I'm new to FIDO2 specification.

I'm aware that Android and IOS devices support FIDO2 protocols (even Android phones could act as a physical key for FIDO2 authentication).

However, Could anyone let me know that, when we use the platform authenticators such as Android fingerprint, where are the credentials (private keys) stored?


1 Answer 1


Android 7 requires certified devices to have a Hardware Security Module (HSM) to do lock-screen authentication (with the exception of devices that launched with an older version of Android such as Android 6). The Pixel 3 comes with a HSM powered by Google's cryptoprocessor Titan M. The Qualcomm Snapdragon 845, an SoC used in multiple Android devices, has the Secure Processing Unit (SPU) serving as their HSM's cryptoprocessor. The credentials used by the Android device's FIDO2 implementation will be stored and processed within these HSMs.

Note that the credentials don't have to be stored on the HSM. The FIDO2 spec states that the credential ID used by the relying party to identify you can be the encrypted credentials themselves. This means that the Android device doesn't need to store anything in the HSM; they would just use it to encrypt and decrypt the credentials using whatever private key that's locked within it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .