diff --git a/keystore2/aidl/android/security/metrics/HardwareAuthenticatorType.aidl b/keystore2/aidl/android/security/metrics/HardwareAuthenticatorType.aidl
index b13f6ea..d5cacfd 100644
--- a/keystore2/aidl/android/security/metrics/HardwareAuthenticatorType.aidl
+++ b/keystore2/aidl/android/security/metrics/HardwareAuthenticatorType.aidl
@@ -17,16 +17,41 @@
 package android.security.metrics;
 
 /**
- * HardwareAuthenticatorType enum as defined in Keystore2KeyCreationWithAuthInfo of
- * frameworks/proto_logging/stats/atoms.proto.
+ * AIDL enum representing the
+ * android.os.statsd.Keystore2KeyCreationWithAuthInfo.HardwareAuthenticatorType protocol buffer enum
+ * defined in frameworks/proto_logging/stats/atoms.proto.
+ *
+ * This enum is a mirror of
+ * hardware/interfaces/security/keymint/aidl/android/hardware/security/keymint/HardwareAuthenticatorType.aidl
+ * except that:
+ *   - The enum tag number for the ANY value is set to 5,
+ *   - The enum tag numbers of all other values are incremented by 1, and
+ *   - Two new values are added: AUTH_TYPE_UNSPECIFIED and NO_AUTH_TYPE.
+ * The KeyMint AIDL enum is a bitmask, but since the enum tag numbers in this metrics-specific
+ * mirror were shifted, this enum can't behave as a bitmask. As a result, we have to explicitly add
+ * values to represent the bitwise OR of pairs of values that we expect to see in the wild.
  * @hide
  */
 @Backing(type="int")
 enum HardwareAuthenticatorType {
-    /** Unspecified takes 0. Other values are incremented by 1 compared to keymint spec. */
+    // Sentinel value to represent undefined enum tag numbers (which would represent combinations of
+    // values from the KeyMint enum that aren't explicitly represented here). We don't expect to see
+    // this value in the metrics, but if we do it means that an unexpected (bitwise OR) combination
+    // of KeyMint HardwareAuthenticatorType values is being used as the HardwareAuthenticatorType
+    // key parameter.
     AUTH_TYPE_UNSPECIFIED = 0,
+    // Corresponds to KeyMint's HardwareAuthenticatorType::NONE value (enum tag number 0).
     NONE = 1,
+    // Corresponds to KeyMint's HardwareAuthenticatorType::PASSWORD value (enum tag number 1 << 0).
     PASSWORD = 2,
+    // Corresponds to KeyMint's HardwareAuthenticatorType::FINGERPRINT value (enum tag number
+    // 1 << 1).
     FINGERPRINT = 3,
+    // Corresponds to the (bitwise OR) combination of KeyMint's HardwareAuthenticatorType::PASSWORD
+    // and HardwareAuthenticatorType::FINGERPRINT values.
+    PASSWORD_OR_FINGERPRINT = 4,
+    // Corresponds to KeyMint's HardwareAuthenticatorType::ANY value (enum tag number 0xFFFFFFFF).
     ANY = 5,
+    // No HardwareAuthenticatorType was specified in the key parameters.
+    NO_AUTH_TYPE = 6,
 }
\ No newline at end of file
diff --git a/keystore2/src/metrics_store.rs b/keystore2/src/metrics_store.rs
index fd1f9b5..72bbfe2 100644
--- a/keystore2/src/metrics_store.rs
+++ b/keystore2/src/metrics_store.rs
@@ -205,7 +205,7 @@
     };
 
     let mut key_creation_with_auth_info = KeyCreationWithAuthInfo {
-        user_auth_type: MetricsHardwareAuthenticatorType::AUTH_TYPE_UNSPECIFIED,
+        user_auth_type: MetricsHardwareAuthenticatorType::NO_AUTH_TYPE,
         log10_auth_key_timeout_seconds: -1,
         security_level: MetricsSecurityLevel::SECURITY_LEVEL_UNSPECIFIED,
     };
@@ -258,6 +258,12 @@
                     HardwareAuthenticatorType::FINGERPRINT => {
                         MetricsHardwareAuthenticatorType::FINGERPRINT
                     }
+                    a if a.0
+                        == HardwareAuthenticatorType::PASSWORD.0
+                            | HardwareAuthenticatorType::FINGERPRINT.0 =>
+                    {
+                        MetricsHardwareAuthenticatorType::PASSWORD_OR_FINGERPRINT
+                    }
                     HardwareAuthenticatorType::ANY => MetricsHardwareAuthenticatorType::ANY,
                     _ => MetricsHardwareAuthenticatorType::AUTH_TYPE_UNSPECIFIED,
                 }
@@ -792,14 +798,14 @@
     SECURITY_LEVEL_KEYSTORE => "KEYSTORE",
 );
 
-// Metrics values for HardwareAuthenticatorType are broken -- the AIDL type is a bitmask
-// not an enum, so offseting the enum values by 1 doesn't work.
-impl_summary_enum!(MetricsHardwareAuthenticatorType, 6,
+impl_summary_enum!(MetricsHardwareAuthenticatorType, 8,
     AUTH_TYPE_UNSPECIFIED => "UNSPEC",
     NONE => "NONE",
     PASSWORD => "PASSWD",
     FINGERPRINT => "FPRINT",
+    PASSWORD_OR_FINGERPRINT => "PW_OR_FP",
     ANY => "ANY",
+    NO_AUTH_TYPE => "NOAUTH",
 );
 
 impl_summary_enum!(MetricsPurpose, 7,