1

According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK file.

I have some questions regarding this:

(1) How did Google insert this the metadata into APK signing block of the APK and how it verifies that metadata on the phone (technically)?

I guess it is possible to create custom content in this signing block? Let's say I want to distribute some APK privately in my company, when the user installs that APK then I can figure out if the APK belongs to our company or not, just like Google did with their apps in Play Store.

(2) If all developers use App Signing by Google Play, then does the mentioned security metadata above become unnecessary? Because Google can just simply verify the certificate inside each APK instead.

My apologies for the shallow understanding. Any comments are highly appreciated!

  • The signature is most likely an RSA or EX(DSA) signature. For verifying you only need the corresponding public key on the device. For info on the APK signature block see source.android.com/security/apksigning/… – Robert Nov 12 '18 at 20:17
  • Thank you but I need more technical details of how it works. In terms of source code if necessary – Long Oct 23 '19 at 6:58
  • The Google signature (aka "Frosting") is not documented anywhere. The only information I have is more or less summarized here: stackoverflow.com/questions/48090841 Especially the linked avast/apkverifier project contains some details. – Robert Oct 23 '19 at 7:22
0

How did Google insert this the metadata into APK signing block of the APK and how it verifies that metadata on the phone (technically)?

Technically the Google "Frosting" signature is inserted the same way as described in the APK Signature Scheme v2. Note that it is just added to the same section inside the ZIP file - it does not replace any existing signatures in this section.

I guess it is possible to create custom content in this signing block? Let's say I want to distribute some APK privately in my company, when the user installs that APK then I can figure out if the APK belongs to our company or not, just like Google did with their apps in Play Store.

As far as I know the only "meta data" is the signature itself. If it is present it is an APK from Play Store.

If all developers use App Signing by Google Play, then does the mentioned security metadata above become unnecessary? Because Google can just simply verify the certificate inside each APK instead.

No. The Google Frosting signature is just an additionally signature. The Android permission model still relies on the common APK signature by the developer. Only the Google Play Store app is able to verify the Google frosting signature. The other parts of the Android system (those from AOSP) don't even recognize this signature.

For more technical details see this question + answers on Stackoverflow: Security Metadata in Android APK

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.