Merge "CDD: Clarified hardware-backed keystore requirement." into nougat-mr1-dev am: 83536f4d73 am: 06f0abad22
am: 8ab2128766
Change-Id: I593c0d90730a45900a06c70d117092401a48e319
diff --git a/9_security-model/9_11_keys-and-credentials.md b/9_security-model/9_11_keys-and-credentials.md
index 8cb497b..0d0dff2 100644
--- a/9_security-model/9_11_keys-and-credentials.md
+++ b/9_security-model/9_11_keys-and-credentials.md
@@ -24,9 +24,10 @@
(HAL)](http://source.android.com/devices/tech/security/authentication/gatekeeper.html)
that can be used to satisfy this requirement.
-Note that if a device implementation is already launched on an earlier Android version, and does
-not have a fingerprint scanner, such a device is exempted from the requirement to have a
-hardware-backed keystore.
+Note that if a device implementation is already launched on an earlier Android
+version, such a device is exempted from the requirement to have a
+hardware-backed keystore, unless it declares the `android.hardware.fingerprint`
+feature which requires a hardware-backed keystore.
### 9.11.1\. Secure Lock Screen