title: Can multiple Android Applications(same device) share same key-pair for Passwordless Authentication using FIDO 2 Protocol?
body: <p><strong>Problem Statement:</strong></p>
  <p>I want to solve the user authentication on Android applications using the FIDO2 protocol(by providing an SDK), without doing multiple registration ceremonies for different applications on the same device.
  For example, If a user has been Registered(generated Public-Private key pair) in an Android application A, he/she shall not be required to Registered in an Android application B(Given App A and App B are on the same device).</p>
  <p><strong>What could be the possible Solutions(as per my knowledge):-</strong></p>
  <ol>
  <li>A common SDK integrated with application A and B to provide authentication.</li>
  <li>Separate Authentication App.</li>
  </ol>
  <p>I want to go forward with Solution 1 as Solution 2 might not be desirable because it needs an extra step of downloading an extra app(Authentication App).</p>
  <p><strong>What am I able to achieve right now:-</strong>
  We are able to do passwordless authentication of a user for app A and app B by maintaining separate private keys for app A and app B .</p>
  <p><a href="https://i.stack.imgur.com/6zSTF.png" rel="noreferrer"><img src="https://i.stack.imgur.com/6zSTF.png" alt="enter image description here" /></a>
  In the above diagram:-</p>
  <ol>
  <li>User XYZ logs-in to App A and registers himself with app A on this device.</li>
  <li>During the registration step a Public-private key pair is generated by the authenticator.</li>
  <li>PrivateKey_1(PrivateKey) gets created and is stored in the Keystore and PublicKey_1(PublicKey) gets created and is shared with the server.</li>
  <li>Let's say now that User XYZ wants to login to the app B.
  Same process gets repeated for user XYZ to register him with app B.</li>
  <li>In this process, A PrivateKey_2 gets created and is stored in the Keystore and PublicKey_2 gets created and is shared with the server.</li>
  <li>So in above scenario User XYZ is able to authenticate on App A and App B using private key PrivateKey_1 and PrivateKey_2 respectively.</li>
  </ol>
  <p><strong>I want to know the feasibility of the following Scenario?</strong>
  I want to do passwordless authentication of user XYZ for app A and app B, where applications(app A and app B) can use the same credentials (public and private key pair ) and do not need to perform a repeated registration ceremony(creating public and private key) for the same user on the same device for multiple applications sharing the <strong>common SDK</strong>(app A and app B).</p>
  <p><a href="https://i.stack.imgur.com/uStCq.png" rel="noreferrer"><img src="https://i.stack.imgur.com/uStCq.png" alt="enter image description here" /></a>
  In the above diagram:-</p>
  <ol>
  <li>User XYZ logs-in to App A and registers himself with app A on this device.</li>
  <li>In this process, a PrivateKey_1 gets created and is stored in the Keystore and
  PublicKey_1 gets created and is shared with the server.</li>
  <li>User XYZ wants to login to the app B.</li>
  <li>App B should be able to verify user XYZ using the previously generated
  credentials(by app A).</li>
  </ol>
  <p><strong>Is this even possible? Is there any gap in my understanding?</strong></p>
  <p>Any Suggestion and help is really appreciable :) :)</p>