Merge "docs: Migrated "key attestation" page to a new location (for N OTA)." into nyc-dev

docs/html/_redirects.yaml

@@ -1201,3 +1201,8 @@ redirects:
   to: /studio/intro/index.html?utm_medium=android-studio
 - from: /r/studio-ui/menu-start.html
   to: /training/index.html?utm_medium=android-studio
+
+# N Preview redirects
+
+- from: /preview/features/key-attestation.html
+  to: /training/articles/security-key-attestation.html

docs/html/training/_book.yaml

@@ -1373,6 +1373,11 @@ toc:
     path_attributes:
     - name: description
       value: How to use the SafetyNet service to analyze a device where your app is running and get information about its compatibility with your app.
+  - title: Verifying Hardware-backed Key Pairs with Key Attestation
+    path: /training/articles/security-key-attestation.html
+    path_attributes:
+    - name: description
+      value: How to retrieve and verify the properties of a device's hardware-backed key pair.
   - title: Enhancing Security with Device Management Policies
     path: /work/device-management-policy.html
     path_attributes:

docs/html/training/articles/security-key-attestation.jd

@@ -1,11 +1,11 @@
 page.title=Key Attestation
-page.metaDescription=New support in Android N for verifying security properties of hardware-backed keys.
+page.metaDescription=A tool for verifying security properties of hardware-backed key pairs.
-page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "certificate", "key attestation"
+page.keywords="security", "TEE", "hardware-backed", "keystore", "certificate", "key attestation"
 
 @jd:body
 
-<div id="qv-wrapper">
+<div id="tb-wrapper">
-  <div id="qv">
+  <div id="tb">
     <h2>In this document</h2>
       <ol>
         <li><a href="#verifying">Retrieving and Verifying a Hardware-backed Key Pair</a></li>
@@ -22,14 +22,14 @@ page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "ce
 </p>
 
 <p class="note">
-  <strong>Note: </strong>Only a small number of devices running Android N
+  <strong>Note: </strong>Only a small number of devices running Android 7.0 (API
-  support hardware-level key attestation; all other devices running Android N
+  level 24) support hardware-level key attestation; all other devices running
-  use software-level key attestation instead. Before you verify the properties
+  Android 7.0 use software-level key attestation instead. Before you verify the
-  of a device's hardware-backed keys in a production-level environment, you
+  properties of a device's hardware-backed keys in a production-level
-  should make sure that the device supports hardware-level key attestation. To
+  environment, you should make sure that the device supports hardware-level key
-  do so, you should check that the attestation certificate chain contains a root
+  attestation. To do so, you should check that the attestation certificate chain
-  certificate that is signed by the Google attestation root key and that the
+  contains a root certificate that is signed by the Google attestation root key
-  <code>attestationSecurityLevel</code> element within the <a
+  and that the <code>attestationSecurityLevel</code> element within the <a
   href="#certificate_schema_keydescription">key description</a> data structure
   is set to the TrustedEnvironment security level.
 </p>
@@ -45,15 +45,17 @@ page.keywords="android N", "security", "TEE", "hardware-backed", "keystore", "ce
 </p>
 
 <p>
-  The root certificate within this chain is signed using an attestation key,
+  If the device supports hardware-level key attestation, the root certificate
-  which the device manufacturer injects into the device’s hardware-backed
+  within this chain is signed using an attestation root key, which the device
-  keystore at the factory.
+  manufacturer injects into the device’s hardware-backed keystore at the
+  factory.
 </p>
 
 <p class="note">
-  <strong>Note:</strong> On devices that ship with Android N and Google Play
+  <strong>Note:</strong> On devices that ship with hardware-level key
-  services, the root certificate is issued by Google. You should verify that
+  attestation, Android 7.0 (API level 24), and Google Play services, the root
-  this root certificate appears within Google’s list of root certificates.
+  certificate is signed by the Google attestation root key. You should verify
+  that this root certificate appears within Google’s list of root certificates.
 </p>
 
 <p>
@@ -231,7 +233,7 @@ VerifiedBootState ::= ENUMERATED {
   </dd>
 
   <dt>
-    <code>attestationSecurity</code>
+    <code>attestationSecurityLevel</code>
   </dt>
 
   <dd>
@@ -242,8 +244,8 @@ VerifiedBootState ::= ENUMERATED {
 
     <p class="caution">
       <strong>Warning:</strong> Although it is possible to attest keys that are
-      stored in the Android system&mdash;that is, if the
+      stored in the Android system&mdash;that is, if the value of
-      <code>attestationSecurity</code> value is set to Software&mdash;you
+      <code>attestationSecurityLevel</code> is set to Software&mdash;you
       cannot trust these attestations if the Android system becomes compromised.
     </p>
   </dd>
@@ -259,7 +261,7 @@ VerifiedBootState ::= ENUMERATED {
   </dd>
 
   <dt>
-    <code>keymasterSecurity</code>
+    <code>keymasterSecurityLevel</code>
   </dt>
 
   <dd>
@@ -357,7 +359,8 @@ VerifiedBootState ::= ENUMERATED {
 <p>
   Each field name corresponds to a similarly-named Keymaster tag. For example,
   the <code>keySize</code> field in an authorization list corresponds to the
-  <code>KM_TAG_KEY_SIZE</code> Keymaster tag.
+  <a href="https://source.android.com/security/keystore/implementer-ref.html#km_tag_key_size">
+  <code>KM_TAG_KEY_SIZE</code></a> Keymaster tag.
 </p>
 
 <p>
@@ -780,7 +783,7 @@ VerifiedBootState ::= ENUMERATED {
   <dd>
     The month and year associated with the security patch that is currently
     installed on the device, specified as a six-digit integer. For example, the
-    June 2016 patch is represented as 201606.
+    August 2016 patch is represented as 201608.
   </dd>
 </dl>