auth/com.midnight.kuira.core.auth/SeedVault

SeedVault

class SeedVault(context: Context, biometricGate: BiometricGate)

Encrypted seed storage backed by Android Keystore + biometric authentication.

Layered security model:

Local layer (this class): Seed encrypted with device-bound Keystore master key. Biometric-gated for every access.
Backup layer (future — core:backup): Separate encrypted blob using a transferable key (passkey PRF or backup password). Needed for cross-device recovery because the Keystore master key cannot transfer to a new device.

Storage format: The on-disk file is a single blob:

[12 bytes: IV] + [96 bytes: encrypted(entropy || seed)] + [16 bytes: GCM auth tag]

Total: 124 bytes.

File location: <app filesDir>/kuira_seed.bin — app-private storage, explicitly excluded from Auto Backup via data_extraction_rules.xml in the host app's manifest.

Atomicity: Writes go to a temp file and are renamed in place, so a crash mid-write leaves either the old seed or the new seed, never a partial file.

Threading: All file I/O runs on Dispatchers.IO via withContext.