text: # Sec Change Summary for N Preview
  
  ## Key Attestation
  
  Can prove to 3rd partys that a hardware keystore exists with certain keys by signing a representation using a factory 
  supplied key
  
  > To ensure that the device is using a secure, official Android factory image, Key Attestation requires that the device bootloader provide the following information to the Trusted Execution Environment (TEE)...
  
  [from](http://developer.android.com/preview/api-overview.html#key_attestation) 
  
  ## Network Security Config
  
  > In Android N, apps can customize the behavior of their secure (HTTPS, TLS) connections safely, without any code modification, by using the declarative Network Security Config instead of using the conventional error-prone programmatic APIs (e.g. X509TrustManager)
    - Custom trust anchors.
    - Debug-only overrides. 
    - Cleartext traffic opt-out. 
    - Certificate pinning. 
  
  [from](http://developer.android.com/preview/api-overview.html#network_security_config) 
  
  - `<network-security-config>`
  - Custom trust achors 
    - can be specified for debug use only
    - trust root for domain(s) (so no need to purchase a cert)
  
  See [Changes to Trusted Certificate Authorities in Android Nougat](http://android-developers.blogspot.co.uk/2016/07/changes-to-trusted-certificate.html) for more. 
    
  
  ## APK signature scheme v2
  
  > The PackageManager class now supports verifying apps using the APK signature scheme v2. The APK signature scheme v2 is a whole-file signature scheme that significantly improves verification speed and strengthens integrity guarantees by detecting any unauthorized changes to APK files.
  
  [from](http://developer.android.com/preview/api-overview.html#network_security_config)
  
  ## Verified Boot
  
  Now in 'enforcing' mode.
  
  ## Direct Boot
  
  > Android N runs in a secure, Direct Boot mode when the device has been powered on but the user has not unlocked the device.
  
  Introduces
  
  - _Credential encrypted storage_, which is the default storage location and only available after the user has unlocked the device.
  - _Device encrypted storage_, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.
  
  [from](http://developer.android.com/preview/features/direct-boot.html)
  
  ## Crypto security provider has been ~~removed~~ deprecated.  
  
  > You should only call to the Java Cryptography Extension (JCE) APIs with a provider listed if the provider is included in the code of the APK. Otherwise, your app needs to be able to handle the provider’s absence.
  
  > The reason apps use this provider is to take advantage of its SecureRandom implementation. If your app was relying on setSeed() to derive keys from strings, you must either switch to using SecretKeySpec to load raw key bytes directly, or use a real key derivation function (KDF).
  
  This was originally copied from [the N release notes](http://developer.android.com/preview/behavior-changes.html#open-jdk) but has since been removed (less than 24 hours after publishing. It was found under the heading _Platform Migration toward OpenJDK 8_.
  
  This has now been clarified with [Security "Crypto" provider deprecated in Android N](http://android-developers.blogspot.co.uk/2016/06/security-crypto-provider-deprecated-in.html?utm_source=androiddevdigest).
  
  > Note 1: as a temporary measure to keep apps working, we decided to still create the instance for apps targeting SDK version 23, the SDK version for Marshmallow, or less. Please don't rely on the presence of the Crypto provider in the Android SDK, our plan is to delete it completely in the future.
  
  > Note 2: Because many parts of the system assume the existence of a SHA1PRNG algorithm, when an instance of SHA1PRNG is requested and the provider is not specified we return an instance of OpenSSLRandom, which is a strong source of random numbers derived from OpenSSL.
  
  ## **MUST** have a hardware KeyStore
  
  > When the device implementation supports a secure lock screen it MUST back up the keystore implementation with secure hardware...
  
  From [Android 7.0 Compatibility Definition](http://source.android.com/compatibility/7.0/android-7.0-cdd.html#9_11_keys_and_credentials)
  
  This is only if _shipped_ with 7. See the KeyStore section in this guide for more info.
  
  ## Other
  
  - [`seccomp`](https://en.wikipedia.org/wiki/Seccomp) api now available natively 
    - See [IO16 talk](https://youtu.be/XZzLjllizYs?list=PLWz5rJ2EKKc8jQTUYvIfqA9lMvSGQWtte&t=2622) for more.
    - Can be used to restrict process operations 
  - `/proc/` and `/sys/` restrictions [issuetracker.google](https://issuetracker.google.com/issues/37091475)
    - Can access process info via `PACKAGE_USAGE_STATS` but the obtaining of this perm is a [bit crummy](https://stackoverflow.com/a/36822181/236743)
  - [ioctl](https://android-developers.googleblog.com/2016/07/protecting-android-with-more-linux.html)? 
  