1

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK file.

I have some questions regarding this:

(1) How did Google insert this the metadata into APK signing block of the APK and how it verifies that metadata on the phone (technically)?

I guess it is possible to create custom content in this signing block? Let's say I want to distribute some APK privately in my company, when the user installs that APK then I can figure out if the APK belongs to our company or not, just like Google did with their apps in Play Store.

(2) If all developers use App Signing by Google Play, then does the mentioned security metadata above become unnecessary? Because Google can just simply verify the certificate inside each APK instead.

My apologies for the shallow understanding. Any comments are highly appreciated!

3
  • The signature is most likely an RSA or EX(DSA) signature. For verifying you only need the corresponding public key on the device. For info on the APK signature block see source.android.com/security/apksigning/…
    – Robert
    Nov 12, 2018 at 20:17
  • Thank you but I need more technical details of how it works. In terms of source code if necessary
    – Long
    Oct 23, 2019 at 6:58
  • The Google signature (aka "Frosting") is not documented anywhere. The only information I have is more or less summarized here: stackoverflow.com/questions/48090841 Especially the linked avast/apkverifier project contains some details.
    – Robert
    Oct 23, 2019 at 7:22

1 Answer 1

0

How did Google insert this the metadata into APK signing block of the APK and how it verifies that metadata on the phone (technically)?

Technically the Google "Frosting" signature is inserted the same way as described in the APK Signature Scheme v2. Note that it is just added to the same section inside the ZIP file - it does not replace any existing signatures in this section.

I guess it is possible to create custom content in this signing block? Let's say I want to distribute some APK privately in my company, when the user installs that APK then I can figure out if the APK belongs to our company or not, just like Google did with their apps in Play Store.

As far as I know the only "meta data" is the signature itself. If it is present it is an APK from Play Store.

If all developers use App Signing by Google Play, then does the mentioned security metadata above become unnecessary? Because Google can just simply verify the certificate inside each APK instead.

No. The Google Frosting signature is just an additionally signature. The Android permission model still relies on the common APK signature by the developer. Only the Google Play Store app is able to verify the Google frosting signature. The other parts of the Android system (those from AOSP) don't even recognize this signature.

For more technical details see this question + answers on Stackoverflow: Security Metadata in Android APK

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .