Description:
I am requesting a feature to enhance security by implementing a strict, user-configurable timeout for the master key in the Android Keystore.
​Currently, the app relies on biometric unlock, but there is no mechanism to enforce an "auto-purge" of the session key from RAM after a specific period of inactivity. To mitigate risks from memory forensic analysis (RAM dumping), I propose the following:
​Configurable Timeout: Add a setting to define an auth-timeout (in seconds/minutes).
​Forced Purge: Upon expiration of this timer, the session key must be explicitly wiped from memory (zeroed out).
​Biometric Re-bind: Once the timeout is reached, the app must revoke the current CryptoObject token and require a fresh BiometricPrompt authentication to re-initialize the Keystore access.
​Implementation details: Please utilize KeyGenParameterSpec.Builder with setUserAuthenticationValidityDurationSeconds() to enforce this policy at the hardware/TEE level, ensuring the key becomes inaccessible once the validity window closes.
​This is critical for users who need to protect their vault against physical forensic extraction while the device is in a locked or backgrounded state.