Google Renames Android Ready SE as Android Digital Credential Alliance

On September 1, 2026, Google announced the expansion and renaming of the Android Ready SE initiative as Android Digital Credential Alliance. At the same time, it published the white paper “High Assurance Digital Credentials on Android,” which describes using the hardware-isolated StrongBox key storage for digital credentials with high security requirements.

This is not an announcement of a vulnerability, confirmed exploitation, or a security fix. Google is presenting a platform and ecosystem initiative intended to connect hardware manufacturers, wallet developers, and digital credential issuers.

Android Digital Credential Alliance aims to connect hardware, wallets, and credential issuers

According to Google, the alliance is intended to bring together chip and Secure Element suppliers, device manufacturers, digital wallet developers, and government authorities that issue digital credentials. The goal is to simplify the deployment of mobile identities and other credentials on Android devices that meet the relevant technical requirements.

Google says the original Android Ready SE initiative expanded certified hardware to hundreds of millions of devices. However, this figure was not independently substantiated in the materials reviewed. The announcement also does not include a public list of the new alliance’s members, a timeline, or a list of specific new phones with certified StrongBox.

StrongBox is optional hardware protection for keys

The white paper focuses on StrongBox, which Android uses as hardware-isolated storage for cryptographic keys on selected devices. For digital credentials, it is important to make copying private keys more difficult and to enable verification of their origin or association with a specific device.

Official Android documentation states that StrongBox KeyMint is an optional feature on devices running Android 9 and later. Compared with the usual trusted execution environment, known as a TEE, it provides stronger isolation and greater resistance to physical tampering. However, it also has limitations: it may be slower and may not support all cryptographic algorithms or features available outside StrongBox.

The mere presence of StrongBox therefore does not mean that every Android phone will automatically provide the same level of digital identity protection. It depends on support from the specific device and on how the wallet and credential issuance system use the feature.

Why hardware binding matters for digital credentials

Digital identity cards, driver’s licenses, and other mobile credentials use sensitive identifying data and cryptographic keys. Hardware-protected key storage, together with mechanisms for verifying key origin, can make it more difficult to clone a credential or use it without holder authentication.

In its materials, Google states that the proposed architecture may support the highest regulatory requirements, including eIDAS 2.0. Actual compliance with these requirements will depend on the specific phone, wallet implementation, certification, and decisions by the relevant authorities.

In Europe, the relevant context is the EUDI Wallet. An open reference implementation exists, and the plan calls for at least one wallet to be available in every EU member state by the end of 2026. However, Google’s announcement does not specify any deployment of Android Digital Credential Alliance for national electronic identities or in the EUDI Wallet.

What to watch next

• a public list of partners and the alliance’s technical or certification outputs,
• which phones and digital wallets will actually support the required level of StrongBox,
• specific projects involving national eIDs and the EUDI Wallet, including independent certifications.

Verified and updated: 09/02/2026 07:41