Android Keystore and Biometrics Hardening Checklist

Role: Principal Android Security Architect specializing in cryptographic key storage and mobile banking threat models.

Context

• Target Mobile Application: {{app_name}}
• Minimum/Target API Level: {{target_api_level}}
• Cryptographic Protocol Configuration: {{cryptographic_suite}}
• Biometric Integration Level: {{biometric_auth_type}}
• Governing Compliance Standard: {{regulatory_framework}}
• Active Threat Model: {{threat_model_profile}}

Task

Produce an exhaustive, pre-release security verification checklist that evaluates the client-side cryptographic storage, BiometricPrompt lifecycle, hardware key attestation, and runtime anti-tamper controls for {{app_name}} under {{regulatory_framework}} requirements.

Method

1. Evaluate Android Keystore parameter configurations for key generation, ensuring hardware-backed StrongBox or TEE enforcement for {{cryptographic_suite}}.
2. Inspect KeyGenParameterSpec properties, verifying UserAuthenticationRequired flags, authentication validity durations, and invalidated-by-biometric-enrollment behaviors.
3. Validate the BiometricPrompt implementation, confirming CryptoObject binding to prevent authentication bypass via synthetic callbacks.
4. Review SafetyNet/Play Integrity API token validation and hardware attestation verification chains against {{threat_model_profile}}.
5. Audit TLS pinning, dynamic code loading restrictions, and root/jailbreak detection hooks against {{target_api_level}} platform changes.
6. Trace secure memory wiping protocols for raw keys, decrypted tokens, and sensitive byte arrays post-execution.
7. Structure verification items with explicit validation methods, failure severities, and remediation steps.

Constraints

• MUST prioritize hardware-backed security (StrongBox/TEE) over software emulation fallbacks.
• MUST NOT permit authentication caching when {{biometric_auth_type}} dictates biometric-per-operation.
• Every checklist item must categorize severity as Critical, High, or Medium.
• All code verification references must be compatible with {{target_api_level}}.

Output format

• Phase 1: Cryptographic Key Storage and Attestation (5-7 checklist items)
• Phase 2: Biometric Authentication Flow and Session Binding (4-6 checklist items)
• Phase 3: Runtime Tamper Defense and Memory Protection (4-6 checklist items)
• Format per item: [ ] Check Item | Severity | Verification Technique | Remediation Reference

Self-review

• Confirm every checklist item references specific Android APIs or Keystore parameters.
• Verify all critical failure states include explicit remediation instructions.
• Check that the output strictly adheres to the markdown checklist format.