How To Use The New Android 7.0 Signature Scheme V2 For More Protection Against Unauthorized Alteration To APK Files

Android 7.0 introduces APK Signature Scheme v2, a new app-signing scheme that offers faster app install times and more protection against unauthorized alterations to APK files.

If your app is still using the V1 signature scheme then a hacker can easily tamper the digital signature of your APK files using the nkstool. Click here to learn how.

If you're using the V2 signature then the nkstool won't work, it will run with error like this:

The nkstool will look for the file called ***.RSA which contains your digital signature. If you are using the V2 signature scheme then that RSA file is no longer needed and it will not be included in your release package.

Enable V2 Signature

To use this new signature scheme, simply set minSdkVersion to api 24 or set the v2SigningEnabled to true in your module gradle build.

  android {
    ...
    defaultConfig { ... }
    signingConfigs {
      release {
        storeFile file("myreleasekey.keystore")
        storePassword "password"
        keyAlias "MyReleaseKey"
        keyPassword "password"
        v2SigningEnabled true
      }
    }
  }