Hardware-Backed Biometric Keystore Script Generator

Role: Principal Mobile Security Architect with expertise in Android cryptographic subsystems and FIPS-compliant payment security.

Context

• Target Financial Institution: {{institution_name}}
• Platform SDK Version: {{target_sdk_version}}
• Biometric Authentication Class: {{biometric_authenticator_type}}
• Cryptographic Key Identifier: {{key_alias}}
• Banking Payload Model: {{session_token_payload}}
• Hardware Security Requirement: {{strongbox_required}}

Task

Generate a standalone, hardened Kotlin script and implementation module that initializes hardware-backed Android KeyStore cryptography, presents a biometric authentication prompt, and safely encrypts or decrypts high-value transaction payloads.

Method

1. Inspect {{target_sdk_version}} and {{strongbox_required}} to configure KeyGenParameterSpec with AES-256 GCM and user authentication validity flags.
2. Implement a dedicated KeyStore manager class generating hardware-isolated keys within StrongBox when available, falling back gracefully to standard TEE.
3. Build cipher initialization logic supporting both encryption and decryption lifecycle states with random IV generation.
4. Construct BiometricPrompt.CryptoObject wrappers compliant with {{biometric_authenticator_type}} specifications.
5. Implement BiometricPrompt callback listeners handling authentication success, system cancellation, and lockout error codes.
6. Process {{session_token_payload}} through the initialized Cipher upon successful biometric validation.
7. Add zero-fill memory sanitization routines to clear decrypted byte arrays immediately after serialization.
8. Include structured logging interceptors configured to track cryptographic failures for {{institution_name}} without leaking sensitive material.

Constraints

• Code MUST be written in clean, thread-safe Kotlin utilizing Coroutines for asynchronous invocation.
• The script MUST NOT store unencrypted sensitive payloads in SharedPreferences, SQLite, or device cache.
• Keys MUST require biometric authentication for every individual cipher operation when handling high-risk transfers.
• The implementation MUST handle KeyPermanentlyInvalidatedException by forcing full re-enrollment.

Output format

• Section 1: Architectural Specification & Cryptographic Properties (maximum 150 words)
• Section 2: Complete Executable Kotlin Script (single block containing KeyStoreManager, BiometricHelper, and Callback handlers)
• Section 3: Error Handling and Lockout Recovery Logic
• Section 4: ProGuard/R8 Obfuscation Rules (keep rules for crypto classes)

Self-review

• Verify that StrongBox initialization logic strictly handles unsupported hardware exceptions.
• Ensure IV handling enforces 12-byte GCM initialization vectors without reuse.
• Check that all variable references are properly bound to {{institution_name}} and {{key_alias}}.