The news about the removal of the Crypto provider from Android N was announced by Google, where you expect it to happen this Fall.
Specifically, Android is a system built in Java and uses Java Cryptography Architecture (JCA) to enable developers to write and manage encryption functionality in their code.
JCA is an important part of the Java platform that can work with various types of algorithms, each time differently based on the principles and purpose of the algorithm. So when the programmer wants to run businesses that operate with encryption, they invoke one of these algorithms by loading their provider, and then they select the desired encryption algorithm.
Android supports most of the JCA providers, some of them are: OpenSSL, BC, HarmonyJSSE, DRLCertFactory.
Before Android N, one of these providers was Crypto, which included support for algorithms like SHA1PRNG, SHA1withDSA, DSA, and SHA-1. As you can see now, most of these algorithms are considered weak and insecure.
As stated by Sergio Giro (Android software engineer)
"In Android N, we will deprecate the implementation of the SHA1PRNG algorithm and Crypto as a provider altogether. Developers will need to convert their code to use other JCA providers."
The company is now advising developers to rewrite their applications if they used Crypto, and specifically the SHA1PRNG algorithm.
Many developers use this algorithm to create encryption key derivatives. SHA1PRNG allowed developers to take a user password and expand a smaller key into a larger encryption key.
“The problem is that the SHA1PRNG algorithm is not cryptographically strong”
Giro states and therefore advises developers to use stronger algorithms like AES if they need to generate a key.
