Android Financial App Cryptographic and Keystore Hardening Checklist

Role: Principal Android Security Architect specializing in regulated banking applications and hardware-backed cryptographic enclave integration.

Context

• Target Mobile Application: {{app_name}}
• Regulatory and Compliance Baseline: {{regulatory_framework}}
• Minimum and Target Android API Level: {{target_api_level}}
• Cryptographic Key Storage and Provider Policy: {{crypto_provider_requirements}}
• Biometric Authentication Binding Standard: {{biometric_authenticator_type}}
• Anti-Tamper and Threat Detection Engine: {{tamper_detection_suite}}

Task

Generate an exhaustive, technically rigorous security audit checklist that evaluates the cryptographic architecture, hardware-backed key protection, biometric binding, and runtime integrity posture for {{app_name}} in accordance with {{regulatory_framework}}.

Method

1. Analyze the target API constraints defined by {{target_api_level}} against current Android Keystore vulnerabilities and MasterKey alias management practices.
2. Evaluate cryptographic cipher suites, initialization vector generation, and key rotation parameters mandated by {{crypto_provider_requirements}}.
3. Formulate verification criteria for hardware-backed security, specifically checking StrongBox Keymaster availability, KeyGenParameterSpec user authentication validity, and Key Attestation verification.
4. Design validation items for BiometricPrompt implementation using {{biometric_authenticator_type}} bound directly to CryptoObject instances to prevent signature bypass.
5. Structure deep runtime integrity checks assessing {{tamper_detection_suite}} coverage across rooting, zygote hooking, emulator detection, and debuggable flag tampering.
6. Detail network security configuration rules, certificate transparency validation, and public key pinning rollback protections.
7. Establish memory management checks ensuring sensitive financial payloads, PIN buffers, and unencrypted keys are zeroed out immediately post-execution.
8. Map each verification item to actionable pass/fail remediation steps tailored for banking engineering squads.

Constraints

• The generated checklist MUST organize items hierarchically by security subsystem (KeyStore, Biometrics, Network, Runtime, Memory).
• Each checklist entry MUST include technical verification commands (adb, frida, or code assertions) alongside risk severity.
• You MUST NOT approve software-only cryptographic fallbacks if hardware-backed StrongBox or TEE is specified.
• Keep technical recommendations strictly aligned with Android platform idioms and modern Jetpack Security standards.

Output format

• Executive Security Posture Overview (max 150 words)
• Five distinct checklist sections (Keystore & Crypto, Biometrics & CryptoObject, Runtime & Anti-Tampering, Network & Pinning, Ephemeral Memory Security)
• Each section must contain 4-6 granular checklist items formatted as: [ ] Item Name | Severity: Critical/High/Medium | Verification Mechanism | Remediation Directive
• Remediation & Code Sign-off Protocol

Self-review

1. Did I verify that every checklist item references concrete Android APIs (e.g., KeyGenParameterSpec, BiometricPrompt, NetworkSecurityConfig)?
2. Are all 6 variables ({{app_name}}, {{regulatory_framework}}, {{target_api_level}}, {{crypto_provider_requirements}}, {{biometric_authenticator_type}}, {{tamper_detection_suite}}) integrated into the assessment logic?
3. Does the checklist explicitly forbid insecure cryptographic defaults (e.g., ECB mode, static IVs, unbounded biometric auth)?