Nexus Imprint on the new Nexus phones is fantastic compared to other fingerprint sensors. It's fast and incredibly accurate. The setup process is painless too. How will other devices with fingerprint sensors on Android 6.0 fare? They should at least get the job done if they follow the new rules. Google has listed the requirements for OEMs to make sure their sensors work correctly in Marshmallow.

The rules come from Google's updated Marshmallow Compatibility Definition Document (CDD). While fingerprint sensors are not required (i.e. MUST), Google encourages OEMs to include them (SHOULD). Here's the relevant text from the CDD.

7.3.10. Fingerprint Sensor
Device implementations with a secure lock screen SHOULD include a fingerprint sensor. If a device implementation includes a fingerprint sensor and has a corresponding API for third-party developers, it:

  • MUST declare support for the android.hardware.fingerprint feature.
  • MUST fully implement the corresponding API as described in the Android SDK documentation [Resources, 95].
  • MUST have a false acceptance rate not higher than 0.002%.
  • Is STRONGLY RECOMMENDED to have a false rejection rate not higher than 10%, and a latency from when the fingerprint sensor is touched until the screen is unlocked below 1 second, for 1 enrolled finger.
  • MUST rate limit attempts for at least 30 seconds after 5 false trials for fingerprint verification.
  • MUST have a hardware-backed keystore implementation, and perform the fingerprint matching in a Trusted Execution Environment (TEE) or on a chip with a secure channel to the TEE.
  • MUST have all identifiable fingerprint data encrypted and cryptographically authenticated such that they cannot be acquired, read or altered outside of the Trusted Execution Environment (TEE) as documented in the implementation guidelines on the Android Open Source Project site [Resources, 96].
  • MUST prevent adding a fingerprint without first establishing a chain of trust by having the user confirm existing or add a new device credential (PIN/pattern/password) using the TEE as implemented in the Android Open Source project.
  • MUST NOT enable 3rd-party applications to distinguish between individual fingerprints.
  • MUST honor the DevicePolicyManager.KEYGUARD_DISABLE_FINGERPRINT flag.
  • MUST, when upgraded from a version earlier than Android 6.0, have the fingerprint data securely migrated to meet the above requirements or removed.
  • SHOULD use the Android Fingerprint icon provided in the Android Open Source Project.

These are basically the rules if you want to build a phone with support for Marshmallow's version of fingerprint sensor support. Developers have to follow all the API guidelines to make sure data is kept secure. There are both hardware and software requirements that OEMs have to follow in order to use Google's system and have support for all the apps that will use the standard Android APIs.

Any phones that are updated from an earlier version of Android to 6.0 will also have to migrate the fingerprint data to match these specifications or it must be wiped from the device. That means there might be some devices that require you to set up your fingerprints all over again after upgrading. We'll see how troublesome this is in a few months when OEMs get around to rolling out some OTAs.