashAsync(localMasterPasswordHash);
                 await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(newProtectedUserKey.EncryptedString);
-                await _cryptoService.SetPrivateKeyAsync(keys.Item2.EncryptedString);
+                await _cryptoService.SetUserPrivateKeyAsync(newProtectedPrivateKey.EncryptedString);
 
                 if (ResetPasswordAutoEnroll)
                 {

src/App/Pages/Accounts/TwoFactorPage.xaml.cs

@@ -37,8 +37,6 @@ namespace Bit.App.Pages
                 Device.BeginInvokeOnMainThread(async () => await TwoFactorAuthSuccessAsync());
             _vm.UpdateTempPasswordAction =
                 () => Device.BeginInvokeOnMainThread(async () => await UpdateTempPasswordAsync());
-            _vm.StartDeviceApprovalOptionsAction =
-                () => Device.BeginInvokeOnMainThread(async () => await StartDeviceApprovalOptionsAsync());
             _vm.CloseAction = async () => await Navigation.PopModalAsync();
             DuoWebView = _duoWebView;
             if (Device.RuntimePlatform == Device.Android)
@@ -182,12 +180,6 @@ namespace Bit.App.Pages
             await Navigation.PushModalAsync(new NavigationPage(page));
         }
 
-        private async Task StartDeviceApprovalOptionsAsync()
-        {
-            var page = new LoginApproveDevicePage();
-            await Navigation.PushModalAsync(new NavigationPage(page));
-        }
-
         private async Task TwoFactorAuthSuccessAsync()
         {
             if (_authingWithSso)

src/App/Pages/Accounts/TwoFactorPageViewModel.cs

@@ -11,7 +11,6 @@ using Bit.Core.Abstractions;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Request;
-using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Newtonsoft.Json;
 using Xamarin.CommunityToolkit.ObjectModel;
@@ -34,7 +33,7 @@ namespace Bit.App.Pages
         private readonly II18nService _i18nService;
         private readonly IAppIdService _appIdService;
         private readonly ILogger _logger;
-        private readonly IDeviceTrustCryptoService _deviceTrustCryptoService;
+
         private TwoFactorProviderType? _selectedProviderType;
         private string _totpInstruction;
         private string _webVaultUrl = "https://vault.bitwarden.com";
@@ -56,7 +55,6 @@ namespace Bit.App.Pages
             _i18nService = ServiceContainer.Resolve<II18nService>("i18nService");
             _appIdService = ServiceContainer.Resolve<IAppIdService>("appIdService");
             _logger = ServiceContainer.Resolve<ILogger>();
-            _deviceTrustCryptoService = ServiceContainer.Resolve<IDeviceTrustCryptoService>();
 
             PageTitle = AppResources.TwoStepLogin;
             SubmitCommand = new Command(async () => await SubmitAsync());
@@ -120,7 +118,6 @@ namespace Bit.App.Pages
         public Command SubmitCommand { get; }
         public ICommand MoreCommand { get; }
         public Action TwoFactorAuthSuccessAction { get; set; }
-        public Action StartDeviceApprovalOptionsAction { get; set; }
         public Action StartSetPasswordAction { get; set; }
         public Action CloseAction { get; set; }
         public Action UpdateTempPasswordAction { get; set; }
@@ -318,7 +315,6 @@ namespace Bit.App.Pages
 
                 var task = Task.Run(() => _syncService.FullSyncAsync(true));
                 await _deviceActionService.HideLoadingAsync();
-                var decryptOptions = await _stateService.GetAccountDecryptionOptions();
                 _messagingService.Send("listenYubiKeyOTP", false);
                 _broadcasterService.Unsubscribe(nameof(TwoFactorPage));
 
@@ -330,27 +326,6 @@ namespace Bit.App.Pages
                 {
                     UpdateTempPasswordAction?.Invoke();
                 }
-                else if (decryptOptions?.TrustedDeviceOption != null)
-                {
-                    // If user doesn't have a MP, but has reset password permission, they must set a MP
-                    if (!decryptOptions.HasMasterPassword &&
-                        decryptOptions.TrustedDeviceOption.HasManageResetPasswordPermission)
-                    {
-                        StartSetPasswordAction?.Invoke();
-                    }
-                    else if (result.ForcePasswordReset)
-                    {
-                        UpdateTempPasswordAction?.Invoke();
-                    }
-                    else if (await _deviceTrustCryptoService.IsDeviceTrustedAsync())
-                    {
-                        TwoFactorAuthSuccessAction?.Invoke();
-                    }
-                    else
-                    {
-                        StartDeviceApprovalOptionsAction?.Invoke();
-                    }
-                }
                 else
                 {
                     TwoFactorAuthSuccessAction?.Invoke();

src/App/Pages/Accounts/UpdateTempPasswordPageViewModel.cs

@@ -95,7 +95,7 @@ namespace Bit.App.Pages
 
             // Create new master key and hash new password
             var masterKey = await _cryptoService.MakeMasterKeyAsync(MasterPassword, email, kdfConfig);
-            var masterPasswordHash = await _cryptoService.HashPasswordAsync(MasterPassword, masterKey);
+            var masterPasswordHash = await _cryptoService.HashMasterKeyAsync(MasterPassword, masterKey);
 
             // Encrypt user key with new master key
             var (userKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(masterKey);
@@ -155,7 +155,7 @@ namespace Bit.App.Pages
 
         private async Task UpdatePasswordAsync(string newMasterPasswordHash, string newEncKey)
         {
-            var currentPasswordHash = await _cryptoService.HashPasswordAsync(CurrentMasterPassword, null);
+            var currentPasswordHash = await _cryptoService.HashMasterKeyAsync(CurrentMasterPassword, null);
 
             var request = new PasswordRequest
             {

src/App/Pages/Settings/ExportVaultPageViewModel.cs

@@ -67,7 +67,7 @@ namespace Bit.App.Pages
             _initialized = true;
             FileFormatSelectedIndex = FileFormatOptions.FindIndex(k => k.Key == "json");
             DisablePrivateVaultPolicyEnabled = await _policyService.PolicyAppliesToUser(PolicyType.DisablePersonalVaultExport);
-            UseOTPVerification = await _keyConnectorService.GetUsesKeyConnector();
+            UseOTPVerification = await _keyConnectorService.GetUsesKeyConnectorAsync();
 
             if (UseOTPVerification)
             {
@@ -165,7 +165,7 @@ namespace Bit.App.Pages
                 return;
             }
 
-            var verificationType = await _keyConnectorService.GetUsesKeyConnector()
+            var verificationType = await _keyConnectorService.GetUsesKeyConnectorAsync()
                 ? VerificationType.OTP
                 : VerificationType.MasterPassword;
             if (!await _userVerificationService.VerifyUser(Secret, verificationType))

src/App/Pages/Settings/SettingsPage/SettingsPageViewModel.cs

@@ -48,7 +48,6 @@ namespace Bit.App.Pages
         private bool _reportLoggingEnabled;
         private bool _approvePasswordlessLoginRequests;
         private bool _shouldConnectToWatch;
-        private bool _hasMasterPassword;
         private readonly static List<KeyValuePair<string, int?>> VaultTimeoutOptions =
             new List<KeyValuePair<string, int?>>
             {
@@ -101,17 +100,12 @@ namespace Bit.App.Pages
             ExecuteSettingItemCommand = new AsyncCommand<SettingsPageListItem>(item => item.ExecuteAsync(), onException: _loggerService.Exception, allowsMultipleExecutions: false);
         }
 
-        private bool IsVaultTimeoutActionLockAllowed => _hasMasterPassword || _biometric || _pin;
-
         public ObservableRangeCollection<ISettingsPageListItem> GroupedItems { get; set; }
 
         public IAsyncCommand<SettingsPageListItem> ExecuteSettingItemCommand { get; }
 
         public async Task InitAsync()
         {
-            var decryptionOptions = await _stateService.GetAccountDecryptionOptions();
-            // set has true for backwards compatibility
-            _hasMasterPassword = decryptionOptions?.HasMasterPassword ?? true;
             _supportsBiometric = await _platformUtilsService.SupportsBiometricAsync();
             var lastSync = await _syncService.GetLastSyncAsync();
             if (lastSync != null)
@@ -130,13 +124,7 @@ namespace Bit.App.Pages
             _vaultTimeoutDisplayValue = _vaultTimeoutOptions.FirstOrDefault(o => o.Value == _vaultTimeout).Key;
             _vaultTimeoutDisplayValue ??= _vaultTimeoutOptions.Where(o => o.Value == CustomVaultTimeoutValue).First().Key;
 
-            var savedVaultTimeoutAction = await _vaultTimeoutService.GetVaultTimeoutAction();
-            var action = savedVaultTimeoutAction ?? VaultTimeoutAction.Lock;
-            if (!_hasMasterPassword && savedVaultTimeoutAction == null)
-            {
-                action = VaultTimeoutAction.Logout;
-                await _vaultTimeoutService.SetVaultTimeoutOptionsAsync(_vaultTimeout, VaultTimeoutAction.Logout);
-            }
+            var action = await _vaultTimeoutService.GetVaultTimeoutAction() ?? VaultTimeoutAction.Lock;
             _vaultTimeoutActionDisplayValue = _vaultTimeoutActionOptions.FirstOrDefault(o => o.Value == action).Key;
 
             if (await _policyService.PolicyAppliesToUser(PolicyType.MaximumVaultTimeout))
@@ -150,8 +138,8 @@ namespace Bit.App.Pages
                     t.Value != null).ToList();
             }
 
-            var pinSet = await _vaultTimeoutService.IsPinLockSetAsync();
-            _pin = pinSet != PinLockEnum.Disabled;
+            var pinSet = await _vaultTimeoutService.GetPinLockTypeAsync();
+            _pin = pinSet != PinLockType.Disabled;
             _biometric = await _vaultTimeoutService.IsBiometricLockSetAsync();
             _screenCaptureAllowed = await _stateService.GetScreenCaptureAllowedAsync();
 
@@ -161,7 +149,7 @@ namespace Bit.App.Pages
             }
 
             _showChangeMasterPassword = IncludeLinksWithSubscriptionInfo() &&
-                !await _keyConnectorService.GetUsesKeyConnector();
+                !await _keyConnectorService.GetUsesKeyConnectorAsync();
             _reportLoggingEnabled = await _loggerService.IsEnabled();
             _approvePasswordlessLoginRequests = await _stateService.GetApprovePasswordlessLoginsAsync();
             _shouldConnectToWatch = await _stateService.GetShouldConnectToWatchAsync();
@@ -335,6 +323,7 @@ namespace Bit.App.Pages
             }
             if (oldTimeout != newTimeout)
             {
+                await _cryptoService.RefreshKeysAsync();
                 await Device.InvokeOnMainThreadAsync(BuildList);
             }
         }
@@ -399,11 +388,8 @@ namespace Bit.App.Pages
                 // do nothing if we have a policy set
                 return;
             }
-
-            var options = IsVaultTimeoutActionLockAllowed
-                ? _vaultTimeoutActionOptions.Select(o => CreateSelectableOption(o.Key, _vaultTimeoutActionDisplayValue == o.Key)).ToArray()
-                : _vaultTimeoutActionOptions.Where(o => o.Value == VaultTimeoutAction.Logout).Select(v => ToSelectedOption(v.Key)).ToArray();
-
+            var options = _vaultTimeoutActionOptions.Select(o =>
+                o.Key == _vaultTimeoutActionDisplayValue ? $"✓ {o.Key}" : o.Key).ToArray();
             var selection = await Page.DisplayActionSheet(AppResources.VaultTimeoutAction,
                 AppResources.Cancel, null, options);
             if (selection == null || selection == AppResources.Cancel)
@@ -443,7 +429,7 @@ namespace Bit.App.Pages
                 if (!string.IsNullOrWhiteSpace(pin))
                 {
                     var masterPassOnRestart = false;
-                    if (!await _keyConnectorService.GetUsesKeyConnector())
+                    if (!await _keyConnectorService.GetUsesKeyConnectorAsync())
                     {
                         masterPassOnRestart = await _platformUtilsService.ShowDialogAsync(
                             AppResources.PINRequireMasterPasswordRestart, AppResources.UnlockWithPIN,
@@ -454,18 +440,18 @@ namespace Bit.App.Pages
                     var email = await _stateService.GetEmailAsync();
                     var pinKey = await _cryptoService.MakePinKeyAsync(pin, email, kdfConfig);
                     var userKey = await _cryptoService.GetUserKeyAsync();
-                    var pinProtectedKey = await _cryptoService.EncryptAsync(userKey.Key, pinKey);
+                    var protectedPinKey = await _cryptoService.EncryptAsync(userKey.Key, pinKey);
 
                     var encPin = await _cryptoService.EncryptAsync(pin);
                     await _stateService.SetProtectedPinAsync(encPin.EncryptedString);
 
                     if (masterPassOnRestart)
                     {
-                        await _stateService.SetUserKeyPinEphemeralAsync(pinProtectedKey);
+                        await _stateService.SetPinKeyEncryptedUserKeyEphemeralAsync(protectedPinKey);
                     }
                     else
                     {
-                        await _stateService.SetUserKeyPinAsync(pinProtectedKey);
+                        await _stateService.SetPinKeyEncryptedUserKeyAsync(protectedPinKey);
                     }
                 }
                 else
@@ -504,10 +490,9 @@ namespace Bit.App.Pages
             else
             {
                 await _stateService.SetBiometricUnlockAsync(null);
-                await UpdateVaultTimeoutActionIfNeededAsync();
             }
             await _stateService.SetBiometricLockedAsync(false);
-            await _cryptoService.ToggleKeysAsync();
+            await _cryptoService.RefreshKeysAsync();
             BuildList();
         }
 
@@ -851,11 +836,9 @@ namespace Bit.App.Pages
             return _vaultTimeoutOptions.FirstOrDefault(o => o.Key == key).Value;
         }
 
-        private string CreateSelectableOption(string option, bool selected) => selected ? ToSelectedOption(option) : option;
+        private string CreateSelectableOption(string option, bool selected) => selected ? $"✓ {option}" : option;
 
-        private bool CompareSelection(string selection, string compareTo) => selection == compareTo || selection == ToSelectedOption(compareTo);
-
-        private string ToSelectedOption(string option) => $"✓ {option}";
+        private bool CompareSelection(string selection, string compareTo) => selection == compareTo || selection == $"✓ {compareTo}";
 
         public async Task SetScreenCaptureAllowedAsync()
         {
@@ -887,17 +870,5 @@ namespace Bit.App.Pages
             await _watchDeviceService.SetShouldConnectToWatchAsync(_shouldConnectToWatch);
             BuildList();
         }
-
-        private async Task UpdateVaultTimeoutActionIfNeededAsync()
-        {
-            if (IsVaultTimeoutActionLockAllowed)
-            {
-                return;
-            }
-
-            _vaultTimeoutActionDisplayValue = _vaultTimeoutActionOptions.First(o => o.Value == VaultTimeoutAction.Logout).Key;
-            await _vaultTimeoutService.SetVaultTimeoutOptionsAsync(_vaultTimeout, VaultTimeoutAction.Logout);
-            _deviceActionService.Toast(AppResources.VaultTimeoutActionChangedToLogOut);
-        }
     }
 }

src/App/Pages/TabsPage.cs

@@ -94,7 +94,7 @@ namespace Bit.App.Pages
                 }
             });
             await UpdateVaultButtonTitleAsync();
-            if (await _keyConnectorService.UserNeedsMigration())
+            if (await _keyConnectorService.UserNeedsMigrationAsync())
             {
                 _messagingService.Send("convertAccountToKeyConnector");
             }

src/App/Pages/Vault/CipherAddEditPage.xaml.cs

@@ -176,7 +176,7 @@ namespace Bit.App.Pages
                 }
             });
             // Hide password reprompt option if using key connector
-            _passwordPrompt.IsVisible = !await _keyConnectorService.GetUsesKeyConnector();
+            _passwordPrompt.IsVisible = !await _keyConnectorService.GetUsesKeyConnectorAsync();
         }
 
         protected override void OnDisappearing()

src/App/Resources/AppResources.Designer.cs

@@ -418,15 +418,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Admin approval requested.
-        /// </summary>
-        public static string AdminApprovalRequested {
-            get {
-                return ResourceManager.GetString("AdminApprovalRequested", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to All.
         /// </summary>
@@ -571,24 +562,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Approve with master password.
-        /// </summary>
-        public static string ApproveWithMasterPassword {
-            get {
-                return ResourceManager.GetString("ApproveWithMasterPassword", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Approve with my other device.
-        /// </summary>
-        public static string ApproveWithMyOtherDevice {
-            get {
-                return ResourceManager.GetString("ApproveWithMyOtherDevice", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to April.
         /// </summary>
@@ -3685,15 +3658,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Logged in!.
-        /// </summary>
-        public static string LoggedIn {
-            get {
-                return ResourceManager.GetString("LoggedIn", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Logged in as {0} on {1}..
         /// </summary>
@@ -3712,15 +3676,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Logging in as {0}.
-        /// </summary>
-        public static string LoggingInAsX {
-            get {
-                return ResourceManager.GetString("LoggingInAsX", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Logging in as {0} on {1}.
         /// </summary>
@@ -5318,15 +5273,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Remember this device.
-        /// </summary>
-        public static string RememberThisDevice {
-            get {
-                return ResourceManager.GetString("RememberThisDevice", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Remove.
         /// </summary>
@@ -5399,15 +5345,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Request admin approval.
-        /// </summary>
-        public static string RequestAdminApproval {
-            get {
-                return ResourceManager.GetString("RequestAdminApproval", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Request one-time password.
         /// </summary>
@@ -6416,15 +6353,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Trouble logging in?.
-        /// </summary>
-        public static string TroubleLoggingIn {
-            get {
-                return ResourceManager.GetString("TroubleLoggingIn", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Try again.
         /// </summary>
@@ -6434,15 +6362,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Turn off using a public device.
-        /// </summary>
-        public static string TurnOffUsingPublicDevice {
-            get {
-                return ResourceManager.GetString("TurnOffUsingPublicDevice", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to 20 seconds.
         /// </summary>
@@ -6974,15 +6893,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Vault timeout action changed to log out.
-        /// </summary>
-        public static string VaultTimeoutActionChangedToLogOut {
-            get {
-                return ResourceManager.GetString("VaultTimeoutActionChangedToLogOut", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Your organization policies have set your vault timeout action to {0}..
         /// </summary>
@@ -7352,24 +7262,6 @@ namespace Bit.App.Resources {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Your request has been sent to your admin..
-        /// </summary>
-        public static string YourRequestHasBeenSentToYourAdmin {
-            get {
-                return ResourceManager.GetString("YourRequestHasBeenSentToYourAdmin", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to You will be notified once approved. .
-        /// </summary>
-        public static string YouWillBeNotifiedOnceApproved {
-            get {
-                return ResourceManager.GetString("YouWillBeNotifiedOnceApproved", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to To continue, hold your YubiKey NEO against the back of the device or insert your YubiKey into your device&apos;s USB port, then touch its button..
         /// </summary>

src/App/Resources/AppResources.resx

@@ -2628,24 +2628,6 @@ Do you want to switch to this account?</value>
   <data name="CurrentMasterPassword" xml:space="preserve">
     <value>Current master password</value>
   </data>
-  <data name="LoggedIn" xml:space="preserve">
-    <value>Logged in!</value>
-  </data>
-  <data name="ApproveWithMyOtherDevice" xml:space="preserve">
-    <value>Approve with my other device</value>
-  </data>
-  <data name="RequestAdminApproval" xml:space="preserve">
-    <value>Request admin approval</value>
-  </data>
-  <data name="ApproveWithMasterPassword" xml:space="preserve">
-    <value>Approve with master password</value>
-  </data>
-  <data name="TurnOffUsingPublicDevice" xml:space="preserve">
-    <value>Turn off using a public device</value>
-  </data>
-  <data name="RememberThisDevice" xml:space="preserve">
-    <value>Remember this device</value>
-  </data>
   <data name="MasterPasswordRePromptHelp" xml:space="preserve">
     <value>Master password re-prompt help</value>
   </data>
@@ -2658,24 +2640,6 @@ Do you want to switch to this account?</value>
   <data name="InvalidAPIToken" xml:space="preserve">
     <value>Invalid API token</value>
   </data>
-  <data name="AdminApprovalRequested" xml:space="preserve">
-    <value>Admin approval requested</value>
-  </data>
-  <data name="YourRequestHasBeenSentToYourAdmin" xml:space="preserve">
-    <value>Your request has been sent to your admin.</value>
-  </data>
-  <data name="YouWillBeNotifiedOnceApproved" xml:space="preserve">
-    <value>You will be notified once approved. </value>
-  </data>
-  <data name="TroubleLoggingIn" xml:space="preserve">
-    <value>Trouble logging in?</value>
-  </data>
-  <data name="LoggingInAsX" xml:space="preserve">
-    <value>Logging in as {0}</value>
-  </data>
-  <data name="VaultTimeoutActionChangedToLogOut" xml:space="preserve">
-    <value>Vault timeout action changed to log out</value>
-  </data>
   <data name="BlockAutoFill" xml:space="preserve">
     <value>Block auto-fill</value>
   </data>

src/App/Services/BaseBiometricService.cs

@@ -0,0 +1,25 @@
+using System.Threading.Tasks;
+using Bit.Core.Abstractions;
+
+namespace Bit.App.Services
+{
+    public abstract class BaseBiometricService : IBiometricService
+    {
+        protected readonly IStateService _stateService;
+        protected readonly ICryptoService _cryptoService;
+
+        protected BaseBiometricService(IStateService stateService, ICryptoService cryptoService)
+        {
+            _stateService = stateService;
+            _cryptoService = cryptoService;
+        }
+
+        public async Task<bool> CanUseBiometricsUnlockAsync()
+        {
+            return await _cryptoService.HasEncryptedUserKeyAsync() || await _stateService.GetKeyEncryptedAsync() != null;
+        }
+
+        public abstract Task<bool> IsSystemBiometricIntegrityValidAsync(string bioIntegritySrcKey = null);
+        public abstract Task<bool> SetupBiometricAsync(string bioIntegritySrcKey = null);
+    }
+}

src/App/Services/MobilePasswordRepromptService.cs

@@ -38,13 +38,13 @@ namespace Bit.App.Services
                 return false;
             };
 
-            return await _cryptoService.CompareAndUpdatePasswordHashAsync(password, null);
+            return await _cryptoService.CompareAndUpdateKeyHashAsync(password, null);
         }
 
         public async Task<bool> Enabled()
         {
             var keyConnectorService = ServiceContainer.Resolve<IKeyConnectorService>("keyConnectorService");
-            return !await keyConnectorService.GetUsesKeyConnector();
+            return !await keyConnectorService.GetUsesKeyConnectorAsync();
         }
     }
 }

src/App/Utilities/AccountManagement/AccountsManager.cs

@@ -206,6 +206,7 @@ namespace Bit.App.Utilities.AccountManagement
 
         private async Task AddAccountAsync()
         {
+            await AppHelpers.ClearServiceCacheAsync();
             await Device.InvokeOnMainThreadAsync(() =>
             {
                 Options.HideAccountSwitcher = false;

src/App/Utilities/VerificationActionsFlowHelper.cs

@@ -107,7 +107,7 @@ namespace Bit.App.Utilities
 
         public async Task ValidateAndExecuteAsync()
         {
-            var verificationType = await _keyConnectorService.GetUsesKeyConnector()
+            var verificationType = await _keyConnectorService.GetUsesKeyConnectorAsync()
                 ? VerificationType.OTP
                 : VerificationType.MasterPassword;
 
@@ -121,7 +121,7 @@ namespace Bit.App.Utilities
                     }
 
                     var parameters = GetParameters();
-                    parameters.Secret = await _cryptoService.HashPasswordAsync(password, null);
+                    parameters.Secret = await _cryptoService.HashMasterKeyAsync(password, null);
                     parameters.VerificationType = VerificationType.MasterPassword;
                     await ExecuteAsync(parameters);
                     break;

src/Core/Abstractions/IApiService.cs

@@ -4,7 +4,6 @@ using System.Net;
 using System.Net.Http;
 using System.Threading;
 using System.Threading.Tasks;
-using Bit.Core.Enums;
 using Bit.Core.Models.Domain;
 using Bit.Core.Models.Request;
 using Bit.Core.Models.Response;
@@ -71,7 +70,7 @@ namespace Bit.Core.Abstractions
         Task<OrganizationAutoEnrollStatusResponse> GetOrganizationAutoEnrollStatusAsync(string identifier);
         Task PutOrganizationUserResetPasswordEnrollmentAsync(string orgId, string userId,
             OrganizationUserResetPasswordEnrollmentRequest request);
-        Task<KeyConnectorUserKeyResponse> GetMasterKeyFromKeyConnector(string keyConnectorUrl);
+        Task<KeyConnectorUserKeyResponse> GetMasterKeyFromKeyConnectorAsync(string keyConnectorUrl);
         Task PostUserKeyToKeyConnector(string keyConnectorUrl, KeyConnectorUserKeyRequest request);
         Task PostSetKeyConnectorKey(SetKeyConnectorKeyRequest request);
         Task PostConvertToKeyConnector();
@@ -91,12 +90,9 @@ namespace Bit.Core.Abstractions
         Task<PasswordlessLoginResponse> GetAuthRequestAsync(string id);
         Task<PasswordlessLoginResponse> GetAuthResponseAsync(string id, string accessCode);
         Task<PasswordlessLoginResponse> PutAuthRequestAsync(string id, string key, string masterPasswordHash, string deviceIdentifier, bool requestApproved);
-        Task<PasswordlessLoginResponse> PostCreateRequestAsync(PasswordlessCreateLoginRequest passwordlessCreateLoginRequest, AuthRequestType authRequestType);
+        Task<PasswordlessLoginResponse> PostCreateRequestAsync(PasswordlessCreateLoginRequest passwordlessCreateLoginRequest);
         Task<bool> GetKnownDeviceAsync(string email, string deviceIdentifier);
-        Task<DeviceResponse> GetDeviceByIdentifierAsync(string deviceIdentifier);
-        Task<DeviceResponse> UpdateTrustedDeviceKeysAsync(string deviceIdentifier, TrustedDeviceKeysRequest deviceRequest);
         Task<OrganizationDomainSsoDetailsResponse> GetOrgDomainSsoDetailsAsync(string email);
-        Task<bool> GetDevicesExistenceByTypes(DeviceType[] deviceTypes);
         Task<ConfigResponse> GetConfigsAsync();
         Task<string> GetFastmailAccountIdAsync(string apiKey);
     }

src/Core/Abstractions/IAuthService.cs

@@ -32,12 +32,9 @@ namespace Bit.Core.Abstractions
         Task<List<PasswordlessLoginResponse>> GetPasswordlessLoginRequestsAsync();
         Task<List<PasswordlessLoginResponse>> GetActivePasswordlessLoginRequestsAsync();
         Task<PasswordlessLoginResponse> GetPasswordlessLoginRequestByIdAsync(string id);
-        /// <summary>
-        /// Gets a passwordless login request by <paramref name="id"/> and <paramref name="accessCode"/>. No authentication required.
-        /// </summary>
-        Task<PasswordlessLoginResponse> GetPasswordlessLoginResquestAsync(string id, string accessCode);
+        Task<PasswordlessLoginResponse> GetPasswordlessLoginResponseAsync(string id, string accessCode);
         Task<PasswordlessLoginResponse> PasswordlessLoginAsync(string id, string pubKey, bool requestApproved);
-        Task<PasswordlessLoginResponse> PasswordlessCreateLoginRequestAsync(string email, AuthRequestType authRequestType);
+        Task<PasswordlessLoginResponse> PasswordlessCreateLoginRequestAsync(string email);
 
         void LogOut(Action callback);
         void Init();

src/Core/Abstractions/IBiometricService.cs

@@ -4,6 +4,7 @@ namespace Bit.Core.Abstractions
 {
     public interface IBiometricService
     {
+        Task<bool> CanUseBiometricsUnlockAsync();
         Task<bool> SetupBiometricAsync(string bioIntegritySrcKey = null);
         Task<bool> IsSystemBiometricIntegrityValidAsync(string bioIntegritySrcKey = null);
     }

src/Core/Abstractions/ICryptoService.cs

@@ -10,7 +10,7 @@ namespace Bit.Core.Abstractions
     public interface ICryptoService
     {
         void ClearCache();
-        Task ToggleKeysAsync();
+        Task RefreshKeysAsync();
         Task SetUserKeyAsync(UserKey userKey, string userId = null);
         Task<UserKey> GetUserKeyAsync(string userId = null);
         Task<UserKey> GetUserKeyWithLegacySupportAsync(string userId = null);
@@ -19,26 +19,28 @@ namespace Bit.Core.Abstractions
         Task<UserKey> MakeUserKeyAsync();
         Task ClearUserKeyAsync(string userId = null);
         Task SetMasterKeyEncryptedUserKeyAsync(string value, string userId = null);
+        Task<UserKey> GetAutoUnlockKeyAsync(string userId = null);
+        Task<bool> HasAutoUnlockKeyAsync(string userId = null);
+        Task<UserKey> GetBiometricUnlockKeyAsync(string userId = null);
         Task SetMasterKeyAsync(MasterKey masterKey, string userId = null);
         Task<MasterKey> GetMasterKeyAsync(string userId = null);
         Task<MasterKey> MakeMasterKeyAsync(string password, string email, KdfConfig kdfConfig);
         Task ClearMasterKeyAsync(string userId = null);
-        Task<Tuple<UserKey, EncString>> EncryptUserKeyWithMasterKeyAsync(MasterKey masterKey, UserKey userKey = null);
+        Task<Tuple<UserKey, EncString>> EncryptUserKeyWithMasterKeyAsync(MasterKey masterKey);
         Task<UserKey> DecryptUserKeyWithMasterKeyAsync(MasterKey masterKey, EncString encUserKey = null, string userId = null);
-        Task<Tuple<SymmetricCryptoKey, EncString>> MakeDataEncKeyAsync(UserKey key);
-        Task<Tuple<SymmetricCryptoKey, EncString>> MakeDataEncKeyAsync(OrgKey key);
-        Task<string> HashPasswordAsync(string password, SymmetricCryptoKey key, HashPurpose hashPurpose = HashPurpose.ServerAuthorization);
-        Task SetPasswordHashAsync(string keyHash);
-        Task<string> GetPasswordHashAsync();
-        Task ClearPasswordHashAsync(string userId = null);
-        Task<bool> CompareAndUpdatePasswordHashAsync(string masterPassword, MasterKey key);
+        Task<Tuple<SymmetricCryptoKey, EncString>> MakeDataEncKeyAsync(SymmetricCryptoKey key);
+        Task<string> HashMasterKeyAsync(string password, MasterKey key, HashPurpose hashPurpose = HashPurpose.ServerAuthorization);
+        Task SetMasterKeyHashAsync(string keyHash);
+        Task<string> GetMasterKeyHashAsync();
+        Task ClearMasterKeyHashAsync(string userId = null);
+        Task<bool> CompareAndUpdateKeyHashAsync(string masterPassword, MasterKey key);
         Task SetOrgKeysAsync(IEnumerable<ProfileOrganizationResponse> orgs);
         Task<OrgKey> GetOrgKeyAsync(string orgId);
         Task<Dictionary<string, OrgKey>> GetOrgKeysAsync();
         Task ClearOrgKeysAsync(bool memoryOnly = false, string userId = null);
-        Task<byte[]> GetPublicKeyAsync();
-        Task SetPrivateKeyAsync(string encPrivateKey);
-        Task<byte[]> GetPrivateKeyAsync();
+        Task<byte[]> GetUserPublicKeyAsync();
+        Task SetUserPrivateKeyAsync(string encPrivateKey);
+        Task<byte[]> GetUserPrivateKeyAsync();
         Task<List<string>> GetFingerprintAsync(string userId, byte[] publicKey = null);
         Task<Tuple<string, EncString>> MakeKeyPairAsync(SymmetricCryptoKey key = null);
         Task ClearKeyPairAsync(bool memoryOnly = false, string userId = null);

src/Core/Abstractions/IDeviceTrustCryptoService.cs

@@ -1,16 +0,0 @@
-using System.Threading.Tasks;
-using Bit.Core.Models.Domain;
-
-namespace Bit.Core.Abstractions
-{
-    public interface IDeviceTrustCryptoService
-    {
-        Task<SymmetricCryptoKey> GetDeviceKeyAsync();
-        Task<DeviceResponse> TrustDeviceAsync();
-        Task<DeviceResponse> TrustDeviceIfNeededAsync();
-        Task<bool> GetShouldTrustDeviceAsync();
-        Task SetShouldTrustDeviceAsync(bool value);
-        Task<UserKey> DecryptUserKeyWithDeviceKeyAsync(string encryptedDevicePrivateKey, string encryptedUserKey);
-        Task<bool> IsDeviceTrustedAsync();
-    }
-}

src/Core/Abstractions/IKeyConnectorService.cs

@@ -6,11 +6,11 @@ namespace Bit.Core.Abstractions
 {
     public interface IKeyConnectorService
     {
-        Task SetUsesKeyConnector(bool usesKeyConnector);
-        Task<bool> GetUsesKeyConnector();
-        Task<bool> UserNeedsMigration();
-        Task MigrateUser();
-        Task GetAndSetKey(string url);
-        Task<Organization> GetManagingOrganization();
+        Task SetUsesKeyConnectorAsync(bool usesKeyConnector);
+        Task<bool> GetUsesKeyConnectorAsync();
+        Task<bool> UserNeedsMigrationAsync();
+        Task MigrateUserAsync();
+        Task GetAndSetMasterKeyAsync(string url);
+        Task<Organization> GetManagingOrganizationAsync();
     }
 }

src/Core/Abstractions/IStateService.cs

@@ -17,8 +17,10 @@ namespace Bit.Core.Abstractions
         Task SetUserKeyAsync(UserKey value, string userId = null);
         Task<MasterKey> GetMasterKeyAsync(string userId = null);
         Task SetMasterKeyAsync(MasterKey value, string userId = null);
-        Task<string> GetUserKeyMasterKeyAsync(string userId = null);
-        Task SetUserKeyMasterKeyAsync(string value, string userId = null);
+        Task<string> GetMasterKeyEncryptedUserKeyAsync(string userId = null);
+        Task SetMasterKeyEncryptedUserKeyAsync(string value, string userId = null);
+        Task<UserKey> GetUserKeyAutoUnlockAsync(string userId = null);
+        Task SetUserKeyAutoUnlockAsync(UserKey value, string userId = null);
         Task<string> GetActiveUserIdAsync();
         Task<string> GetActiveUserEmailAsync();
         Task<T> GetActiveUserCustomDataAsync<T>(Func<Account, T> dataMapper);
@@ -33,6 +35,8 @@ namespace Bit.Core.Abstractions
         Task<EnvironmentUrlData> GetPreAuthEnvironmentUrlsAsync();
         Task SetPreAuthEnvironmentUrlsAsync(EnvironmentUrlData value);
         Task<EnvironmentUrlData> GetEnvironmentUrlsAsync(string userId = null);
+        Task<UserKey> GetUserKeyBiometricUnlockAsync(string userId = null);
+        Task SetUserKeyBiometricUnlockAsync(UserKey value, string userId = null);
         Task<bool?> GetBiometricUnlockAsync(string userId = null);
         Task SetBiometricUnlockAsync(bool? value, string userId = null);
         Task<bool> GetBiometricLockedAsync(string userId = null);
@@ -44,19 +48,11 @@ namespace Bit.Core.Abstractions
         Task<bool> CanAccessPremiumAsync(string userId = null);
         Task<string> GetProtectedPinAsync(string userId = null);
         Task SetPersonalPremiumAsync(bool value, string userId = null);
-        Task<EncString> GetUserKeyPinAsync(string userId = null);
-        Task SetUserKeyPinAsync(EncString value, string userId = null);
-        Task<EncString> GetUserKeyPinEphemeralAsync(string userId = null);
-        Task SetUserKeyPinEphemeralAsync(EncString value, string userId = null);
+        Task<EncString> GetPinKeyEncryptedUserKeyAsync(string userId = null);
+        Task SetPinKeyEncryptedUserKeyAsync(EncString value, string userId = null);
+        Task<EncString> GetPinKeyEncryptedUserKeyEphemeralAsync(string userId = null);
+        Task SetPinKeyEncryptedUserKeyEphemeralAsync(EncString value, string userId = null);
         Task SetProtectedPinAsync(string value, string userId = null);
-        [Obsolete("Use GetUserKeyPinAsync instead, left for migration purposes")]
-        Task<string> GetPinProtectedAsync(string userId = null);
-        [Obsolete("Use SetUserKeyPinAsync instead")]
-        Task SetPinProtectedAsync(string value, string userId = null);
-        [Obsolete("Use GetUserKeyPinEphemeralAsync instead, left for migration purposes")]
-        Task<EncString> GetPinProtectedKeyAsync(string userId = null);
-        [Obsolete("Use SetUserKeyPinEphemeralAsync instead")]
-        Task SetPinProtectedKeyAsync(EncString value, string userId = null);
         Task SetKdfConfigurationAsync(KdfConfig config, string userId = null);
         Task<string> GetKeyHashAsync(string userId = null);
         Task SetKeyHashAsync(string value, string userId = null);
@@ -64,8 +60,6 @@ namespace Bit.Core.Abstractions
         Task SetOrgKeysEncryptedAsync(Dictionary<string, string> value, string userId = null);
         Task<string> GetPrivateKeyEncryptedAsync(string userId = null);
         Task SetPrivateKeyEncryptedAsync(string value, string userId = null);
-        Task<SymmetricCryptoKey> GetDeviceKeyAsync(string userId = null);
-        Task SetDeviceKeyAsync(SymmetricCryptoKey value, string userId = null);
         Task<List<string>> GetAutofillBlacklistedUrisAsync(string userId = null);
         Task SetAutofillBlacklistedUrisAsync(List<string> value, string userId = null);
         Task<bool?> GetAutofillTileAddedAsync();
@@ -182,26 +176,28 @@ namespace Bit.Core.Abstractions
         Task<string> GetAvatarColorAsync(string userId = null);
         Task<string> GetPreLoginEmailAsync();
         Task SetPreLoginEmailAsync(string value);
-        Task<AccountDecryptionOptions> GetAccountDecryptionOptions(string userId = null);
-        Task<PendingAdminAuthRequest> GetPendingAdminAuthRequestAsync(string userId = null);
-        Task SetPendingAdminAuthRequestAsync(PendingAdminAuthRequest value, string userId = null);
         string GetLocale();
         void SetLocale(string locale);
         ConfigResponse GetConfigs();
         void SetConfigs(ConfigResponse value);
-        Task<bool> GetShouldTrustDeviceAsync();
-        Task SetShouldTrustDeviceAsync(bool value);
-        [Obsolete("Use GetUserKeyMasterKey instead")]
+        [Obsolete("Use GetPinKeyEncryptedUserKeyAsync instead, left for migration purposes")]
+        Task<string> GetPinProtectedAsync(string userId = null);
+        [Obsolete("Use SetPinKeyEncryptedUserKeyAsync instead, left for migration purposes")]
+        Task SetPinProtectedAsync(string value, string userId = null);
+        [Obsolete("Use GetPinKeyEncryptedUserKeyEphemeralAsync instead, left for migration purposes")]
+        Task<EncString> GetPinProtectedKeyAsync(string userId = null);
+        [Obsolete("Use SetPinKeyEncryptedUserKeyEphemeralAsync instead, left for migration purposes")]
+        Task SetPinProtectedKeyAsync(EncString value, string userId = null);
+        [Obsolete("Use GetMasterKeyEncryptedUserKeyAsync instead, left for migration purposes")]
         Task<string> GetEncKeyEncryptedAsync(string userId = null);
-        [Obsolete("Use SetUserKeyMasterKey instead")]
+        [Obsolete("Use SetMasterKeyEncryptedUserKeyAsync instead, left for migration purposes")]
         Task SetEncKeyEncryptedAsync(string value, string userId = null);
-        [Obsolete]
-        Task<string> GetKeyEncryptedAsync(string userId = null);
-        [Obsolete]
+        [Obsolete("Left for migration purposes")]
         Task SetKeyEncryptedAsync(string value, string userId = null);
-        [Obsolete("Use GetMasterKey instead")]
+
+        [Obsolete("Use GetUserKeyAutoUnlock instead, left for migration purposes")]
+        Task<string> GetKeyEncryptedAsync(string userId = null);
+        [Obsolete("Use GetMasterKeyAsync instead, left for migration purposes")]
         Task<SymmetricCryptoKey> GetKeyDecryptedAsync(string userId = null);
-        [Obsolete("Use GetMasterKey instead")]
-        Task SetKeyDecryptedAsync(SymmetricCryptoKey value, string userId = null);
     }
 }

src/Core/Abstractions/IVaultTimeoutService.cs

@@ -17,7 +17,7 @@ namespace Bit.Core.Abstractions
         Task<bool> ShouldLockAsync(string userId = null);
         Task<bool> IsLoggedOutByTimeoutAsync(string userId = null);
         Task<bool> ShouldLogOutByTimeoutAsync(string userId = null);
-        Task<PinLockEnum> IsPinLockSetAsync(string userId = null);
+        Task<PinLockType> GetPinLockTypeAsync(string userId = null);
         Task<bool> IsBiometricLockSetAsync(string userId = null);
         Task LockAsync(bool allowSoftLock = false, bool userInitiated = false, string userId = null);
         Task LogOutAsync(bool userInitiated = true, string userId = null);

src/Core/Constants.cs

@@ -55,7 +55,6 @@ namespace Bit.Core
         public const string AppLocaleKey = "appLocale";
         public const string ClearSensitiveFields = "clearSensitiveFields";
         public const string ForceUpdatePassword = "forceUpdatePassword";
-        public const string ShouldTrustDevice = "shouldTrustDevice";
         public const int SelectFileRequestCode = 42;
         public const int SelectFilePermissionRequestCode = 43;
         public const int SaveFileRequestCode = 44;
@@ -82,7 +81,9 @@ namespace Bit.Core
 
         public static string VaultTimeoutKey(string userId) => $"vaultTimeout_{userId}";
         public static string VaultTimeoutActionKey(string userId) => $"vaultTimeoutAction_{userId}";
-        public static string UserKeyKey(string userId) => $"userKey_{userId}";
+        public static string MasterKeyEncryptedUserKeyKey(string userId) => $"masterKeyEncryptedUserKey_{userId}";
+        public static string UserKeyAutoUnlockKey(string userId) => $"autoUnlock_{userId}";
+        public static string UserKeyBiometricUnlockKey(string userId) => $"biometricUnlock_{userId}";
         public static string CiphersKey(string userId) => $"ciphers_{userId}";
         public static string FoldersKey(string userId) => $"folders_{userId}";
         public static string CollectionsKey(string userId) => $"collections_{userId}";
@@ -93,9 +94,8 @@ namespace Bit.Core
         public static string PoliciesKey(string userId) => $"policies_{userId}";
         public static string EncOrgKeysKey(string userId) => $"encOrgKeys_{userId}";
         public static string EncPrivateKeyKey(string userId) => $"encPrivateKey_{userId}";
-        public static string DeviceKeyKey(string userId) => $"deviceKey_{userId}";
         public static string KeyHashKey(string userId) => $"keyHash_{userId}";
-        public static string UserKeyPinKey(string userId) => $"userKeyPin_{userId}";
+        public static string PinKeyEncryptedUserKeyKey(string userId) => $"pinKeyEncryptedUserKey_{userId}";
         public static string PassGenOptionsKey(string userId) => $"passwordGenerationOptions_{userId}";
         public static string PassGenHistoryKey(string userId) => $"generatedPasswordHistory_{userId}";
         public static string TwoFactorTokenKey(string email) => $"twoFactorToken_{email}";
@@ -124,7 +124,6 @@ namespace Bit.Core
         public static string PushCurrentTokenKey(string userId) => $"pushCurrentToken_{userId}";
         public static string ShouldConnectToWatchKey(string userId) => $"shouldConnectToWatch_{userId}";
         public static string ScreenCaptureAllowedKey(string userId) => $"screenCaptureAllowed_{userId}";
-        public static string PendingAdminAuthRequest(string userId) => $"pendingAdminAuthRequest_{userId}";
         [Obsolete]
         public static string KeyKey(string userId) => $"key_{userId}";
         [Obsolete]

src/Core/Enums/AuthRequestType.cs

@@ -1,11 +0,0 @@
-using System;
-namespace Bit.Core.Enums
-{
-    public enum AuthRequestType : byte
-    {
-        AuthenticateAndUnlock = 0,
-        Unlock = 1,
-        AdminApproval = 2
-    }
-}
-

src/Core/Enums/DeviceType.cs

@@ -1,7 +1,4 @@
-using System.Collections.Generic;
-using System.Linq;
-
-namespace Bit.Core.Enums
+namespace Bit.Core.Enums
 {
     public enum DeviceType : byte
     {
@@ -27,24 +24,4 @@ namespace Bit.Core.Enums
         VivaldiExtension = 19,
         SafariExtension = 20
     }
-
-    public static class DeviceTypeExtensions
-    {
-        public static List<DeviceType> GetMobileTypes() => new List<DeviceType>
-            {
-                DeviceType.Android,
-                DeviceType.AndroidAmazon,
-                DeviceType.iOS
-            };
-
-        public static List<DeviceType> GetDesktopTypes() => new List<DeviceType>
-            {
-                DeviceType.WindowsDesktop,
-                DeviceType.MacOsDesktop,
-                DeviceType.LinuxDesktop,
-                DeviceType.UWP,
-            };
-
-        public static List<DeviceType> GetDesktopAndMobileTypes() => GetMobileTypes().Concat(GetDesktopTypes()).ToList();
-    }
 }

src/Core/Models/Domain/Account.cs

@@ -53,7 +53,6 @@ namespace Bit.Core.Models.Domain
                 HasPremiumPersonally = copy.HasPremiumPersonally;
                 AvatarColor = copy.AvatarColor;
                 ForcePasswordResetReason = copy.ForcePasswordResetReason;
-                UserDecryptionOptions = copy.UserDecryptionOptions;
             }
 
             public string UserId;
@@ -69,7 +68,6 @@ namespace Bit.Core.Models.Domain
             public bool? EmailVerified;
             public bool? HasPremiumPersonally;
             public ForcePasswordResetReason? ForcePasswordResetReason;
-            public AccountDecryptionOptions UserDecryptionOptions;
         }
 
         public class AccountTokens
@@ -121,7 +119,7 @@ namespace Bit.Core.Models.Domain
         {
             public UserKey UserKey;
             public MasterKey MasterKey;
-            public EncString UserKeyPinEphemeral;
+            public EncString PinKeyEncryptedUserKeyEphemeral;
             public bool? BiometricLocked;
             [Obsolete("Jul 6 2023: Key has been deprecated. We will use the User Key in the future. It remains here for migration during app upgrade.")]
             public SymmetricCryptoKey Key;

src/Core/Models/Domain/AccountDecryptionOptions.cs

@@ -1,25 +0,0 @@
-using System;
-namespace Bit.Core.Models.Domain
-{
-    public class AccountDecryptionOptions
-    {
-        public bool HasMasterPassword { get; set; }
-        public TrustedDeviceOption TrustedDeviceOption { get; set; }
-        public KeyConnectorOption KeyConnectorOption { get; set; }
-    }
-
-    public class TrustedDeviceOption
-    {
-        public bool HasAdminApproval { get; set; }
-        public bool HasLoginApprovingDevice { get; set; }
-        public bool HasManageResetPasswordPermission { get; set; }
-        public string EncryptedPrivateKey { get; set; }
-        public string EncryptedUserKey { get; set; }
-    }
-
-    public class KeyConnectorOption
-    {
-        public string KeyConnectorUrl { get; set; }
-    }
-}
-

src/Core/Models/Domain/PendingAdminAuthRequest.cs

@@ -1,10 +0,0 @@
-using System;
-namespace Bit.Core.Models.Domain
-{
-    public class PendingAdminAuthRequest
-    {
-        public string Id { get; set; }
-        public byte[] PrivateKey { get; set; }
-    }
-}
-

src/Core/Models/Request/PasswordlessCreateLoginRequest.cs

@@ -1,6 +1,4 @@
 using System;
-using Bit.Core.Enums;
-
 namespace Bit.Core.Models.Request
 {
     public class PasswordlessCreateLoginRequest
@@ -27,4 +25,10 @@ namespace Bit.Core.Models.Request
 
         public string FingerprintPhrase { get; set; }
     }
+
+    public enum AuthRequestType : byte
+    {
+        AuthenticateAndUnlock = 0,
+        Unlock = 1
+    }
 }

src/Core/Models/Request/TrustedDeviceKeysRequest.cs

@@ -1,10 +0,0 @@
-
-namespace Bit.Core.Models.Request
-{
-    public class TrustedDeviceKeysRequest
-    {
-        public string EncryptedUserKey { get; set; }
-        public string EncryptedPublicKey { get; set; }
-        public string EncryptedPrivateKey { get; set; }
-    }
-}

src/Core/Models/Response/DeviceResponse.cs

@@ -1,13 +0,0 @@
-using Bit.Core.Enums;
-
-public class DeviceResponse
-{
-    public string Id { get; set; }
-    public string Name { get; set; }
-    public string Identifier { get; set; }
-    public DeviceType Type { get; set; }
-    public string CreationDate { get; set; }
-    public string EncryptedUserKey { get; set; }
-    public string EncryptedPublicKey { get; set; }
-    public string EncryptedPrivateKey { get; set; }
-}

src/Core/Models/Response/IdentityTokenResponse.cs

@@ -27,7 +27,6 @@ namespace Bit.Core.Models.Response
         public bool ForcePasswordReset { get; set; }
         public string KeyConnectorUrl { get; set; }
         public MasterPasswordPolicyOptions MasterPasswordPolicy { get; set; }
-        public AccountDecryptionOptions UserDecryptionOptions { get; set; }
         [JsonIgnore]
         public KdfConfig KdfConfig => new KdfConfig(Kdf, KdfIterations, KdfMemory, KdfParallelism);
     }

src/Core/Services/ApiService.cs

@@ -397,38 +397,12 @@ namespace Bit.Core.Services
 
         #region Device APIs
 
-
-        public Task<bool> GetKnownDeviceAsync(string email, string deviceIdentifier)
-        {
-            return SendAsync<object, bool>(HttpMethod.Get, "/devices/knowndevice", null, false, true, (message) =>
-            {
-                message.Headers.Add("X-Device-Identifier", deviceIdentifier);
-                message.Headers.Add("X-Request-Email", CoreHelpers.Base64UrlEncode(Encoding.UTF8.GetBytes(email)));
-            });
-        }
-
         public Task PutDeviceTokenAsync(string identifier, DeviceTokenRequest request)
         {
             return SendAsync<DeviceTokenRequest, object>(
                 HttpMethod.Put, $"/devices/identifier/{identifier}/token", request, true, false);
         }
 
-        public Task<bool> GetDevicesExistenceByTypes(DeviceType[] deviceTypes)
-        {
-            return SendAsync<DeviceType[], bool>(
-                HttpMethod.Post, "/devices/exist-by-types", deviceTypes, true, true);
-        }
-
-        public Task<DeviceResponse> GetDeviceByIdentifierAsync(string deviceIdentifier)
-        {
-            return SendAsync<object, DeviceResponse>(HttpMethod.Get, $"/devices/identifier/{deviceIdentifier}", null, true, true);
-        }
-
-        public Task<DeviceResponse> UpdateTrustedDeviceKeysAsync(string deviceIdentifier, TrustedDeviceKeysRequest trustedDeviceKeysRequest)
-        {
-            return SendAsync<TrustedDeviceKeysRequest, DeviceResponse>(HttpMethod.Put, $"/devices/{deviceIdentifier}/keys", trustedDeviceKeysRequest, true, true);
-        }
-
         #endregion
 
         #region Event APIs
@@ -511,7 +485,7 @@ namespace Bit.Core.Services
 
         #region Key Connector
 
-        public async Task<KeyConnectorUserKeyResponse> GetMasterKeyFromKeyConnector(string keyConnectorUrl)
+        public async Task<KeyConnectorUserKeyResponse> GetMasterKeyFromKeyConnectorAsync(string keyConnectorUrl)
         {
             using (var requestMessage = new HttpRequestMessage())
             {
@@ -591,9 +565,9 @@ namespace Bit.Core.Services
             return SendAsync<object, PasswordlessLoginResponse>(HttpMethod.Get, $"/auth-requests/{id}/response?code={accessCode}", null, false, true);
         }
 
-        public Task<PasswordlessLoginResponse> PostCreateRequestAsync(PasswordlessCreateLoginRequest passwordlessCreateLoginRequest, AuthRequestType authRequestType)
+        public Task<PasswordlessLoginResponse> PostCreateRequestAsync(PasswordlessCreateLoginRequest passwordlessCreateLoginRequest)
         {
-            return SendAsync<object, PasswordlessLoginResponse>(HttpMethod.Post, authRequestType == AuthRequestType.AdminApproval ? "/auth-requests/admin-request" : "/auth-requests", passwordlessCreateLoginRequest, authRequestType == AuthRequestType.AdminApproval, true);
+            return SendAsync<object, PasswordlessLoginResponse>(HttpMethod.Post, $"/auth-requests", passwordlessCreateLoginRequest, false, true);
         }
 
         public Task<PasswordlessLoginResponse> PutAuthRequestAsync(string id, string encKey, string encMasterPasswordHash, string deviceIdentifier, bool requestApproved)
@@ -602,6 +576,15 @@ namespace Bit.Core.Services
             return SendAsync<object, PasswordlessLoginResponse>(HttpMethod.Put, $"/auth-requests/{id}", request, true, true);
         }
 
+        public Task<bool> GetKnownDeviceAsync(string email, string deviceIdentifier)
+        {
+            return SendAsync<object, bool>(HttpMethod.Get, "/devices/knowndevice", null, false, true, (message) =>
+            {
+                message.Headers.Add("X-Device-Identifier", deviceIdentifier);
+                message.Headers.Add("X-Request-Email", CoreHelpers.Base64UrlEncode(Encoding.UTF8.GetBytes(email)));
+            });
+        }
+
         #endregion
 
         #region Configs

src/Core/Services/AuthService.cs

@@ -27,7 +27,6 @@ namespace Bit.Core.Services
         private readonly IKeyConnectorService _keyConnectorService;
         private readonly IPasswordGenerationService _passwordGenerationService;
         private readonly IPolicyService _policyService;
-        private readonly IDeviceTrustCryptoService _deviceTrustCryptoService;
         private readonly bool _setCryptoKeys;
 
         private readonly LazyResolve<IWatchDeviceService> _watchDeviceService = new LazyResolve<IWatchDeviceService>();
@@ -47,11 +46,8 @@ namespace Bit.Core.Services
             II18nService i18nService,
             IPlatformUtilsService platformUtilsService,
             IMessagingService messagingService,
-            IVaultTimeoutService vaultTimeoutService,
-            IKeyConnectorService keyConnectorService,
             IPasswordGenerationService passwordGenerationService,
             IPolicyService policyService,
-            IDeviceTrustCryptoService deviceTrustCryptoService,
             bool setCryptoKeys = true)
         {
             _cryptoService = cryptoService;
@@ -63,10 +59,8 @@ namespace Bit.Core.Services
             _i18nService = i18nService;
             _platformUtilsService = platformUtilsService;
             _messagingService = messagingService;
-            _keyConnectorService = keyConnectorService;
             _passwordGenerationService = passwordGenerationService;
             _policyService = policyService;
-            _deviceTrustCryptoService = deviceTrustCryptoService;
             _setCryptoKeys = setCryptoKeys;
 
             TwoFactorProviders = new Dictionary<TwoFactorProviderType, TwoFactorProvider>();
@@ -148,8 +142,8 @@ namespace Bit.Core.Services
             SelectedTwoFactorProviderType = null;
             _2faForcePasswordResetReason = null;
             var key = await MakePreloginKeyAsync(masterPassword, email);
-            var hashedPassword = await _cryptoService.HashPasswordAsync(masterPassword, key);
-            var localHashedPassword = await _cryptoService.HashPasswordAsync(masterPassword, key, HashPurpose.LocalAuthorization);
+            var hashedPassword = await _cryptoService.HashMasterKeyAsync(masterPassword, key);
+            var localHashedPassword = await _cryptoService.HashMasterKeyAsync(masterPassword, key, HashPurpose.LocalAuthorization);
             var result = await LogInHelperAsync(email, hashedPassword, localHashedPassword, null, null, null, key, null, null, null, captchaToken);
 
             if (await RequirePasswordChangeAsync(email, masterPassword))
@@ -198,34 +192,11 @@ namespace Bit.Core.Services
             return !await _policyService.EvaluateMasterPassword(strength.Value, masterPassword, _masterPasswordPolicy);
         }
 
-        public async Task<AuthResult> LogInPasswordlessAsync(string email, string accessCode, string authRequestId, byte[] decryptionKey, string encryptedAuthRequestKey, string masterKeyHash)
+        public async Task<AuthResult> LogInPasswordlessAsync(string email, string accessCode, string authRequestId, byte[] decryptionKey, string userKeyCiphered, string localHashedPasswordCiphered)
         {
-            var decryptedKey = await _cryptoService.RsaDecryptAsync(encryptedAuthRequestKey, decryptionKey);
-
-            // On SSO flow user is already AuthN
-            if (await _stateService.IsAuthenticatedAsync())
-            {
-                if (string.IsNullOrEmpty(masterKeyHash))
-                {
-                    await _cryptoService.SetUserKeyAsync(new UserKey(decryptedKey));
-                }
-                else
-                {
-                    var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(new MasterKey(decryptedKey));
-                    await _cryptoService.SetUserKeyAsync(userKey);
-                }
-                await _deviceTrustCryptoService.TrustDeviceIfNeededAsync();
-                return null;
-            }
-
-            if (string.IsNullOrEmpty(masterKeyHash) && decryptionKey != null)
-            {
-                await _cryptoService.SetUserKeyAsync(new UserKey(decryptedKey));
-                return null;
-            }
-
-            var decKeyHash = await _cryptoService.RsaDecryptAsync(masterKeyHash, decryptionKey);
-            return await LogInHelperAsync(email, accessCode, Encoding.UTF8.GetString(decKeyHash), null, null, null, new MasterKey(decryptedKey), null, null,
+            var decKey = await _cryptoService.RsaDecryptAsync(userKeyCiphered, decryptionKey);
+            var decPasswordHash = await _cryptoService.RsaDecryptAsync(localHashedPasswordCiphered, decryptionKey);
+            return await LogInHelperAsync(email, accessCode, Encoding.UTF8.GetString(decPasswordHash), null, null, null, new MasterKey(decKey), null, null,
                 null, null, authRequestId: authRequestId);
         }
 
@@ -262,8 +233,8 @@ namespace Bit.Core.Services
         {
             SelectedTwoFactorProviderType = null;
             var key = await MakePreloginKeyAsync(masterPassword, email);
-            var hashedPassword = await _cryptoService.HashPasswordAsync(masterPassword, key);
-            var localHashedPassword = await _cryptoService.HashPasswordAsync(masterPassword, key, HashPurpose.LocalAuthorization);
+            var hashedPassword = await _cryptoService.HashMasterKeyAsync(masterPassword, key);
+            var localHashedPassword = await _cryptoService.HashMasterKeyAsync(masterPassword, key, HashPurpose.LocalAuthorization);
             return await LogInHelperAsync(email, hashedPassword, localHashedPassword, null, null, null, key, twoFactorProvider,
                 twoFactorToken, remember);
         }
@@ -485,7 +456,6 @@ namespace Bit.Core.Services
                         ForcePasswordResetReason = result.ForcePasswordReset
                             ? ForcePasswordResetReason.AdminForcePasswordReset
                             : (ForcePasswordResetReason?)null,
-                        UserDecryptionOptions = tokenResponse.UserDecryptionOptions,
                     },
                     new Account.AccountTokens()
                     {
@@ -497,41 +467,22 @@ namespace Bit.Core.Services
             _messagingService.Send("accountAdded");
             if (_setCryptoKeys)
             {
+
                 if (localHashedPassword != null)
                 {
-                    await _cryptoService.SetPasswordHashAsync(localHashedPassword);
-                    await _cryptoService.SetMasterKeyAsync(masterKey);
-                    var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(masterKey);
-                    await _cryptoService.SetUserKeyAsync(userKey);
+                    await _cryptoService.SetMasterKeyHashAsync(localHashedPassword);
                 }
 
                 if (code == null || tokenResponse.Key != null)
                 {
-                    var decryptOptions = await _stateService.GetAccountDecryptionOptions();
+                    if (tokenResponse.KeyConnectorUrl != null)
+                    {
+                        await _keyConnectorService.GetAndSetMasterKeyAsync(tokenResponse.KeyConnectorUrl);
+                    }
+
                     await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(tokenResponse.Key);
 
-                    if (decryptOptions?.TrustedDeviceOption != null)
-                    {
-                        var key = await _deviceTrustCryptoService.DecryptUserKeyWithDeviceKeyAsync(decryptOptions.TrustedDeviceOption.EncryptedPrivateKey, decryptOptions.TrustedDeviceOption.EncryptedUserKey);
-                        if (key != null)
-                        {
-                            await _cryptoService.SetUserKeyAsync(key);
-                        }
-                    }
-                    else if (!string.IsNullOrEmpty(tokenResponse.KeyConnectorUrl) || !string.IsNullOrEmpty(decryptOptions?.KeyConnectorOption?.KeyConnectorUrl))
-                    {
-
-                        await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(tokenResponse.Key);
-                        if (masterKey != null)
-                        {
-                            await _cryptoService.SetMasterKeyAsync(masterKey);
-                            var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(masterKey);
-                            await _cryptoService.SetUserKeyAsync(userKey);
-                        }
-                    }
-
-                    // Login with Device
-                    if (masterKey != null && !string.IsNullOrEmpty(authRequestId))
+                    if (masterKey != null)
                     {
                         await _cryptoService.SetMasterKeyAsync(masterKey);
                         var userKey = await _cryptoService.DecryptUserKeyWithMasterKeyAsync(masterKey);
@@ -554,21 +505,25 @@ namespace Bit.Core.Services
                         catch { }
                     }
 
-                    await _cryptoService.SetPrivateKeyAsync(tokenResponse.PrivateKey);
+                    await _cryptoService.SetUserPrivateKeyAsync(tokenResponse.PrivateKey);
                 }
                 else if (tokenResponse.KeyConnectorUrl != null)
                 {
                     // SSO Key Connector Onboarding
                     var password = await _cryptoFunctionService.RandomBytesAsync(64);
-                    var newMasterKey = await _cryptoService.MakeMasterKeyAsync(Convert.ToBase64String(password), _tokenService.GetEmail(), tokenResponse.KdfConfig);
-                    var keyConnectorRequest = new KeyConnectorUserKeyRequest(newMasterKey.EncKeyB64);
-                    await _cryptoService.SetMasterKeyAsync(newMasterKey);
+                    var newMasterKey = await _cryptoService.MakeMasterKeyAsync(
+                        Convert.ToBase64String(password),
+                        _tokenService.GetEmail(),
+                        tokenResponse.KdfConfig);
 
-                    var (newUserKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(
-                        newMasterKey,
-                        await _cryptoService.MakeUserKeyAsync());
+                    var keyConnectorRequest = new KeyConnectorUserKeyRequest(newMasterKey.EncKeyB64);
+
+                    var (newUserKey, newProtectedUserKey) = await _cryptoService.EncryptUserKeyWithMasterKeyAsync(newMasterKey);
 
                     await _cryptoService.SetUserKeyAsync(newUserKey);
+                    await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(newProtectedUserKey.EncryptedString);
+                    await _cryptoService.SetMasterKeyAsync(newMasterKey);
+
                     var (newPublicKey, newProtectedPrivateKey) = await _cryptoService.MakeKeyPairAsync();
 
                     try
@@ -590,6 +545,7 @@ namespace Bit.Core.Services
                     );
                     await _apiService.PostSetKeyConnectorKey(setPasswordRequest);
                 }
+
             }
 
             _authedUserId = _tokenService.GetUserId();
@@ -626,14 +582,14 @@ namespace Bit.Core.Services
             var activeRequests = requests.Where(r => !r.IsAnswered && !r.IsExpired).OrderByDescending(r => r.CreationDate).ToList();
             return await PopulateFingerprintPhrasesAsync(activeRequests);
         }
+
         public async Task<PasswordlessLoginResponse> GetPasswordlessLoginRequestByIdAsync(string id)
         {
             var response = await _apiService.GetAuthRequestAsync(id);
             return await PopulateFingerprintPhraseAsync(response, await _stateService.GetEmailAsync());
         }
 
-        /// <inheritdoc />
-        public async Task<PasswordlessLoginResponse> GetPasswordlessLoginResquestAsync(string id, string accessCode)
+        public async Task<PasswordlessLoginResponse> GetPasswordlessLoginResponseAsync(string id, string accessCode)
         {
             return await _apiService.GetAuthResponseAsync(id, accessCode);
         }
@@ -643,18 +599,13 @@ namespace Bit.Core.Services
             var publicKey = CoreHelpers.Base64UrlDecode(pubKey);
             var masterKey = await _cryptoService.GetMasterKeyAsync();
             var encryptedKey = await _cryptoService.RsaEncryptAsync(masterKey.EncKey, publicKey);
-            var keyHash = await _stateService.GetKeyHashAsync();
-            EncString encryptedMasterPassword = null;
-            if (!string.IsNullOrEmpty(keyHash))
-            {
-                encryptedMasterPassword = await _cryptoService.RsaEncryptAsync(Encoding.UTF8.GetBytes(keyHash), publicKey);
-            }
+            var encryptedMasterPassword = await _cryptoService.RsaEncryptAsync(Encoding.UTF8.GetBytes(await _stateService.GetKeyHashAsync()), publicKey);
             var deviceId = await _appIdService.GetAppIdAsync();
-            var response = await _apiService.PutAuthRequestAsync(id, encryptedKey.EncryptedString, encryptedMasterPassword?.EncryptedString, deviceId, requestApproved);
+            var response = await _apiService.PutAuthRequestAsync(id, encryptedKey.EncryptedString, encryptedMasterPassword.EncryptedString, deviceId, requestApproved);
             return await PopulateFingerprintPhraseAsync(response, await _stateService.GetEmailAsync());
         }
 
-        public async Task<PasswordlessLoginResponse> PasswordlessCreateLoginRequestAsync(string email, AuthRequestType authRequestType)
+        public async Task<PasswordlessLoginResponse> PasswordlessCreateLoginRequestAsync(string email)
         {
             var deviceId = await _appIdService.GetAppIdAsync();
             var keyPair = await _cryptoFunctionService.RsaGenerateKeyPairAsync(2048);
@@ -662,8 +613,8 @@ namespace Bit.Core.Services
             var fingerprintPhrase = string.Join("-", generatedFingerprintPhrase);
             var publicB64 = Convert.ToBase64String(keyPair.Item1);
             var accessCode = await _passwordGenerationService.GeneratePasswordAsync(PasswordGenerationOptions.CreateDefault.WithLength(25));
-            var passwordlessCreateLoginRequest = new PasswordlessCreateLoginRequest(email, publicB64, deviceId, accessCode, authRequestType, fingerprintPhrase);
-            var response = await _apiService.PostCreateRequestAsync(passwordlessCreateLoginRequest, authRequestType);
+            var passwordlessCreateLoginRequest = new PasswordlessCreateLoginRequest(email, publicB64, deviceId, accessCode, AuthRequestType.AuthenticateAndUnlock, fingerprintPhrase);
+            var response = await _apiService.PostCreateRequestAsync(passwordlessCreateLoginRequest);
 
             if (response != null)
             {

src/Core/Services/CipherService.cs

@@ -249,8 +249,7 @@ namespace Bit.Core.Services
             {
                 try
                 {
-                    var hashKey = await _cryptoService.HasUserKeyAsync();
-                    if (!hashKey)
+                    if (!await _cryptoService.HasUserKeyAsync())
                     {
                         throw new Exception("No key.");
                     }
@@ -557,20 +556,9 @@ namespace Bit.Core.Services
 
         public async Task<Cipher> SaveAttachmentRawWithServerAsync(Cipher cipher, string filename, byte[] data)
         {
-            SymmetricCryptoKey attachmentKey;
-            EncString protectedAttachmentKey;
-            var orgKey = await _cryptoService.GetOrgKeyAsync(cipher.OrganizationId);
-            if (orgKey != null)
-            {
-                (attachmentKey, protectedAttachmentKey) = await _cryptoService.MakeDataEncKeyAsync(orgKey);
-            }
-            else
-            {
-                var userKey = await _cryptoService.GetUserKeyWithLegacySupportAsync();
-                (attachmentKey, protectedAttachmentKey) = await _cryptoService.MakeDataEncKeyAsync(userKey);
-            }
+            var (attachmentKey, protectedAttachmentKey, encKey) = await MakeAttachmentKeyAsync(cipher.OrganizationId);
 
-            var encFileName = await _cryptoService.EncryptAsync(filename, orgKey);
+            var encFileName = await _cryptoService.EncryptAsync(filename, encKey);
             var encFileData = await _cryptoService.EncryptToBytesAsync(data, attachmentKey);
 
             CipherResponse response;
@@ -807,6 +795,14 @@ namespace Bit.Core.Services
 
         // Helpers
 
+        private async Task<Tuple<SymmetricCryptoKey, EncString, SymmetricCryptoKey>> MakeAttachmentKeyAsync(string organizationId)
+        {
+            var encryptionKey = await _cryptoService.GetOrgKeyAsync(organizationId)
+                ?? (SymmetricCryptoKey)await _cryptoService.GetUserKeyWithLegacySupportAsync();
+            var (attachmentKey, protectedAttachmentKey) = await _cryptoService.MakeDataEncKeyAsync(encryptionKey);
+            return new Tuple<SymmetricCryptoKey, EncString, SymmetricCryptoKey>(attachmentKey, protectedAttachmentKey, encryptionKey);
+        }
+
         private async Task ShareAttachmentWithServerAsync(AttachmentView attachmentView, string cipherId,
             string organizationId)
         {
@@ -819,20 +815,9 @@ namespace Bit.Core.Services
             var bytes = await attachmentResponse.Content.ReadAsByteArrayAsync();
             var decBytes = await _cryptoService.DecryptFromBytesAsync(bytes, null);
 
-            SymmetricCryptoKey attachmentKey;
-            EncString protectedAttachmentKey;
-            var orgKey = await _cryptoService.GetOrgKeyAsync(organizationId);
-            if (orgKey != null)
-            {
-                (attachmentKey, protectedAttachmentKey) = await _cryptoService.MakeDataEncKeyAsync(orgKey);
-            }
-            else
-            {
-                var userKey = await _cryptoService.GetUserKeyWithLegacySupportAsync();
-                (attachmentKey, protectedAttachmentKey) = await _cryptoService.MakeDataEncKeyAsync(userKey);
-            }
+            var (attachmentKey, protectedAttachmentKey, encKey) = await MakeAttachmentKeyAsync(organizationId);
 
-            var encFileName = await _cryptoService.EncryptAsync(attachmentView.FileName, orgKey);
+            var encFileName = await _cryptoService.EncryptAsync(attachmentView.FileName, encKey);
             var encFileData = await _cryptoService.EncryptToBytesAsync(decBytes, attachmentKey);
 
             var boundary = string.Concat("--BWMobileFormBoundary", DateTime.UtcNow.Ticks);

src/Core/Services/CryptoService.cs

@@ -20,7 +20,7 @@ namespace Bit.Core.Services
         private readonly ICryptoFunctionService _cryptoFunctionService;
 
         private SymmetricCryptoKey _legacyEtmKey;
-        private string _passwordHash;
+        private string _masterKeyHash;
         private byte[] _publicKey;
         private byte[] _privateKey;
         private Dictionary<string, OrgKey> _orgKeys;
@@ -37,42 +37,28 @@ namespace Bit.Core.Services
         public void ClearCache()
         {
             _legacyEtmKey = null;
-            _passwordHash = null;
+            _masterKeyHash = null;
             _publicKey = null;
             _privateKey = null;
             _orgKeys = null;
         }
 
-        public async Task ToggleKeysAsync()
+        public async Task RefreshKeysAsync()
         {
-            // refresh or clear the pin key
+            // Refresh or clear additional keys such as
+            // pin and auto unlock keys
             await SetUserKeyAsync(await GetUserKeyAsync());
-
-            // refresh or clear the encrypted user key
-            var encUserKey = await _stateService.GetUserKeyMasterKeyAsync();
-            await _stateService.SetUserKeyMasterKeyAsync(null);
-            await _stateService.SetUserKeyMasterKeyAsync(encUserKey);
         }
 
         public async Task SetUserKeyAsync(UserKey userKey, string userId = null)
         {
             await _stateService.SetUserKeyAsync(userKey, userId);
-
-            // Refresh the Pin Key if the user has a Pin set
-            if (await _stateService.GetProtectedPinAsync(userId) != null)
-            {
-                await StorePinKey(userKey, userId);
-            }
-            else
-            {
-                await _stateService.SetUserKeyPinAsync(null, userId);
-                await _stateService.SetUserKeyPinEphemeralAsync(null, userId);
-            }
+            await StoreAdditionalKeysAsync(userKey, userId);
         }
 
-        public async Task<UserKey> GetUserKeyAsync(string userId = null)
+        public Task<UserKey> GetUserKeyAsync(string userId = null)
         {
-            return await _stateService.GetUserKeyAsync(userId);
+            return _stateService.GetUserKeyAsync(userId);
         }
 
         public async Task<UserKey> GetUserKeyWithLegacySupportAsync(string userId = null)
@@ -85,7 +71,7 @@ namespace Bit.Core.Services
 
             // Legacy support: encryption used to be done with the master key (derived from master password).
             // Users who have not migrated will have a null user key and must use the master key instead.
-            return (SymmetricCryptoKey)await GetMasterKeyAsync() as UserKey;
+            return new UserKey((await GetMasterKeyAsync()).Key);
         }
 
         public async Task<bool> HasUserKeyAsync(string userId = null)
@@ -95,7 +81,7 @@ namespace Bit.Core.Services
 
         public async Task<bool> HasEncryptedUserKeyAsync(string userId = null)
         {
-            return await _stateService.GetUserKeyMasterKeyAsync(userId) != null;
+            return await _stateService.GetMasterKeyEncryptedUserKeyAsync(userId) != null;
         }
 
         public async Task<UserKey> MakeUserKeyAsync()
@@ -103,20 +89,36 @@ namespace Bit.Core.Services
             return new UserKey(await _cryptoFunctionService.RandomBytesAsync(64));
         }
 
-        public async Task ClearUserKeyAsync(string userId = null)
+        public Task ClearUserKeyAsync(string userId = null)
         {
-            await _stateService.SetUserKeyAsync(null, userId);
+            return _stateService.SetUserKeyAsync(null, userId);
         }
 
-        public async Task SetMasterKeyEncryptedUserKeyAsync(string value, string userId = null)
+        public Task SetMasterKeyEncryptedUserKeyAsync(string value, string userId = null)
         {
-            await _stateService.SetUserKeyMasterKeyAsync(value, userId);
+            return _stateService.SetMasterKeyEncryptedUserKeyAsync(value, userId);
         }
 
-        public async Task SetMasterKeyAsync(MasterKey masterKey, string userId = null)
+        public async Task<UserKey> GetAutoUnlockKeyAsync(string userId = null)
         {
-            await _stateService.SetMasterKeyAsync(masterKey, userId);
+            await MigrateAutoAndBioKeysIfNeededAsync(userId);
+            return await _stateService.GetUserKeyAutoUnlockAsync(userId);
+        }
 
+        public async Task<bool> HasAutoUnlockKeyAsync(string userId = null)
+        {
+            return await GetAutoUnlockKeyAsync(userId) != null;
+        }
+
+        public async Task<UserKey> GetBiometricUnlockKeyAsync(string userId = null)
+        {
+            await MigrateAutoAndBioKeysIfNeededAsync(userId);
+            return await _stateService.GetUserKeyBiometricUnlockAsync(userId);
+        }
+
+        public Task SetMasterKeyAsync(MasterKey masterKey, string userId = null)
+        {
+            return _stateService.SetMasterKeyAsync(masterKey, userId);
         }
 
         public async Task<MasterKey> GetMasterKeyAsync(string userId = null)
@@ -125,7 +127,7 @@ namespace Bit.Core.Services
             if (masterKey == null)
             {
                 // Migration support
-                masterKey = await _stateService.GetKeyDecryptedAsync(userId) as MasterKey;
+                masterKey = new MasterKey((await _stateService.GetKeyDecryptedAsync(userId)).Key);
                 if (masterKey != null)
                 {
                     await SetMasterKeyAsync(masterKey, userId);
@@ -134,20 +136,20 @@ namespace Bit.Core.Services
             return masterKey;
         }
 
-        public async Task<MasterKey> MakeMasterKeyAsync(string password, string email, KdfConfig kdfConfig)
+        public Task<MasterKey> MakeMasterKeyAsync(string password, string email, KdfConfig kdfConfig)
         {
-            return await MakeKeyAsync(password, email, kdfConfig, keyBytes => new MasterKey(keyBytes));
+            return MakeKeyAsync(password, email, kdfConfig, keyBytes => new MasterKey(keyBytes));
         }
 
-        public async Task ClearMasterKeyAsync(string userId = null)
+        public Task ClearMasterKeyAsync(string userId = null)
         {
-            await _stateService.SetMasterKeyAsync(null, userId);
+            return _stateService.SetMasterKeyAsync(null, userId);
         }
 
-        public async Task<Tuple<UserKey, EncString>> EncryptUserKeyWithMasterKeyAsync(MasterKey masterKey, UserKey userKey = null)
+        public async Task<Tuple<UserKey, EncString>> EncryptUserKeyWithMasterKeyAsync(MasterKey masterKey)
         {
-            userKey ??= await GetUserKeyAsync();
-            return await BuildProtectedSymmetricKey<UserKey>(masterKey, userKey.Key);
+            var userKey = await GetUserKeyAsync() ?? await MakeUserKeyAsync();
+            return await BuildProtectedSymmetricKeyAsync(masterKey, userKey.Key, keyBytes => new UserKey(keyBytes));
         }
 
         public async Task<UserKey> DecryptUserKeyWithMasterKeyAsync(MasterKey masterKey, EncString encUserKey = null, string userId = null)
@@ -160,11 +162,27 @@ namespace Bit.Core.Services
 
             if (encUserKey == null)
             {
-                var userKeyMasterKey = await _stateService.GetUserKeyMasterKeyAsync(userId);
-                if (userKeyMasterKey == null)
+                var userKeyMasterKey = await _stateService.GetMasterKeyEncryptedUserKeyAsync(userId);
+
+                if (userKeyMasterKey is null)
                 {
-                    throw new Exception("No encrypted user key found");
+                    // Migrate old key
+                    var oldEncUserKey = await _stateService.GetEncKeyEncryptedAsync(userId);
+
+                    if (oldEncUserKey is null)
+                    {
+                        throw new Exception("No encrypted user key nor old encKeyEncrypted found");
+                    }
+
+                    var userKey = await DecryptUserKeyWithMasterKeyAsync(
+                        masterKey,
+                        new EncString(oldEncUserKey),
+                        userId
+                    );
+                    await SetMasterKeyEncryptedUserKeyAsync(oldEncUserKey, userId);
+                    return userKey;
                 }
+
                 encUserKey = new EncString(userKeyMasterKey);
             }
 
@@ -175,12 +193,12 @@ namespace Bit.Core.Services
             }
             else if (encUserKey.EncryptionType == EncryptionType.AesCbc256_HmacSha256_B64)
             {
-                var newKey = await StretchKeyAsync(masterKey);
+                var newKey = await StretchKeyAsync(masterKey, keyBytes => new MasterKey(keyBytes));
                 decUserKey = await DecryptToBytesAsync(encUserKey, newKey);
             }
             else
             {
-                throw new Exception("Unsupported encKey type.");
+                throw new Exception($"Unsupported encrypted user key type: {encUserKey.EncryptionType}");
             }
 
             if (decUserKey == null)
@@ -190,86 +208,82 @@ namespace Bit.Core.Services
             return new UserKey(decUserKey);
         }
 
-        public async Task<Tuple<SymmetricCryptoKey, EncString>> MakeDataEncKeyAsync(UserKey key)
+        public async Task<Tuple<SymmetricCryptoKey, EncString>> MakeDataEncKeyAsync(SymmetricCryptoKey key)
         {
-            if (key == null)
+            if (key is null)
             {
-                throw new Exception("No user key provided");
+                throw new ArgumentNullException(nameof(key));
+            }
+            if (!(key is UserKey) && !(key is OrgKey))
+            {
+                throw new ArgumentException($"Data encryption keys must be of type UserKey or OrgKey. {key.GetType().FullName} unsupported.");
             }
 
             var newSymKey = await _cryptoFunctionService.RandomBytesAsync(64);
-            return await BuildProtectedSymmetricKey<SymmetricCryptoKey>(key, newSymKey);
+            return await BuildProtectedSymmetricKeyAsync(key, newSymKey, keyBytes => new SymmetricCryptoKey(keyBytes));
         }
 
-        public async Task<Tuple<SymmetricCryptoKey, EncString>> MakeDataEncKeyAsync(OrgKey key)
+        public async Task<string> HashMasterKeyAsync(string password, MasterKey masterKey, HashPurpose hashPurpose = HashPurpose.ServerAuthorization)
         {
-            if (key == null)
+            if (password is null)
             {
-                throw new Exception("No org key provided");
+                throw new ArgumentNullException(nameof(password));
             }
 
-            var newSymKey = await _cryptoFunctionService.RandomBytesAsync(64);
-            return await BuildProtectedSymmetricKey<SymmetricCryptoKey>(key, newSymKey);
-        }
+            if (masterKey is null)
+            {
+                masterKey = await GetMasterKeyAsync();
 
-        // TODO(Jake): Uses Master Key
-        public async Task<string> HashPasswordAsync(string password, SymmetricCryptoKey key, HashPurpose hashPurpose = HashPurpose.ServerAuthorization)
-        {
-            if (key == null)
-            {
-                key = await GetMasterKeyAsync();
+                if (masterKey is null)
+                {
+                    throw new ArgumentNullException(nameof(masterKey));
+                }
             }
-            if (password == null || key == null)
-            {
-                throw new Exception("Invalid parameters.");
-            }
-            var iterations = hashPurpose == HashPurpose.LocalAuthorization ? 2 : 1;
-            var hash = await _cryptoFunctionService.Pbkdf2Async(key.Key, password, CryptoHashAlgorithm.Sha256, iterations);
+            var hash = await _cryptoFunctionService.Pbkdf2Async(masterKey.Key, password, CryptoHashAlgorithm.Sha256, (int)hashPurpose);
             return Convert.ToBase64String(hash);
         }
 
-        public async Task SetPasswordHashAsync(string keyHash)
+        public Task SetMasterKeyHashAsync(string keyHash)
         {
-            _passwordHash = keyHash;
-            await _stateService.SetKeyHashAsync(keyHash);
+            _masterKeyHash = keyHash;
+            return _stateService.SetKeyHashAsync(keyHash);
         }
 
-        public async Task<string> GetPasswordHashAsync()
+        public async Task<string> GetMasterKeyHashAsync()
         {
-            if (_passwordHash != null)
+            if (_masterKeyHash != null)
             {
-                return _passwordHash;
+                return _masterKeyHash;
             }
             var passwordHash = await _stateService.GetKeyHashAsync();
             if (passwordHash != null)
             {
-                _passwordHash = passwordHash;
+                _masterKeyHash = passwordHash;
             }
-            return _passwordHash;
+            return _masterKeyHash;
         }
 
-        public async Task ClearPasswordHashAsync(string userId = null)
+        public Task ClearMasterKeyHashAsync(string userId = null)
         {
-            _passwordHash = null;
-            await _stateService.SetKeyHashAsync(null, userId);
+            _masterKeyHash = null;
+            return _stateService.SetKeyHashAsync(null, userId);
         }
 
-        // TODO(Jake): Uses Master Key
-        public async Task<bool> CompareAndUpdatePasswordHashAsync(string masterPassword, MasterKey key)
+        public async Task<bool> CompareAndUpdateKeyHashAsync(string masterPassword, MasterKey key)
         {
-            var storedPasswordHash = await GetPasswordHashAsync();
+            var storedPasswordHash = await GetMasterKeyHashAsync();
             if (masterPassword != null && storedPasswordHash != null)
             {
-                var localPasswordHash = await HashPasswordAsync(masterPassword, key, HashPurpose.LocalAuthorization);
+                var localPasswordHash = await HashMasterKeyAsync(masterPassword, key, HashPurpose.LocalAuthorization);
                 if (localPasswordHash != null && storedPasswordHash == localPasswordHash)
                 {
                     return true;
                 }
 
-                var serverPasswordHash = await HashPasswordAsync(masterPassword, key, HashPurpose.ServerAuthorization);
-                if (serverPasswordHash != null & storedPasswordHash == serverPasswordHash)
+                var serverPasswordHash = await HashMasterKeyAsync(masterPassword, key, HashPurpose.ServerAuthorization);
+                if (serverPasswordHash != null && storedPasswordHash == serverPasswordHash)
                 {
-                    await SetPasswordHashAsync(localPasswordHash);
+                    await SetMasterKeyHashAsync(localPasswordHash);
                     return true;
                 }
             }
@@ -277,11 +291,11 @@ namespace Bit.Core.Services
             return false;
         }
 
-        public async Task SetOrgKeysAsync(IEnumerable<ProfileOrganizationResponse> orgs)
+        public Task SetOrgKeysAsync(IEnumerable<ProfileOrganizationResponse> orgs)
         {
             var orgKeys = orgs.ToDictionary(org => org.Id, org => org.Key);
             _orgKeys = null;
-            await _stateService.SetOrgKeysEncryptedAsync(orgKeys);
+            return _stateService.SetOrgKeysEncryptedAsync(orgKeys);
         }
 
         public async Task<OrgKey> GetOrgKeyAsync(string orgId)
@@ -351,13 +365,13 @@ namespace Bit.Core.Services
             }
         }
 
-        public async Task<byte[]> GetPublicKeyAsync()
+        public async Task<byte[]> GetUserPublicKeyAsync()
         {
             if (_publicKey != null)
             {
                 return _publicKey;
             }
-            var privateKey = await GetPrivateKeyAsync();
+            var privateKey = await GetUserPrivateKeyAsync();
             if (privateKey == null)
             {
                 return null;
@@ -366,7 +380,7 @@ namespace Bit.Core.Services
             return _publicKey;
         }
 
-        public async Task SetPrivateKeyAsync(string encPrivateKey)
+        public async Task SetUserPrivateKeyAsync(string encPrivateKey)
         {
             if (encPrivateKey == null)
             {
@@ -376,7 +390,7 @@ namespace Bit.Core.Services
             _privateKey = null;
         }
 
-        public async Task<byte[]> GetPrivateKeyAsync()
+        public async Task<byte[]> GetUserPrivateKeyAsync()
         {
             if (_privateKey != null)
             {
@@ -395,7 +409,7 @@ namespace Bit.Core.Services
         {
             if (publicKey == null)
             {
-                publicKey = await GetPublicKeyAsync();
+                publicKey = await GetUserPublicKeyAsync();
             }
             if (publicKey == null)
             {
@@ -426,28 +440,29 @@ namespace Bit.Core.Services
         public async Task<PinKey> MakePinKeyAsync(string pin, string salt, KdfConfig config)
         {
             var pinKey = await MakeKeyAsync(pin, salt, config, keyBytes => new PinKey(keyBytes));
-            return await StretchKeyAsync(pinKey) as PinKey;
+            return await StretchKeyAsync(pinKey, keyBytes => new PinKey(keyBytes));
         }
 
-        public async Task ClearPinKeysAsync(string userId = null)
+        public Task ClearPinKeysAsync(string userId = null)
         {
-            await _stateService.SetUserKeyPinAsync(null, userId);
-            await _stateService.SetUserKeyPinEphemeralAsync(null, userId);
-            await _stateService.SetProtectedPinAsync(null, userId);
-            await clearDeprecatedPinKeysAsync(userId);
+            return Task.WhenAll(
+                _stateService.SetPinKeyEncryptedUserKeyAsync(null, userId),
+                _stateService.SetPinKeyEncryptedUserKeyEphemeralAsync(null, userId),
+                _stateService.SetProtectedPinAsync(null, userId),
+                ClearDeprecatedPinKeysAsync(userId));
         }
 
         public async Task<UserKey> DecryptUserKeyWithPinAsync(string pin, string salt, KdfConfig kdfConfig, EncString pinProtectedUserKey = null)
         {
-            pinProtectedUserKey ??= await _stateService.GetUserKeyPinAsync();
-            pinProtectedUserKey ??= await _stateService.GetUserKeyPinEphemeralAsync();
+            pinProtectedUserKey ??= await _stateService.GetPinKeyEncryptedUserKeyAsync();
+            pinProtectedUserKey ??= await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync();
             if (pinProtectedUserKey == null)
             {
                 throw new Exception("No PIN protected user key found.");
             }
             var pinKey = await MakePinKeyAsync(pin, salt, kdfConfig);
-            var userKey = await DecryptToBytesAsync(pinProtectedUserKey, pinKey);
-            return new UserKey(userKey);
+            var userKeyBytes = await DecryptToBytesAsync(pinProtectedUserKey, pinKey);
+            return new UserKey(userKeyBytes);
         }
 
         // Only for migration purposes
@@ -481,7 +496,7 @@ namespace Bit.Core.Services
         {
             if (publicKey == null)
             {
-                publicKey = await GetPublicKeyAsync();
+                publicKey = await GetUserPublicKeyAsync();
             }
             if (publicKey == null)
             {
@@ -521,7 +536,7 @@ namespace Bit.Core.Services
 
             if (privateKey is null)
             {
-                privateKey = await GetPrivateKeyAsync();
+                privateKey = await GetUserPrivateKeyAsync();
             }
 
             if (privateKey == null)
@@ -618,17 +633,17 @@ namespace Bit.Core.Services
             return await AesDecryptToBytesAsync(encType, ctBytes, ivBytes, macBytes, key);
         }
 
-        public async Task<byte[]> DecryptToBytesAsync(EncString encString, SymmetricCryptoKey key = null)
+        public Task<byte[]> DecryptToBytesAsync(EncString encString, SymmetricCryptoKey key = null)
         {
             var iv = Convert.FromBase64String(encString.Iv);
             var data = Convert.FromBase64String(encString.Data);
             var mac = !string.IsNullOrWhiteSpace(encString.Mac) ? Convert.FromBase64String(encString.Mac) : null;
-            return await AesDecryptToBytesAsync(encString.EncryptionType, data, iv, mac, key);
+            return AesDecryptToBytesAsync(encString.EncryptionType, data, iv, mac, key);
         }
 
-        public async Task<string> DecryptToUtf8Async(EncString encString, SymmetricCryptoKey key = null)
+        public Task<string> DecryptToUtf8Async(EncString encString, SymmetricCryptoKey key = null)
         {
-            return await AesDecryptToUtf8Async(encString.EncryptionType, encString.Data,
+            return AesDecryptToUtf8Async(encString.EncryptionType, encString.Data,
                 encString.Iv, encString.Mac, key);
         }
 
@@ -675,7 +690,41 @@ namespace Bit.Core.Services
 
         // --HELPER METHODS--
 
-        private async Task StorePinKey(UserKey userKey, string userId = null)
+        private async Task StoreAdditionalKeysAsync(UserKey userKey, string userId = null)
+        {
+            // Set, refresh, or clear the pin key
+            if (await _stateService.GetProtectedPinAsync(userId) != null)
+            {
+                await UpdatePinKeyAsync(userKey, userId);
+            }
+            else
+            {
+                await _stateService.SetPinKeyEncryptedUserKeyAsync(null, userId);
+                await _stateService.SetPinKeyEncryptedUserKeyEphemeralAsync(null, userId);
+            }
+
+            // Set, refresh, or clear the auto unlock key
+            if (await _stateService.GetVaultTimeoutAsync(userId) == null)
+            {
+                await _stateService.SetUserKeyAutoUnlockAsync(userKey, userId);
+            }
+            else
+            {
+                await _stateService.SetUserKeyAutoUnlockAsync(null, userId);
+            }
+
+            // Set, refresh, or clear the biometric unlock key
+            if ((await _stateService.GetBiometricUnlockAsync(userId)).GetValueOrDefault())
+            {
+                await _stateService.SetUserKeyBiometricUnlockAsync(userKey, userId);
+            }
+            else
+            {
+                await _stateService.SetUserKeyBiometricUnlockAsync(null, userId);
+            }
+        }
+
+        private async Task UpdatePinKeyAsync(UserKey userKey, string userId = null)
         {
             var pin = await DecryptToUtf8Async(new EncString(await _stateService.GetProtectedPinAsync(userId)));
             var pinKey = await MakePinKeyAsync(
@@ -685,13 +734,12 @@ namespace Bit.Core.Services
             );
             var encPin = await EncryptAsync(userKey.Key, pinKey);
 
-            // TODO(Jake): Does this logic make sense? Should we save something in state to indicate the preference?
-            if (await _stateService.GetUserKeyPinAsync(userId) != null)
+            if (await _stateService.GetPinKeyEncryptedUserKeyAsync(userId) != null)
             {
-                await _stateService.SetUserKeyPinAsync(encPin, userId);
+                await _stateService.SetPinKeyEncryptedUserKeyAsync(encPin, userId);
                 return;
             }
-            await _stateService.SetUserKeyPinEphemeralAsync(encPin, userId);
+            await _stateService.SetPinKeyEncryptedUserKeyEphemeralAsync(encPin, userId);
         }
 
         private async Task<EncryptedObject> AesEncryptAsync(byte[] data, SymmetricCryptoKey key)
@@ -821,14 +869,16 @@ namespace Bit.Core.Services
             return key;
         }
 
-        private async Task<SymmetricCryptoKey> StretchKeyAsync(SymmetricCryptoKey key)
+        // TODO: This needs to be moved into SymmetricCryptoKey model to remove the keyCreator hack
+        private async Task<TKey> StretchKeyAsync<TKey>(SymmetricCryptoKey key, Func<byte[], TKey> keyCreator)
+        where TKey : SymmetricCryptoKey
         {
             var newKey = new byte[64];
             var enc = await _cryptoFunctionService.HkdfExpandAsync(key.Key, Encoding.UTF8.GetBytes("enc"), 32, HkdfAlgorithm.Sha256);
             Buffer.BlockCopy(enc, 0, newKey, 0, 32);
             var mac = await _cryptoFunctionService.HkdfExpandAsync(key.Key, Encoding.UTF8.GetBytes("mac"), 32, HkdfAlgorithm.Sha256);
             Buffer.BlockCopy(mac, 0, newKey, 32, 32);
-            return new SymmetricCryptoKey(newKey);
+            return keyCreator(newKey);
         }
 
         private List<string> HashPhrase(byte[] hash, int minimumEntropy = 64)
@@ -855,13 +905,14 @@ namespace Bit.Core.Services
             return phrase;
         }
 
-        private async Task<Tuple<T, EncString>> BuildProtectedSymmetricKey<T>(SymmetricCryptoKey key,
-            byte[] encKey) where T : SymmetricCryptoKey
+        // TODO: This needs to be moved into SymmetricCryptoKey model to remove the keyCreator hack
+        private async Task<Tuple<TKey, EncString>> BuildProtectedSymmetricKeyAsync<TKey>(SymmetricCryptoKey key,
+            byte[] encKey, Func<byte[], TKey> keyCreator) where TKey : SymmetricCryptoKey
         {
             EncString encKeyEnc = null;
             if (key.Key.Length == 32)
             {
-                var newKey = await StretchKeyAsync(key);
+                var newKey = await StretchKeyAsync(key, keyCreator);
                 encKeyEnc = await EncryptAsync(encKey, newKey);
             }
             else if (key.Key.Length == 64)
@@ -872,14 +923,14 @@ namespace Bit.Core.Services
             {
                 throw new Exception("Invalid key size.");
             }
-            return new Tuple<T, EncString>(new SymmetricCryptoKey(encKey) as T, encKeyEnc);
+            return new Tuple<TKey, EncString>(keyCreator(encKey), encKeyEnc);
         }
 
-        // TODO: This intantiator needs to be moved into each key type in order to get rid of the keyCreator hack
+        // TODO: This needs to be moved into SymmetricCryptoKey model to remove the keyCreator hack
         private async Task<TKey> MakeKeyAsync<TKey>(string password, string salt, KdfConfig kdfConfig, Func<byte[], TKey> keyCreator)
         where TKey : SymmetricCryptoKey
         {
-            byte[] key = null;
+            byte[] key;
             if (kdfConfig.Type == null || kdfConfig.Type == KdfType.PBKDF2_SHA256)
             {
                 var iterations = kdfConfig.Iterations.GetValueOrDefault(5000);
@@ -937,6 +988,37 @@ namespace Bit.Core.Services
         // We previously used the master key for additional keys, but now we use the user key.
         // These methods support migrating the old keys to the new ones.
 
+        private async Task MigrateAutoAndBioKeysIfNeededAsync(string userId = null)
+        {
+            var oldKey = await _stateService.GetKeyEncryptedAsync(userId);
+            if (oldKey == null)
+            {
+                return;
+            }
+
+            // Decrypt
+            var masterKey = new MasterKey(Convert.FromBase64String(oldKey));
+            var encryptedUserKey = await _stateService.GetEncKeyEncryptedAsync(userId);
+            var userKey = await DecryptUserKeyWithMasterKeyAsync(
+                masterKey,
+                new EncString(encryptedUserKey),
+                userId);
+
+            // Migrate
+            if (await _stateService.GetVaultTimeoutAsync(userId) == null)
+            {
+                await _stateService.SetUserKeyAutoUnlockAsync(userKey, userId);
+            }
+            if ((await _stateService.GetBiometricUnlockAsync(userId)).GetValueOrDefault())
+            {
+                await _stateService.SetUserKeyBiometricUnlockAsync(userKey, userId);
+            }
+            await _stateService.SetKeyEncryptedAsync(null, userId);
+
+            // Set encrypted user key just in case the user locks without syncing
+            await SetMasterKeyEncryptedUserKeyAsync(encryptedUserKey);
+        }
+
         public async Task<UserKey> DecryptAndMigrateOldPinKeyAsync(
             bool masterPasswordOnRestart,
             string pin,
@@ -964,25 +1046,28 @@ namespace Bit.Core.Services
             if (masterPasswordOnRestart)
             {
                 await _stateService.SetPinProtectedKeyAsync(null);
-                await _stateService.SetUserKeyPinEphemeralAsync(pinProtectedKey);
+                await _stateService.SetPinKeyEncryptedUserKeyEphemeralAsync(pinProtectedKey);
             }
             else
             {
                 await _stateService.SetPinProtectedAsync(null);
-                await _stateService.SetUserKeyPinAsync(pinProtectedKey);
+                await _stateService.SetPinKeyEncryptedUserKeyAsync(pinProtectedKey);
 
                 // We previously only set the protected pin if MP on Restart was enabled
                 // now we set it regardless
                 var encPin = await EncryptAsync(pin, userKey);
                 await _stateService.SetProtectedPinAsync(encPin.EncryptedString);
             }
+            // Clear old key
+            await _stateService.SetEncKeyEncryptedAsync(null);
             return userKey;
         }
 
-        public async Task clearDeprecatedPinKeysAsync(string userId = null)
+        public Task ClearDeprecatedPinKeysAsync(string userId = null)
         {
-            await _stateService.SetPinProtectedAsync(null);
-            await _stateService.SetPinProtectedKeyAsync(null);
+            return Task.WhenAll(
+                _stateService.SetPinProtectedAsync(null, userId),
+                _stateService.SetPinProtectedKeyAsync(null, userId));
         }
     }
 }

src/Core/Services/DeviceTrustCryptoService.cs

@@ -1,129 +0,0 @@
-
-using System;
-using System.Threading.Tasks;
-using Bit.Core.Abstractions;
-using Bit.Core.Models.Domain;
-using Bit.Core.Models.Request;
-
-namespace Bit.Core.Services
-{
-    public class DeviceTrustCryptoService : IDeviceTrustCryptoService
-    {
-        private readonly IApiService _apiService;
-        private readonly IAppIdService _appIdService;
-        private readonly ICryptoFunctionService _cryptoFunctionService;
-        private readonly ICryptoService _cryptoService;
-        private readonly IStateService _stateService;
-
-        private const int DEVICE_KEY_SIZE = 64;
-
-        public DeviceTrustCryptoService(
-            IApiService apiService,
-            IAppIdService appIdService,
-            ICryptoFunctionService cryptoFunctionService,
-            ICryptoService cryptoService,
-            IStateService stateService)
-        {
-            _apiService = apiService;
-            _appIdService = appIdService;
-            _cryptoFunctionService = cryptoFunctionService;
-            _cryptoService = cryptoService;
-            _stateService = stateService;
-        }
-
-        public async Task<SymmetricCryptoKey> GetDeviceKeyAsync()
-        {
-            return await _stateService.GetDeviceKeyAsync();
-        }
-
-        private async Task SetDeviceKeyAsync(SymmetricCryptoKey deviceKey)
-        {
-            await _stateService.SetDeviceKeyAsync(deviceKey);
-        }
-
-        public async Task<DeviceResponse> TrustDeviceAsync()
-        {
-            // Attempt to get user key
-            var userKey = await _cryptoService.GetUserKeyAsync();
-            if (userKey == null)
-            {
-                return null;
-            }
-            // Generate deviceKey
-            var deviceKey = await MakeDeviceKeyAsync();
-
-            // Generate asymmetric RSA key pair: devicePrivateKey, devicePublicKey
-            var (devicePublicKey, devicePrivateKey) = await _cryptoFunctionService.RsaGenerateKeyPairAsync(2048);
-
-            // Send encrypted keys to server
-            var deviceIdentifier = await _appIdService.GetAppIdAsync();
-            var deviceRequest = new TrustedDeviceKeysRequest
-            {
-                EncryptedUserKey = (await _cryptoService.RsaEncryptAsync(userKey.Key, devicePublicKey)).EncryptedString,
-                EncryptedPublicKey = (await _cryptoService.EncryptAsync(devicePublicKey, userKey)).EncryptedString,
-                EncryptedPrivateKey = (await _cryptoService.EncryptAsync(devicePrivateKey, deviceKey)).EncryptedString,
-            };
-
-            var deviceResponse = await _apiService.UpdateTrustedDeviceKeysAsync(deviceIdentifier, deviceRequest);
-
-            // Store device key if successful
-            await SetDeviceKeyAsync(deviceKey);
-            return deviceResponse;
-        }
-
-        private async Task<SymmetricCryptoKey> MakeDeviceKeyAsync()
-        {
-            // Create 512-bit device key
-            var randomBytes = await _cryptoFunctionService.RandomBytesAsync(DEVICE_KEY_SIZE);
-            return new SymmetricCryptoKey(randomBytes);
-        }
-
-        public async Task<bool> GetShouldTrustDeviceAsync()
-        {
-            return await _stateService.GetShouldTrustDeviceAsync();
-        }
-
-        public async Task SetShouldTrustDeviceAsync(bool value)
-        {
-            await _stateService.SetShouldTrustDeviceAsync(value);
-        }
-
-        public async Task<DeviceResponse> TrustDeviceIfNeededAsync()
-        {
-            if (!await GetShouldTrustDeviceAsync())
-            {
-                return null;
-            }
-
-            var response = await TrustDeviceAsync();
-            await SetShouldTrustDeviceAsync(false);
-            return response;
-        }
-
-        public async Task<bool> IsDeviceTrustedAsync()
-        {
-            var existingDeviceKey = await GetDeviceKeyAsync();
-            return existingDeviceKey != null;
-        }
-
-        public async Task<UserKey> DecryptUserKeyWithDeviceKeyAsync(string encryptedDevicePrivateKey, string encryptedUserKey)
-        {
-            var existingDeviceKey = await GetDeviceKeyAsync();
-            if (existingDeviceKey == null)
-            {
-                // User doesn't have a device key anymore so device is untrusted
-                return null;
-            }
-
-            // Attempt to decrypt encryptedDevicePrivateKey with device key
-            var devicePrivateKeyBytes = await _cryptoService.DecryptToBytesAsync(
-              new EncString(encryptedDevicePrivateKey),
-              existingDeviceKey
-            );
-
-            // Attempt to decrypt encryptedUserDataKey with devicePrivateKey
-            var userKeyBytes = await _cryptoService.RsaDecryptAsync(encryptedUserKey, devicePrivateKeyBytes);
-            return new UserKey(userKeyBytes);
-        }
-    }
-}

src/Core/Services/KeyConnectorService.cs

@@ -24,11 +24,11 @@ namespace Bit.Core.Services
             _organizationService = organizationService;
         }
 
-        public async Task GetAndSetKey(string url)
+        public async Task GetAndSetMasterKeyAsync(string url)
         {
             try
             {
-                var masterKeyResponse = await _apiService.GetMasterKeyFromKeyConnector(url);
+                var masterKeyResponse = await _apiService.GetMasterKeyFromKeyConnectorAsync(url);
                 var masterKeyArr = Convert.FromBase64String(masterKeyResponse.Key);
                 var masterKey = new MasterKey(masterKeyArr);
                 await _cryptoService.SetMasterKeyAsync(masterKey);
@@ -39,17 +39,17 @@ namespace Bit.Core.Services
             }
         }
 
-        public async Task SetUsesKeyConnector(bool usesKeyConnector)
+        public async Task SetUsesKeyConnectorAsync(bool usesKeyConnector)
         {
             await _stateService.SetUsesKeyConnectorAsync(usesKeyConnector);
         }
 
-        public async Task<bool> GetUsesKeyConnector()
+        public async Task<bool> GetUsesKeyConnectorAsync()
         {
             return await _stateService.GetUsesKeyConnectorAsync();
         }
 
-        public async Task<Organization> GetManagingOrganization()
+        public async Task<Organization> GetManagingOrganizationAsync()
         {
             var orgs = await _organizationService.GetAllAsync();
             return orgs.Find(o =>
@@ -57,9 +57,9 @@ namespace Bit.Core.Services
                 !o.IsAdmin);
         }
 
-        public async Task MigrateUser()
+        public async Task MigrateUserAsync()
         {
-            var organization = await GetManagingOrganization();
+            var organization = await GetManagingOrganizationAsync();
             var masterKey = await _cryptoService.GetMasterKeyAsync();
 
             try
@@ -75,11 +75,11 @@ namespace Bit.Core.Services
             await _apiService.PostConvertToKeyConnector();
         }
 
-        public async Task<bool> UserNeedsMigration()
+        public async Task<bool> UserNeedsMigrationAsync()
         {
             var loggedInUsingSso = await _tokenService.GetIsExternal();
-            var requiredByOrganization = await GetManagingOrganization() != null;
-            var userIsNotUsingKeyConnector = !await GetUsesKeyConnector();
+            var requiredByOrganization = await GetManagingOrganizationAsync() != null;
+            var userIsNotUsingKeyConnector = !await GetUsesKeyConnectorAsync();
 
             return loggedInUsingSso && requiredByOrganization && userIsNotUsingKeyConnector;
         }

src/Core/Services/StateService.cs

@@ -241,6 +241,19 @@ namespace Bit.Core.Services
             ))?.Settings?.EnvironmentUrls;
         }
 
+        public async Task<UserKey> GetUserKeyBiometricUnlockAsync(string userId = null)
+        {
+            var keyB64 = await _storageMediatorService.GetAsync<string>(
+                await ComposeKeyAsync(Constants.UserKeyBiometricUnlockKey, userId), true);
+            return keyB64 == null ? null : new UserKey(Convert.FromBase64String(keyB64));
+        }
+
+        public async Task SetUserKeyBiometricUnlockAsync(UserKey value, string userId = null)
+        {
+            await _storageMediatorService.SaveAsync(
+                await ComposeKeyAsync(Constants.UserKeyBiometricUnlockKey, userId), value?.KeyB64, true);
+        }
+
         public async Task<bool?> GetBiometricUnlockAsync(string userId = null)
         {
             var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
@@ -334,18 +347,29 @@ namespace Bit.Core.Services
             await SaveAccountAsync(account, reconciledOptions);
         }
 
-        public async Task<string> GetUserKeyMasterKeyAsync(string userId = null)
+        public async Task<string> GetMasterKeyEncryptedUserKeyAsync(string userId = null)
         {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultInMemoryOptionsAsync());
-            return await _storageMediatorService.GetAsync<string>(Constants.UserKeyKey(reconciledOptions.UserId), false);
+            return await _storageMediatorService.GetAsync<string>(
+                await ComposeKeyAsync(Constants.MasterKeyEncryptedUserKeyKey, userId), false);
         }
 
-        public async Task SetUserKeyMasterKeyAsync(string value, string userId = null)
+        public async Task SetMasterKeyEncryptedUserKeyAsync(string value, string userId = null)
         {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultInMemoryOptionsAsync());
-            await _storageMediatorService.SaveAsync(Constants.UserKeyKey(reconciledOptions.UserId), value, false);
+            await _storageMediatorService.SaveAsync(
+                await ComposeKeyAsync(Constants.MasterKeyEncryptedUserKeyKey, userId), value, false);
+        }
+
+        public async Task<UserKey> GetUserKeyAutoUnlockAsync(string userId = null)
+        {
+            var keyB64 = await _storageMediatorService.GetAsync<string>(
+                await ComposeKeyAsync(Constants.UserKeyAutoUnlockKey, userId), true);
+            return keyB64 == null ? null : new UserKey(Convert.FromBase64String(keyB64));
+        }
+
+        public async Task SetUserKeyAutoUnlockAsync(UserKey value, string userId = null)
+        {
+            await _storageMediatorService.SaveAsync(
+                await ComposeKeyAsync(Constants.UserKeyAutoUnlockKey, userId), value?.KeyB64, true);
         }
 
         public async Task<bool> CanAccessPremiumAsync(string userId = null)
@@ -354,6 +378,7 @@ namespace Bit.Core.Services
             {
                 userId = await GetActiveUserIdAsync();
             }
+
             if (!await IsAuthenticatedAsync(userId))
             {
                 return false;
@@ -399,66 +424,35 @@ namespace Bit.Core.Services
             await SetValueAsync(Constants.ProtectedPinKey(reconciledOptions.UserId), value, reconciledOptions);
         }
 
-        public async Task<EncString> GetUserKeyPinAsync(string userId = null)
+        public async Task<EncString> GetPinKeyEncryptedUserKeyAsync(string userId = null)
         {
-            var key = await _storageMediatorService.GetAsync<string>(Constants.UserKeyPinKey(userId), false);
+            var key = await _storageMediatorService.GetAsync<string>(
+                await ComposeKeyAsync(Constants.PinKeyEncryptedUserKeyKey, userId), false);
             return key != null ? new EncString(key) : null;
         }
 
-        public async Task SetUserKeyPinAsync(EncString value, string userId = null)
+        public async Task SetPinKeyEncryptedUserKeyAsync(EncString value, string userId = null)
         {
-            await _storageMediatorService.SaveAsync(Constants.UserKeyPinKey(userId), value?.EncryptedString, false);
+            await _storageMediatorService.SaveAsync(
+                await ComposeKeyAsync(Constants.PinKeyEncryptedUserKeyKey, userId), value?.EncryptedString, false);
         }
 
-        public async Task<EncString> GetUserKeyPinEphemeralAsync(string userId = null)
+        public async Task<EncString> GetPinKeyEncryptedUserKeyEphemeralAsync(string userId = null)
         {
             return (await GetAccountAsync(
                 ReconcileOptions(new StorageOptions { UserId = userId }, await GetDefaultInMemoryOptionsAsync())
-            ))?.VolatileData?.UserKeyPinEphemeral;
+            ))?.VolatileData?.PinKeyEncryptedUserKeyEphemeral;
         }
 
-        public async Task SetUserKeyPinEphemeralAsync(EncString value, string userId = null)
+        public async Task SetPinKeyEncryptedUserKeyEphemeralAsync(EncString value, string userId = null)
         {
             var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
                 await GetDefaultInMemoryOptionsAsync());
             var account = await GetAccountAsync(reconciledOptions);
-            account.VolatileData.UserKeyPinEphemeral = value;
+            account.VolatileData.PinKeyEncryptedUserKeyEphemeral = value;
             await SaveAccountAsync(account, reconciledOptions);
         }
 
-        [Obsolete("Use GetUserKeyPinAsync instead, left for migration purposes")]
-        public async Task<string> GetPinProtectedAsync(string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            return await GetValueAsync<string>(Constants.PinProtectedKey(reconciledOptions.UserId), reconciledOptions);
-        }
-
-        [Obsolete("Use SetUserKeyPinAsync instead")]
-        public async Task SetPinProtectedAsync(string value, string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            await SetValueAsync(Constants.PinProtectedKey(reconciledOptions.UserId), value, reconciledOptions);
-        }
-
-        [Obsolete("Use GetUserKeyPinEphemeralAsync instead, left for migration purposes")]
-        public async Task<EncString> GetPinProtectedKeyAsync(string userId = null)
-        {
-            return (await GetAccountAsync(
-                ReconcileOptions(new StorageOptions { UserId = userId }, await GetDefaultInMemoryOptionsAsync())
-            ))?.VolatileData?.PinProtectedKey;
-        }
-
-        [Obsolete("Use SetUserKeyPinEphemeralAsync instead")]
-        public async Task SetPinProtectedKeyAsync(EncString value, string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultInMemoryOptionsAsync());
-            var account = await GetAccountAsync(reconciledOptions);
-            account.VolatileData.PinProtectedKey = value;
-            await SaveAccountAsync(account, reconciledOptions);
-        }
 
         public async Task SetKdfConfigurationAsync(KdfConfig config, string userId = null)
         {
@@ -517,25 +511,6 @@ namespace Bit.Core.Services
             await SetValueAsync(Constants.EncPrivateKeyKey(reconciledOptions.UserId), value, reconciledOptions);
         }
 
-        public async Task<SymmetricCryptoKey> GetDeviceKeyAsync(string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            var deviceKeyB64 = await _storageMediatorService.GetAsync<string>(Constants.DeviceKeyKey(reconciledOptions.UserId), true);
-            if (string.IsNullOrEmpty(deviceKeyB64))
-            {
-                return null;
-            }
-            return new SymmetricCryptoKey(Convert.FromBase64String(deviceKeyB64));
-        }
-
-        public async Task SetDeviceKeyAsync(SymmetricCryptoKey value, string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            await _storageMediatorService.SaveAsync(Constants.DeviceKeyKey(reconciledOptions.UserId), value.KeyB64, true);
-        }
-
         public async Task<List<string>> GetAutofillBlacklistedUrisAsync(string userId = null)
         {
             var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
@@ -1334,37 +1309,6 @@ namespace Bit.Core.Services
             await SetValueAsync(Constants.PreLoginEmailKey, value, options);
         }
 
-        public async Task<AccountDecryptionOptions> GetAccountDecryptionOptions(string userId = null)
-        {
-            return (await GetAccountAsync(
-                ReconcileOptions(new StorageOptions { UserId = userId }, await GetDefaultStorageOptionsAsync())
-            ))?.Profile?.UserDecryptionOptions;
-        }
-
-        public async Task<bool> GetShouldTrustDeviceAsync()
-        {
-            return await _storageMediatorService.GetAsync<bool>(Constants.ShouldTrustDevice);
-        }
-
-        public async Task SetShouldTrustDeviceAsync(bool value)
-        {
-            await _storageMediatorService.SaveAsync(Constants.ShouldTrustDevice, value);
-        }
-
-        public async Task<PendingAdminAuthRequest> GetPendingAdminAuthRequestAsync(string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            return await _storageMediatorService.GetAsync<PendingAdminAuthRequest>(Constants.PendingAdminAuthRequest(reconciledOptions.UserId), true);
-        }
-
-        public async Task SetPendingAdminAuthRequestAsync(PendingAdminAuthRequest value, string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultStorageOptionsAsync());
-            await _storageMediatorService.SaveAsync(Constants.PendingAdminAuthRequest(reconciledOptions.UserId), value, true);
-        }
-
         public ConfigResponse GetConfigs()
         {
             return _storageMediatorService.Get<ConfigResponse>(Constants.ConfigsKey);
@@ -1532,28 +1476,31 @@ namespace Bit.Core.Services
             }
 
             // Non-state storage
-            await SetProtectedPinAsync(null, userId);
-            await SetPinProtectedAsync(null, userId);
-            await SetKeyEncryptedAsync(null, userId);
-            await SetKeyHashAsync(null, userId);
-            await SetEncKeyEncryptedAsync(null, userId);
-            await SetOrgKeysEncryptedAsync(null, userId);
-            await SetPrivateKeyEncryptedAsync(null, userId);
-            await SetLastActiveTimeAsync(null, userId);
-            await SetPreviousPageInfoAsync(null, userId);
-            await SetInvalidUnlockAttemptsAsync(null, userId);
-            await SetLocalDataAsync(null, userId);
-            await SetEncryptedCiphersAsync(null, userId);
-            await SetEncryptedCollectionsAsync(null, userId);
-            await SetLastSyncAsync(null, userId);
-            await SetEncryptedFoldersAsync(null, userId);
-            await SetEncryptedPoliciesAsync(null, userId);
-            await SetUsesKeyConnectorAsync(null, userId);
-            await SetOrganizationsAsync(null, userId);
-            await SetEncryptedPasswordGenerationHistoryAsync(null, userId);
-            await SetEncryptedSendsAsync(null, userId);
-            await SetSettingsAsync(null, userId);
-            await SetApprovePasswordlessLoginsAsync(null, userId);
+            await Task.WhenAll(
+                SetUserKeyAutoUnlockAsync(null, userId),
+                SetUserKeyBiometricUnlockAsync(null, userId),
+                SetProtectedPinAsync(null, userId),
+                SetKeyHashAsync(null, userId),
+                SetOrgKeysEncryptedAsync(null, userId),
+                SetPrivateKeyEncryptedAsync(null, userId),
+                SetLastActiveTimeAsync(null, userId),
+                SetPreviousPageInfoAsync(null, userId),
+                SetInvalidUnlockAttemptsAsync(null, userId),
+                SetLocalDataAsync(null, userId),
+                SetEncryptedCiphersAsync(null, userId),
+                SetEncryptedCollectionsAsync(null, userId),
+                SetLastSyncAsync(null, userId),
+                SetEncryptedFoldersAsync(null, userId),
+                SetEncryptedPoliciesAsync(null, userId),
+                SetUsesKeyConnectorAsync(null, userId),
+                SetOrganizationsAsync(null, userId),
+                SetEncryptedPasswordGenerationHistoryAsync(null, userId),
+                SetEncryptedSendsAsync(null, userId),
+                SetSettingsAsync(null, userId),
+                SetApprovePasswordlessLoginsAsync(null, userId),
+                SetEncKeyEncryptedAsync(null, userId),
+                SetKeyEncryptedAsync(null, userId),
+                SetPinProtectedAsync(null, userId));
         }
 
         private async Task ScaffoldNewAccountAsync(Account account)
@@ -1742,7 +1689,41 @@ namespace Bit.Core.Services
                 shouldConnect ?? await GetShouldConnectToWatchAsync(), await GetDefaultStorageOptionsAsync());
         }
 
-        [Obsolete]
+        [Obsolete("Use GetPinKeyEncryptedUserKeyAsync instead, left for migration purposes")]
+        public async Task<string> GetPinProtectedAsync(string userId = null)
+        {
+            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
+                await GetDefaultStorageOptionsAsync());
+            return await GetValueAsync<string>(Constants.PinProtectedKey(reconciledOptions.UserId), reconciledOptions);
+        }
+
+        [Obsolete("Use SetPinKeyEncryptedUserKeyAsync instead")]
+        public async Task SetPinProtectedAsync(string value, string userId = null)
+        {
+            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
+                await GetDefaultStorageOptionsAsync());
+            await SetValueAsync(Constants.PinProtectedKey(reconciledOptions.UserId), value, reconciledOptions);
+        }
+
+        [Obsolete("Use GetPinKeyEncryptedUserKeyEphemeralAsync instead, left for migration purposes")]
+        public async Task<EncString> GetPinProtectedKeyAsync(string userId = null)
+        {
+            return (await GetAccountAsync(
+                ReconcileOptions(new StorageOptions { UserId = userId }, await GetDefaultInMemoryOptionsAsync())
+            ))?.VolatileData?.PinProtectedKey;
+        }
+
+        [Obsolete("Use SetPinKeyEncryptedUserKeyEphemeralAsync instead")]
+        public async Task SetPinProtectedKeyAsync(EncString value, string userId = null)
+        {
+            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
+                await GetDefaultInMemoryOptionsAsync());
+            var account = await GetAccountAsync(reconciledOptions);
+            account.VolatileData.PinProtectedKey = value;
+            await SaveAccountAsync(account, reconciledOptions);
+        }
+
+        [Obsolete("Use GetMasterKeyEncryptedUserKeyAsync instead, left for migration purposes")]
         public async Task<string> GetEncKeyEncryptedAsync(string userId = null)
         {
             var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
@@ -1750,7 +1731,7 @@ namespace Bit.Core.Services
             return await GetValueAsync<string>(Constants.EncKeyKey(reconciledOptions.UserId), reconciledOptions);
         }
 
-        [Obsolete]
+        [Obsolete("Use SetMasterKeyEncryptedUserKeyAsync instead, left for migration purposes")]
         public async Task SetEncKeyEncryptedAsync(string value, string userId)
         {
             var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
@@ -1758,15 +1739,7 @@ namespace Bit.Core.Services
             await SetValueAsync(Constants.EncKeyKey(reconciledOptions.UserId), value, reconciledOptions);
         }
 
-        [Obsolete]
-        public async Task<string> GetKeyEncryptedAsync(string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultSecureStorageOptionsAsync());
-            return await GetValueAsync<string>(Constants.KeyKey(reconciledOptions.UserId), reconciledOptions);
-        }
-
-        [Obsolete]
+        [Obsolete("Left for migration purposes")]
         public async Task SetKeyEncryptedAsync(string value, string userId)
         {
             var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
@@ -1774,22 +1747,20 @@ namespace Bit.Core.Services
             await SetValueAsync(Constants.KeyKey(reconciledOptions.UserId), value, reconciledOptions);
         }
 
-        [Obsolete]
+        [Obsolete("Use GetUserKeyAutoUnlock instead, left for migration purposes")]
+        public async Task<string> GetKeyEncryptedAsync(string userId = null)
+        {
+            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
+                await GetDefaultSecureStorageOptionsAsync());
+            return await GetValueAsync<string>(Constants.KeyKey(reconciledOptions.UserId), reconciledOptions);
+        }
+
+        [Obsolete("Use GetMasterKeyAsync instead, left for migration purposes")]
         public async Task<SymmetricCryptoKey> GetKeyDecryptedAsync(string userId = null)
         {
             return (await GetAccountAsync(
                 ReconcileOptions(new StorageOptions { UserId = userId }, await GetDefaultInMemoryOptionsAsync())
             ))?.VolatileData?.Key;
         }
-
-        [Obsolete]
-        public async Task SetKeyDecryptedAsync(SymmetricCryptoKey value, string userId = null)
-        {
-            var reconciledOptions = ReconcileOptions(new StorageOptions { UserId = userId },
-                await GetDefaultInMemoryOptionsAsync());
-            var account = await GetAccountAsync(reconciledOptions);
-            account.VolatileData.Key = value;
-            await SaveAccountAsync(account, reconciledOptions);
-        }
     }
 }

src/Core/Services/SyncService.cs

@@ -328,7 +328,7 @@ namespace Bit.Core.Services
                 return;
             }
             await _cryptoService.SetMasterKeyEncryptedUserKeyAsync(response.Key);
-            await _cryptoService.SetPrivateKeyAsync(response.PrivateKey);
+            await _cryptoService.SetUserPrivateKeyAsync(response.PrivateKey);
             await _cryptoService.SetOrgKeysAsync(response.Organizations);
             await _stateService.SetSecurityStampAsync(response.SecurityStamp);
             var organizations = response.Organizations.ToDictionary(o => o.Id, o => new OrganizationData(o));
@@ -337,7 +337,7 @@ namespace Bit.Core.Services
             await _stateService.SetNameAsync(response.Name);
             await _stateService.SetPersonalPremiumAsync(response.Premium);
             await _stateService.SetAvatarColorAsync(response.AvatarColor);
-            await _keyConnectorService.SetUsesKeyConnector(response.UsesKeyConnector);
+            await _keyConnectorService.SetUsesKeyConnectorAsync(response.UsesKeyConnector);
         }
 
         private async Task SyncFoldersAsync(string userId, List<FolderResponse> response)

src/Core/Services/UserVerificationService.cs

@@ -44,7 +44,7 @@ namespace Bit.Core.Services
             }
             else
             {
-                var passwordValid = await _cryptoService.CompareAndUpdatePasswordHashAsync(secret, null);
+                var passwordValid = await _cryptoService.CompareAndUpdateKeyHashAsync(secret, null);
                 if (!passwordValid)
                 {
                     await InvalidSecretErrorAsync(verificationType);

src/Core/Services/VaultTimeoutService.cs

@@ -1,13 +1,11 @@
 using System;
-using System.Linq;
 using System.Threading.Tasks;
 using Bit.Core.Abstractions;
 using Bit.Core.Enums;
-using Bit.Core.Models.Domain;
 
 namespace Bit.Core.Services
 {
-    public enum PinLockEnum
+    public enum PinLockType
     {
         Disabled,
         Persistent,
@@ -61,15 +59,26 @@ namespace Bit.Core.Services
 
         public async Task<bool> IsLockedAsync(string userId = null)
         {
-            var hasKey = await _cryptoService.HasUserKeyAsync(userId);
-            if (hasKey)
+            var biometricSet = await IsBiometricLockSetAsync(userId);
+            if (biometricSet && await _stateService.GetBiometricLockedAsync(userId))
             {
-                var biometricSet = await IsBiometricLockSetAsync(userId);
-                if (biometricSet && await _stateService.GetBiometricLockedAsync(userId))
+                return true;
+            }
+
+            if (!await _cryptoService.HasUserKeyAsync(userId))
+            {
+                if (await _cryptoService.HasAutoUnlockKeyAsync(userId))
+                {
+                    await _cryptoService.SetUserKeyAsync(await _cryptoService.GetAutoUnlockKeyAsync(userId));
+                }
+                else
                 {
                     return true;
                 }
             }
+
+            // Check again to verify auto key was set
+            var hasKey = await _cryptoService.HasUserKeyAsync(userId);
             return !hasKey;
         }
 
@@ -170,13 +179,13 @@ namespace Bit.Core.Services
                 userId = await _stateService.GetActiveUserIdAsync();
             }
 
-            if (await _keyConnectorService.GetUsesKeyConnector())
+            if (await _keyConnectorService.GetUsesKeyConnectorAsync())
             {
-                var pinStatus = await IsPinLockSetAsync(userId);
-                var ephemeralPinSet = await _stateService.GetUserKeyPinEphemeralAsync()
+                var pinStatus = await GetPinLockTypeAsync(userId);
+                var ephemeralPinSet = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync()
                     ?? await _stateService.GetPinProtectedKeyAsync();
-                var pinEnabled = (pinStatus == PinLockEnum.Transient && ephemeralPinSet != null) ||
-                          pinStatus == PinLockEnum.Persistent;
+                var pinEnabled = (pinStatus == PinLockType.Transient && ephemeralPinSet != null) ||
+                          pinStatus == PinLockType.Persistent;
 
                 if (!pinEnabled && !await IsBiometricLockSetAsync())
                 {
@@ -198,6 +207,7 @@ namespace Bit.Core.Services
             await Task.WhenAll(
                 _cryptoService.ClearUserKeyAsync(userId),
                 _cryptoService.ClearMasterKeyAsync(userId),
+                _stateService.SetUserKeyAutoUnlockAsync(null, userId),
                 _cryptoService.ClearOrgKeysAsync(true, userId),
                 _cryptoService.ClearKeyPairAsync(true, userId));
 
@@ -223,30 +233,27 @@ namespace Bit.Core.Services
         {
             await _stateService.SetVaultTimeoutAsync(timeout);
             await _stateService.SetVaultTimeoutActionAsync(action);
-            await _cryptoService.ToggleKeysAsync();
+            await _cryptoService.RefreshKeysAsync();
             await _tokenService.ToggleTokensAsync();
         }
 
-        public async Task<PinLockEnum> IsPinLockSetAsync(string userId = null)
+        public async Task<PinLockType> GetPinLockTypeAsync(string userId = null)
         {
             // we can't depend on only the protected pin being set because old
             // versions only used it for MP on Restart
-            var pinIsEnabled = await _stateService.GetProtectedPinAsync(userId);
-            var userKeyPin = await _stateService.GetUserKeyPinAsync(userId);
-            var oldUserKeyPin = await _stateService.GetPinProtectedAsync(userId);
+            var isPinEnabled = await _stateService.GetProtectedPinAsync(userId) != null;
+            var hasUserKeyPin = await _stateService.GetPinKeyEncryptedUserKeyAsync(userId) != null;
+            var hasOldUserKeyPin = await _stateService.GetPinProtectedAsync(userId) != null;
 
-            if (userKeyPin != null || oldUserKeyPin != null)
+            if (hasUserKeyPin || hasOldUserKeyPin)
             {
-                return PinLockEnum.Persistent;
+                return PinLockType.Persistent;
             }
-            else if (pinIsEnabled != null && userKeyPin == null && oldUserKeyPin == null)
+            else if (isPinEnabled && !hasUserKeyPin && !hasOldUserKeyPin)
             {
-                return PinLockEnum.Transient;
-            }
-            else
-            {
-                return PinLockEnum.Disabled;
+                return PinLockType.Transient;
             }
+            return PinLockType.Disabled;
         }
 
         public async Task<bool> IsBiometricLockSetAsync(string userId = null)

src/Core/Utilities/ServiceContainer.cs

@@ -77,10 +77,9 @@ namespace Bit.Core.Utilities
                 });
             var passwordGenerationService = new PasswordGenerationService(cryptoService, stateService, cryptoFunctionService, policyService);
             var totpService = new TotpService(cryptoFunctionService);
-            var deviceTrustCryptoService = new DeviceTrustCryptoService(apiService, appIdService, cryptoFunctionService, cryptoService, stateService);
             var authService = new AuthService(cryptoService, cryptoFunctionService, apiService, stateService,
-                tokenService, appIdService, i18nService, platformUtilsService, messagingService, vaultTimeoutService,
-                keyConnectorService, passwordGenerationService, policyService, deviceTrustCryptoService);
+                tokenService, appIdService, i18nService, platformUtilsService, messagingService,
+                passwordGenerationService, policyService);
             var exportService = new ExportService(folderService, cipherService, cryptoService);
             var auditService = new AuditService(cryptoFunctionService, apiService);
             var environmentService = new EnvironmentService(apiService, stateService, conditionedRunner);
@@ -115,7 +114,6 @@ namespace Bit.Core.Utilities
             Register<IUserVerificationService>("userVerificationService", userVerificationService);
             Register<IUsernameGenerationService>(usernameGenerationService);
             Register<IConfigService>(configService);
-            Register<IDeviceTrustCryptoService>(deviceTrustCryptoService);
         }
 
         public static void Register<T>(string serviceName, T obj)

src/iOS.Autofill/CredentialProviderViewController.cs

@@ -498,7 +498,7 @@ namespace Bit.iOS.Autofill
                 vm.StartTwoFactorAction = () => DismissViewController(false, () => LaunchTwoFactorFlow(false));
                 vm.UpdateTempPasswordAction = () => DismissViewController(false, () => LaunchUpdateTempPasswordFlow());
                 vm.StartSsoLoginAction = () => DismissViewController(false, () => LaunchLoginSsoFlow());
-                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AuthenticateAndUnlock, email));
+                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(email));
                 vm.LogInSuccessAction = () => DismissLockAndContinue();
                 vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
             }
@@ -511,11 +511,11 @@ namespace Bit.iOS.Autofill
             LogoutIfAuthed();
         }
 
-        private void LaunchLoginWithDevice(AuthRequestType authRequestType, string email = null)
+        private void LaunchLoginWithDevice(string email = null)
         {
             var appOptions = new AppOptions { IosExtension = true };
             var app = new App.App(appOptions);
-            var loginWithDevicePage = new LoginPasswordlessRequestPage(email, authRequestType, appOptions);
+            var loginWithDevicePage = new LoginPasswordlessRequestPage(email, appOptions);
             ThemeManager.SetTheme(app.Resources);
             ThemeManager.ApplyResourcesTo(loginWithDevicePage);
             if (loginWithDevicePage.BindingContext is LoginPasswordlessRequestViewModel vm)
@@ -545,7 +545,6 @@ namespace Bit.iOS.Autofill
                 vm.StartTwoFactorAction = () => DismissViewController(false, () => LaunchTwoFactorFlow(true));
                 vm.StartSetPasswordAction = () => DismissViewController(false, () => LaunchSetPasswordFlow());
                 vm.UpdateTempPasswordAction = () => DismissViewController(false, () => LaunchUpdateTempPasswordFlow());
-                vm.StartDeviceApprovalOptionsAction = () => DismissViewController(false, () => LaunchDeviceApprovalOptionsFlow());
                 vm.SsoAuthSuccessAction = () => DismissLockAndContinue();
                 vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
             }
@@ -568,7 +567,6 @@ namespace Bit.iOS.Autofill
             {
                 vm.TwoFactorAuthSuccessAction = () => DismissLockAndContinue();
                 vm.StartSetPasswordAction = () => DismissViewController(false, () => LaunchSetPasswordFlow());
-                vm.StartDeviceApprovalOptionsAction = () => DismissViewController(false, () => LaunchDeviceApprovalOptionsFlow());
                 if (authingWithSso)
                 {
                     vm.CloseAction = () => DismissViewController(false, () => LaunchLoginSsoFlow());
@@ -623,26 +621,6 @@ namespace Bit.iOS.Autofill
             PresentViewController(updateTempPasswordController, true, null);
         }
 
-        private void LaunchDeviceApprovalOptionsFlow()
-        {
-            var loginApproveDevicePage = new LoginApproveDevicePage();
-            var app = new App.App(new AppOptions { IosExtension = true });
-            ThemeManager.SetTheme(app.Resources);
-            ThemeManager.ApplyResourcesTo(loginApproveDevicePage);
-            if (loginApproveDevicePage.BindingContext is LoginApproveDeviceViewModel vm)
-            {
-                vm.LogInWithMasterPasswordAction = () => DismissViewController(false, () => PerformSegue("lockPasswordSegue", this));
-                vm.RequestAdminApprovalAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AdminApproval, vm.Email));
-                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AuthenticateAndUnlock, vm.Email));
-                vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
-            }
-
-            var navigationPage = new NavigationPage(loginApproveDevicePage);
-            var loginApproveDeviceController = navigationPage.CreateViewController();
-            loginApproveDeviceController.ModalPresentationStyle = UIModalPresentationStyle.FullScreen;
-            PresentViewController(loginApproveDeviceController, true, null);
-        }
-
         public Task SetPreviousPageInfoAsync() => Task.CompletedTask;
         public Task UpdateThemeAsync() => Task.CompletedTask;
 

src/iOS.Core/Controllers/BaseLockPasswordViewController.cs

@@ -30,7 +30,7 @@ namespace Bit.iOS.Core.Controllers
         private IBiometricService _biometricService;
         private IKeyConnectorService _keyConnectorService;
         private IAccountsManager _accountManager;
-        private PinLockEnum _pinStatus;
+        private PinLockType _pinStatus;
         private bool _pinEnabled;
         private bool _biometricEnabled;
         private bool _biometricIntegrityValid = true;
@@ -104,24 +104,24 @@ namespace Bit.iOS.Core.Controllers
             if (autofillExtension && await _stateService.GetPasswordRepromptAutofillAsync())
             {
                 _passwordReprompt = true;
-                _pinStatus = PinLockEnum.Disabled;
+                _pinStatus = PinLockType.Disabled;
                 _pinEnabled = false;
                 _biometricEnabled = false;
             }
             else
             {
-                _pinStatus = await _vaultTimeoutService.IsPinLockSetAsync();
+                _pinStatus = await _vaultTimeoutService.GetPinLockTypeAsync();
 
-                var ephemeralPinSet = await _stateService.GetUserKeyPinEphemeralAsync()
+                var ephemeralPinSet = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync()
                     ?? await _stateService.GetPinProtectedKeyAsync();
-                _pinEnabled = (_pinStatus == PinLockEnum.Transient && ephemeralPinSet != null) ||
-                    _pinStatus == PinLockEnum.Persistent;
+                _pinEnabled = (_pinStatus == PinLockType.Transient && ephemeralPinSet != null) ||
+                    _pinStatus == PinLockType.Persistent;
 
                 _biometricEnabled = await _vaultTimeoutService.IsBiometricLockSetAsync()
                     && await _cryptoService.HasEncryptedUserKeyAsync();
                 _biometricIntegrityValid =
                     await _platformUtilsService.IsBiometricIntegrityValidAsync(BiometricIntegritySourceKey);
-                _usesKeyConnector = await _keyConnectorService.GetUsesKeyConnector();
+                _usesKeyConnector = await _keyConnectorService.GetUsesKeyConnectorAsync();
                 _biometricUnlockOnly = _usesKeyConnector && _biometricEnabled && !_pinEnabled;
             }
 
@@ -257,15 +257,15 @@ namespace Bit.iOS.Core.Controllers
                     {
                         EncString userKeyPin = null;
                         EncString oldPinProtected = null;
-                        if (_pinStatus == PinLockEnum.Persistent)
+                        if (_pinStatus == PinLockType.Persistent)
                         {
-                            userKeyPin = await _stateService.GetUserKeyPinAsync();
+                            userKeyPin = await _stateService.GetPinKeyEncryptedUserKeyAsync();
                             var oldEncryptedKey = await _stateService.GetPinProtectedAsync();
                             oldPinProtected = oldEncryptedKey != null ? new EncString(oldEncryptedKey) : null;
                         }
-                        else if (_pinStatus == PinLockEnum.Transient)
+                        else if (_pinStatus == PinLockType.Transient)
                         {
-                            userKeyPin = await _stateService.GetUserKeyPinEphemeralAsync();
+                            userKeyPin = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync();
                             oldPinProtected = await _stateService.GetPinProtectedKeyAsync();
                         }
 
@@ -273,7 +273,7 @@ namespace Bit.iOS.Core.Controllers
                         if (oldPinProtected != null)
                         {
                             userKey = await _cryptoService.DecryptAndMigrateOldPinKeyAsync(
-                                _pinStatus == PinLockEnum.Transient,
+                                _pinStatus == PinLockType.Transient,
                                 inputtedValue,
                                 email,
                                 kdfConfig,
@@ -312,18 +312,18 @@ namespace Bit.iOS.Core.Controllers
                 {
                     var masterKey = await _cryptoService.MakeMasterKeyAsync(inputtedValue, email, kdfConfig);
 
-                    var storedPasswordHash = await _cryptoService.GetPasswordHashAsync();
+                    var storedPasswordHash = await _cryptoService.GetMasterKeyHashAsync();
                     if (storedPasswordHash == null)
                     {
                         var oldKey = await _secureStorageService.GetAsync<string>("oldKey");
                         if (masterKey.KeyB64 == oldKey)
                         {
-                            var localPasswordHash = await _cryptoService.HashPasswordAsync(inputtedValue, masterKey, HashPurpose.LocalAuthorization);
+                            var localPasswordHash = await _cryptoService.HashMasterKeyAsync(inputtedValue, masterKey, HashPurpose.LocalAuthorization);
                             await _secureStorageService.RemoveAsync("oldKey");
-                            await _cryptoService.SetPasswordHashAsync(localPasswordHash);
+                            await _cryptoService.SetMasterKeyHashAsync(localPasswordHash);
                         }
                     }
-                    var passwordValid = await _cryptoService.CompareAndUpdatePasswordHashAsync(inputtedValue, masterKey);
+                    var passwordValid = await _cryptoService.CompareAndUpdateKeyHashAsync(inputtedValue, masterKey);
                     if (passwordValid)
                     {
                         await AppHelpers.ResetInvalidUnlockAttemptsAsync();

src/iOS.Core/Controllers/LockPasswordViewController.cs

@@ -1,20 +1,20 @@
 using System;
-using UIKit;
-using Foundation;
-using Bit.iOS.Core.Views;
-using Bit.App.Resources;
-using Bit.iOS.Core.Utilities;
-using Bit.App.Abstractions;
-using Bit.Core.Abstractions;
-using Bit.Core.Utilities;
 using System.Threading.Tasks;
-using Bit.App.Utilities;
-using Bit.Core.Models.Domain;
-using Bit.Core.Enums;
-using Bit.App.Pages;
+using Bit.App.Abstractions;
 using Bit.App.Models;
-using Xamarin.Forms;
+using Bit.App.Pages;
+using Bit.App.Resources;
+using Bit.App.Utilities;
+using Bit.Core.Abstractions;
+using Bit.Core.Enums;
+using Bit.Core.Models.Domain;
 using Bit.Core.Services;
+using Bit.Core.Utilities;
+using Bit.iOS.Core.Utilities;
+using Bit.iOS.Core.Views;
+using Foundation;
+using UIKit;
+using Xamarin.Forms;
 
 namespace Bit.iOS.Core.Controllers
 {
@@ -30,7 +30,7 @@ namespace Bit.iOS.Core.Controllers
         private IPlatformUtilsService _platformUtilsService;
         private IBiometricService _biometricService;
         private IKeyConnectorService _keyConnectorService;
-        private PinLockEnum _pinStatus;
+        private PinLockType _pinStatus;
         private bool _pinEnabled;
         private bool _biometricEnabled;
         private bool _biometricIntegrityValid = true;
@@ -96,24 +96,24 @@ namespace Bit.iOS.Core.Controllers
             if (autofillExtension && await _stateService.GetPasswordRepromptAutofillAsync())
             {
                 _passwordReprompt = true;
-                _pinStatus = PinLockEnum.Disabled;
+                _pinStatus = PinLockType.Disabled;
                 _pinEnabled = false;
                 _biometricEnabled = false;
             }
             else
             {
-                _pinStatus = await _vaultTimeoutService.IsPinLockSetAsync();
+                _pinStatus = await _vaultTimeoutService.GetPinLockTypeAsync();
 
-                var ephemeralPinSet = await _stateService.GetUserKeyPinEphemeralAsync()
+                var ephemeralPinSet = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync()
                     ?? await _stateService.GetPinProtectedKeyAsync();
-                _pinEnabled = (_pinStatus == PinLockEnum.Transient && ephemeralPinSet != null) ||
-                    _pinStatus == PinLockEnum.Persistent;
+                _pinEnabled = (_pinStatus == PinLockType.Transient && ephemeralPinSet != null) ||
+                    _pinStatus == PinLockType.Persistent;
 
                 _biometricEnabled = await _vaultTimeoutService.IsBiometricLockSetAsync()
                     && await _cryptoService.HasEncryptedUserKeyAsync();
                 _biometricIntegrityValid =
                     await _platformUtilsService.IsBiometricIntegrityValidAsync(BiometricIntegritySourceKey);
-                _usesKeyConnector = await _keyConnectorService.GetUsesKeyConnector();
+                _usesKeyConnector = await _keyConnectorService.GetUsesKeyConnectorAsync();
                 _biometricUnlockOnly = _usesKeyConnector && _biometricEnabled && !_pinEnabled;
             }
 
@@ -129,7 +129,7 @@ namespace Bit.iOS.Core.Controllers
             {
                 BaseNavItem.Title = AppResources.VerifyMasterPassword;
             }
-            
+
             BaseCancelButton.Title = AppResources.Cancel;
 
             if (_biometricUnlockOnly)
@@ -224,15 +224,15 @@ namespace Bit.iOS.Core.Controllers
                 {
                     EncString userKeyPin = null;
                     EncString oldPinProtected = null;
-                    if (_pinStatus == PinLockEnum.Persistent)
+                    if (_pinStatus == PinLockType.Persistent)
                     {
-                        userKeyPin = await _stateService.GetUserKeyPinAsync();
+                        userKeyPin = await _stateService.GetPinKeyEncryptedUserKeyAsync();
                         var oldEncryptedKey = await _stateService.GetPinProtectedAsync();
                         oldPinProtected = oldEncryptedKey != null ? new EncString(oldEncryptedKey) : null;
                     }
-                    else if (_pinStatus == PinLockEnum.Transient)
+                    else if (_pinStatus == PinLockType.Transient)
                     {
-                        userKeyPin = await _stateService.GetUserKeyPinEphemeralAsync();
+                        userKeyPin = await _stateService.GetPinKeyEncryptedUserKeyEphemeralAsync();
                         oldPinProtected = await _stateService.GetPinProtectedKeyAsync();
                     }
 
@@ -240,7 +240,7 @@ namespace Bit.iOS.Core.Controllers
                     if (oldPinProtected != null)
                     {
                         userKey = await _cryptoService.DecryptAndMigrateOldPinKeyAsync(
-                            _pinStatus == PinLockEnum.Transient,
+                            _pinStatus == PinLockType.Transient,
                             inputtedValue,
                             email,
                             kdfConfig,
@@ -284,19 +284,19 @@ namespace Bit.iOS.Core.Controllers
             else
             {
                 var masterKey = await _cryptoService.MakeMasterKeyAsync(inputtedValue, email, kdfConfig);
-                
-                var storedPasswordHash = await _cryptoService.GetPasswordHashAsync();
+
+                var storedPasswordHash = await _cryptoService.GetMasterKeyHashAsync();
                 if (storedPasswordHash == null)
                 {
                     var oldKey = await _secureStorageService.GetAsync<string>("oldKey");
                     if (masterKey.KeyB64 == oldKey)
                     {
-                        var localPasswordHash = await _cryptoService.HashPasswordAsync(inputtedValue, masterKey, HashPurpose.LocalAuthorization);
+                        var localPasswordHash = await _cryptoService.HashMasterKeyAsync(inputtedValue, masterKey, HashPurpose.LocalAuthorization);
                         await _secureStorageService.RemoveAsync("oldKey");
-                        await _cryptoService.SetPasswordHashAsync(localPasswordHash);
+                        await _cryptoService.SetMasterKeyHashAsync(localPasswordHash);
                     }
                 }
-                var passwordValid = await _cryptoService.CompareAndUpdatePasswordHashAsync(inputtedValue, masterKey);
+                var passwordValid = await _cryptoService.CompareAndUpdateKeyHashAsync(inputtedValue, masterKey);
                 if (passwordValid)
                 {
                     await AppHelpers.ResetInvalidUnlockAttemptsAsync();
@@ -395,7 +395,7 @@ namespace Bit.iOS.Core.Controllers
                     });
             PresentViewController(alert, true, null);
         }
-        
+
         private async Task LogOutAsync()
         {
             await AppHelpers.LogOutAsync(await _stateService.GetActiveUserIdAsync());

src/iOS.Core/Services/BiometricService.cs

@@ -1,20 +1,19 @@
 using System.Threading.Tasks;
+using Bit.App.Services;
 using Bit.Core.Abstractions;
 using Foundation;
 using LocalAuthentication;
 
 namespace Bit.iOS.Core.Services
 {
-    public class BiometricService : IBiometricService
+    public class BiometricService : BaseBiometricService
     {
-        private IStateService _stateService;
-
-        public BiometricService(IStateService stateService)
+        public BiometricService(IStateService stateService, ICryptoService cryptoService)
+            : base(stateService, cryptoService)
         {
-            _stateService = stateService;
         }
 
-        public async Task<bool> SetupBiometricAsync(string bioIntegritySrcKey = null)
+        public override async Task<bool> SetupBiometricAsync(string bioIntegritySrcKey = null)
         {
             if (bioIntegritySrcKey == null)
             {
@@ -30,7 +29,7 @@ namespace Bit.iOS.Core.Services
             return true;
         }
 
-        public async Task<bool> IsSystemBiometricIntegrityValidAsync(string bioIntegritySrcKey = null)
+        public override async Task<bool> IsSystemBiometricIntegrityValidAsync(string bioIntegritySrcKey = null)
         {
             var state = GetState();
             if (state == null)

src/iOS.Core/Utilities/iOSCoreHelpers.cs

@@ -112,9 +112,9 @@ namespace Bit.iOS.Core.Utilities
             var clipboardService = new ClipboardService(stateService);
             var platformUtilsService = new MobilePlatformUtilsService(deviceActionService, clipboardService,
                 messagingService, broadcasterService);
-            var biometricService = new BiometricService(stateService);
             var cryptoFunctionService = new PclCryptoFunctionService(cryptoPrimitiveService);
             var cryptoService = new CryptoService(stateService, cryptoFunctionService);
+            var biometricService = new BiometricService(stateService, cryptoService);
             var passwordRepromptService = new MobilePasswordRepromptService(platformUtilsService, cryptoService);
 
             ServiceContainer.Register<ISynchronousStorageService>(preferencesStorage);

src/iOS.Extension/LoadingViewController.cs

@@ -20,7 +20,6 @@ using Bit.App.Pages;
 using Bit.App.Models;
 using Bit.App.Utilities;
 using Bit.iOS.Core.Views;
-using Bit.Core.Enums;
 
 namespace Bit.iOS.Extension
 {
@@ -520,7 +519,7 @@ namespace Bit.iOS.Extension
                 vm.StartTwoFactorAction = () => DismissViewController(false, () => LaunchTwoFactorFlow(false));
                 vm.UpdateTempPasswordAction = () => DismissViewController(false, () => LaunchUpdateTempPasswordFlow());
                 vm.StartSsoLoginAction = () => DismissViewController(false, () => LaunchLoginSsoFlow());
-                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AuthenticateAndUnlock, email));
+                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(email));
                 vm.LogInSuccessAction = () => DismissLockAndContinue();
                 vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
             }
@@ -533,11 +532,11 @@ namespace Bit.iOS.Extension
             LogoutIfAuthed();
         }
 
-        private void LaunchLoginWithDevice(AuthRequestType authRequestType,string email = null)
+        private void LaunchLoginWithDevice(string email = null)
         {
             var appOptions = new AppOptions { IosExtension = true };
             var app = new App.App(appOptions);
-            var loginWithDevicePage = new LoginPasswordlessRequestPage(email, authRequestType, appOptions);
+            var loginWithDevicePage = new LoginPasswordlessRequestPage(email, appOptions);
             ThemeManager.SetTheme(app.Resources);
             ThemeManager.ApplyResourcesTo(loginWithDevicePage);
             if (loginWithDevicePage.BindingContext is LoginPasswordlessRequestViewModel vm)
@@ -567,7 +566,6 @@ namespace Bit.iOS.Extension
                 vm.StartTwoFactorAction = () => DismissViewController(false, () => LaunchTwoFactorFlow(true));
                 vm.StartSetPasswordAction = () => DismissViewController(false, () => LaunchSetPasswordFlow());
                 vm.UpdateTempPasswordAction = () => DismissViewController(false, () => LaunchUpdateTempPasswordFlow());
-                vm.StartDeviceApprovalOptionsAction = () => DismissViewController(false, () => LaunchDeviceApprovalOptionsFlow());
                 vm.SsoAuthSuccessAction = () => DismissLockAndContinue();
                 vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
             }
@@ -590,7 +588,6 @@ namespace Bit.iOS.Extension
             {
                 vm.TwoFactorAuthSuccessAction = () => DismissLockAndContinue();
                 vm.StartSetPasswordAction = () => DismissViewController(false, () => LaunchSetPasswordFlow());
-                vm.StartDeviceApprovalOptionsAction = () => DismissViewController(false, () => LaunchDeviceApprovalOptionsFlow());
                 if (authingWithSso)
                 {
                     vm.CloseAction = () => DismissViewController(false, () => LaunchLoginSsoFlow());
@@ -644,25 +641,5 @@ namespace Bit.iOS.Extension
             updateTempPasswordController.ModalPresentationStyle = UIModalPresentationStyle.FullScreen;
             PresentViewController(updateTempPasswordController, true, null);
         }
-
-        private void LaunchDeviceApprovalOptionsFlow()
-        {
-            var loginApproveDevicePage = new LoginApproveDevicePage();
-            var app = new App.App(new AppOptions { IosExtension = true });
-            ThemeManager.SetTheme(app.Resources);
-            ThemeManager.ApplyResourcesTo(loginApproveDevicePage);
-            if (loginApproveDevicePage.BindingContext is LoginApproveDeviceViewModel vm)
-            {
-                vm.LogInWithMasterPasswordAction = () => DismissViewController(false, () => PerformSegue("lockPasswordSegue", this));
-                vm.RequestAdminApprovalAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AdminApproval, vm.Email));
-                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AuthenticateAndUnlock, vm.Email));
-                vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
-            }
-
-            var navigationPage = new NavigationPage(loginApproveDevicePage);
-            var loginApproveDeviceController = navigationPage.CreateViewController();
-            loginApproveDeviceController.ModalPresentationStyle = UIModalPresentationStyle.FullScreen;
-            PresentViewController(loginApproveDeviceController, true, null);
-        }
     }
 }

src/iOS.ShareExtension/LoadingViewController.cs

@@ -339,7 +339,7 @@ namespace Bit.iOS.ShareExtension
                 vm.StartTwoFactorAction = () => DismissAndLaunch(() => LaunchTwoFactorFlow(false));
                 vm.UpdateTempPasswordAction = () => DismissAndLaunch(() => LaunchUpdateTempPasswordFlow());
                 vm.StartSsoLoginAction = () => DismissAndLaunch(() => LaunchLoginSsoFlow());
-                vm.LogInWithDeviceAction = () => DismissAndLaunch(() => LaunchLoginWithDevice(AuthRequestType.AuthenticateAndUnlock, email));
+                vm.LogInWithDeviceAction = () => DismissAndLaunch(() => LaunchLoginWithDevice(email));
                 vm.LogInSuccessAction = () => { DismissLockAndContinue(); };
                 vm.CloseAction = () => DismissAndLaunch(() => LaunchHomePage());
             }
@@ -348,9 +348,9 @@ namespace Bit.iOS.ShareExtension
             LogoutIfAuthed();
         }
 
-        private void LaunchLoginWithDevice(AuthRequestType authRequestType, string email = null)
+        private void LaunchLoginWithDevice(string email = null)
         {
-            var loginWithDevicePage = new LoginPasswordlessRequestPage(email, authRequestType, _appOptions.Value);
+            var loginWithDevicePage = new LoginPasswordlessRequestPage(email, _appOptions.Value);
             SetupAppAndApplyResources(loginWithDevicePage);
             if (loginWithDevicePage.BindingContext is LoginPasswordlessRequestViewModel vm)
             {
@@ -373,7 +373,6 @@ namespace Bit.iOS.ShareExtension
                 vm.StartTwoFactorAction = () => DismissAndLaunch(() => LaunchTwoFactorFlow(true));
                 vm.StartSetPasswordAction = () => DismissAndLaunch(() => LaunchSetPasswordFlow());
                 vm.UpdateTempPasswordAction = () => DismissAndLaunch(() => LaunchUpdateTempPasswordFlow());
-                vm.StartDeviceApprovalOptionsAction = () => DismissViewController(false, () => LaunchDeviceApprovalOptionsFlow());
                 vm.SsoAuthSuccessAction = () => DismissLockAndContinue();
                 vm.CloseAction = () => DismissAndLaunch(() => LaunchHomePage());
             }
@@ -390,7 +389,6 @@ namespace Bit.iOS.ShareExtension
             {
                 vm.TwoFactorAuthSuccessAction = () => DismissLockAndContinue();
                 vm.StartSetPasswordAction = () => DismissAndLaunch(() => LaunchSetPasswordFlow());
-                vm.StartDeviceApprovalOptionsAction = () => DismissViewController(false, () => LaunchDeviceApprovalOptionsFlow());
                 if (authingWithSso)
                 {
                     vm.CloseAction = () => DismissAndLaunch(() => LaunchLoginSsoFlow());
@@ -429,26 +427,6 @@ namespace Bit.iOS.ShareExtension
             NavigateToPage(updateTempPasswordPage);
         }
 
-        private void LaunchDeviceApprovalOptionsFlow()
-        {
-            var loginApproveDevicePage = new LoginApproveDevicePage();
-            var app = new App.App(new AppOptions { IosExtension = true });
-            ThemeManager.SetTheme(app.Resources);
-            ThemeManager.ApplyResourcesTo(loginApproveDevicePage);
-            if (loginApproveDevicePage.BindingContext is LoginApproveDeviceViewModel vm)
-            {
-                vm.LogInWithMasterPasswordAction = () => DismissViewController(false, () => PerformSegue("lockPasswordSegue", this));
-                vm.RequestAdminApprovalAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AdminApproval, vm.Email));
-                vm.LogInWithDeviceAction = () => DismissViewController(false, () => LaunchLoginWithDevice(AuthRequestType.AuthenticateAndUnlock, vm.Email));
-                vm.CloseAction = () => DismissViewController(false, () => LaunchHomePage());
-            }
-
-            var navigationPage = new NavigationPage(loginApproveDevicePage);
-            var loginApproveDeviceController = navigationPage.CreateViewController();
-            loginApproveDeviceController.ModalPresentationStyle = UIModalPresentationStyle.FullScreen;
-            PresentViewController(loginApproveDeviceController, true, null);
-        }
-
         public void Navigate(NavigationTarget navTarget, INavigationParams navParams = null)
         {
             if (ExtNavigationController?.ViewControllers?.Any() ?? false)