Android Biometric Authentication and FIDO2 Fallback Compliance Matrix

Role: Lead Android Identity & Cryptography Engineer specializing in FIDO2 WebAuthn passkeys, BiometricPrompt APIs, and PSD2 SCA compliance.

Context

• Banking Institution: {{banking_entity_name}}
• SCA Compliance Framework: {{psd2_sca_requirements}}
• Allowed Biometric Authenticators: {{biometric_authenticator_types}}
• Key Timeout Window: {{keystore_auth_timeout}}
• Passkey Provider Tier: {{passkey_sync_provider}}
• Legacy Device Fallback: {{legacy_device_fallback}}

Task

Construct a comprehensive Android biometric authentication and FIDO2 passkey transition matrix for {{banking_entity_name}} that enforces cryptographic transaction authorization, explicit key invalidation on new biometric enrollment, and multi-tier authentication fallbacks meeting {{psd2_sca_requirements}}.

Method

1. Map {{biometric_authenticator_types}} (Class 3 Strong vs. Class 2 Weak) against Android BiometricManager authenticators mask.
2. Configure KeyGenParameterSpec with setUserAuthenticationRequired(true), setInvalidatedByBiometricEnrollment(true), and {{keystore_auth_timeout}} duration parameters.
3. Integrate BiometricPrompt.CryptoObject initialized with Cipher, Signature, or Mac instances for payment step-up authorization.
4. Design FIDO2 passkey registration and assertion flows via Android Credential Manager API, integrating with {{passkey_sync_provider}}.
5. Formulate step-down and recovery paths for hardware configurations governed by {{legacy_device_fallback}} without breaching {{psd2_sca_requirements}}.
6. Handle edge cases: biometric sensor lockout, non-enrolled users, biometric invalidated keys (KeyPermanentlyInvalidatedException), and UI cancellation.
7. Compile a verification and error-handling matrix mapping API exceptions to secure user workflows.

Constraints

• Implementations MUST NOT accept Class 2 (Weak / BiometricPrompt.BIOMETRIC_WEAK) authenticators for transaction authorization or payment release.
• Master signing keys MUST be bound to hardware and invalidated immediately when new fingerprints or face profiles are added to the device.
• The system MUST provide an explicit, cryptographically verifiable recovery path when {{legacy_device_fallback}} is triggered.
• Android Credential Manager responses must validate WebAuthn challenge signatures against backend public keys.

Output format

Provide the architectural deliverable across three sections:

1. Biometric & Credential Architecture Plan (maximum 300 words).
2. Authentication Tier & Failure Mode Matrix (Markdown table containing: Use Case, Biometric Strength Requirement, CryptoObject Signature Binding, Credential Manager / FIDO2 Passkey Integration, Exception Trigger, Fallback Action).
3. Exception & Key Invalidation Decision Tree (maximum 5 structured operational rules).

Self-review

• Ensure KeyPermanentlyInvalidatedException handling requires full re-authentication and server-side key re-registration.
• Confirm all transaction signing scenarios require Class 3 (BIOMETRIC_STRONG) authenticators.
• Validate that all step-down flows meet the non-repudiation clauses of {{psd2_sca_requirements}}.