Binding keys to a device in Android

val result = deviceBindingCallback.bind {
  // Device identification
  deviceName = "Babs' Phone"
  deviceIdentifier = DefaultDeviceIdentifier.id // Use the default device identifier strategy

  // Cryptographic settings
  signingAlgorithm = "RS256"

  // Timing configuration
  issueTime = { Instant.now() }
  expirationTime = { timeout -> Instant.now().plusSeconds(timeout.toLong()) }

  // Storage configuration
  userKeyStorage {
    storage {
      fileName = "user_keys"
    }
  }

  // Authentication configuration
  biometricAuthenticatorConfig {
    promptInfo = {
      setTitle("Device Registration")
      setSubtitle("Secure your account")
      setDescription("Use your fingerprint to register this device")
    }
  }
}

val result = deviceSigningVerifierCallback.sign {
  // Signing algorithm
  signingAlgorithm = "RS512"

  appPinConfig {
    pinRetry = 3
    pinCollector {
      "1234".toCharArray()
    }
    prompt = Prompt("App Pin", "Enter your app pin", "App pin is required")
  }

  // User key selection strategy
  userKeySelector { keys ->
    // Select most recently created key
    keys.maxByOrNull { it.createdAt } ?: keys.first()
  }

  // Authentication configuration
  biometricAuthenticatorConfig {
    promptInfo = {
      setTitle("Verify Transaction")
      setDescription("Confirm this transaction with your fingerprint")
    }
  }
}

deviceSigningVerifierCallback.sign {
  claims {
    // Transaction details
    put("amount", "100.00")
    put("recipient", "babs@example.com")
    put("currency", "USD")

    // Device context
    put("ip_address", getClientIP())
    put("user_agent", getUserAgent())

    // Security context
    put("risk_score", calculateRiskScore())
    put("session_id", getSessionId())
  }
}

// Configuration that makes keys sensitive to biometric changes
biometricAuthenticatorConfig {
    keyGenParameterSpec {
        // This setting makes keys invalid when new biometrics are enrolled
        setInvalidatedByBiometricEnrollment(true)
        //setUnlockedDeviceRequired(true)
        //setUserAuthenticationValidWhileOnBody(true)
        //setUserPresenceRequired(true)
        //setIsStrongBoxBacked(false)
        //setInvalidatedByBiometricEnrollment(false)
    }
}

// When user enrolls new fingerprint, subsequent signing will fail
deviceSigningCallback.sign().onFailure { error ->
  when (error) {
    is KeyPermanentlyInvalidatedException -> {
      // Keys are permanently invalidated due to biometric enrollment
      logger.w("Device keys invalidated by biometric enrollment")
      redirectToDeviceBinding() // User must re-bind device
    }
  }
}

// When all device authentication is removed, keys are deleted by Android KeyStore
deviceSigningCallback.sign().onFailure { error ->
  when (error) {
    is DeviceNotRegisteredException -> {
      logger.w("No device keys found - maybe removed due to authentication method removal")
      showMessage("Please enroll in biometrics or add a device PIN, then register your device")
      redirectToDeviceBinding() // User must re-bind device
    }
  }
}