CDD: Disallow modifying the default security provider list
- Security-related functionality is implemented by providing generic
classes for a category of security functionality (such as
javax.crypto.Cipher) and then security providers are registered that
provide specific implementations of that functionality which are
identified by a string identifier (such as "AES/GCM /NOPADDING").
- Interoperability is key for security functionality, and this
requirement prevents device manufacturers from adding new security
providers that are higher priority than the AOSP implementations and
thus returning a different implementation than an app expects when
it requests a specific identifier.
- If a device manufacturer wants to provide additional security
functionality, they can put it at the end of the list, which means
that developers will need to ask for it explicitly.
Test: manual inspection
Bug: 76462676
Change-Id: I20c2b6eb83488457fbebbbee6ddd10955c15410e
1 file changed