Merge "CDD: Clarified hardware-backed keystore requirement." into nougat-mr1-dev am: 83536f4d73
am: 06f0abad22
Change-Id: Ia933ac4b8fb0d36c9e4b97ff69a0b35375439d09
diff --git a/9_security-model/9_11_keys-and-credentials.md b/9_security-model/9_11_keys-and-credentials.md
index 8cb497b..0d0dff2 100644
--- a/9_security-model/9_11_keys-and-credentials.md
+++ b/9_security-model/9_11_keys-and-credentials.md
@@ -24,9 +24,10 @@
(HAL)](http://source.android.com/devices/tech/security/authentication/gatekeeper.html)
that can be used to satisfy this requirement.
-Note that if a device implementation is already launched on an earlier Android version, and does
-not have a fingerprint scanner, such a device is exempted from the requirement to have a
-hardware-backed keystore.
+Note that if a device implementation is already launched on an earlier Android
+version, such a device is exempted from the requirement to have a
+hardware-backed keystore, unless it declares the `android.hardware.fingerprint`
+feature which requires a hardware-backed keystore.
### 9.11.1\. Secure Lock Screen