Only use APK Signing v3 instead of v2 #164

New issue

Open

opened 2025-08-19 18:22:26 +03:00 by MateusRodCosta · 2 comments

MateusRodCosta commented

2025-08-19 18:22:26 +03:00

(Migrated from github.com)

There are three current APK signature versions on Android:

v1 (aka JAR signing) - the basic version introduced with Android
v2 - introduced in Android 7.0 due to the Janus vulneraibility
v3 - improves upon v2 with key rotation

If you build an APK with a recent AGP you should get the following:

v2 is always enabled by default
v1 is enabled if the app supports versions lower than Android 7.0
v3 is is not enabled by default at all

Since Phocid supports only Android 11+, this implies nothing under Android 9 is supported, which makes it a candidate to disabling v2 signing and having only v3 enabled.

This can be done like this on the build.gradle:

enableV2Signing = false
enableV3Signing = true

There are three current APK signature versions on Android: * v1 (aka JAR signing) - the basic version introduced with Android * [v2](https://source.android.com/docs/security/features/apksigning/v2) - introduced in Android 7.0 due to the [Janus vulneraibility](https://www.trendmicro.com/en_us/research/17/l/janus-android-app-signature-bypass-allows-attackers-modify-legitimate-apps.html) * [v3](https://source.android.com/docs/security/features/apksigning/v3) - improves upon v2 with key rotation If you build an APK with a recent AGP you should get the following: * v2 is always enabled by default * v1 is enabled if the app supports versions lower than Android 7.0 * v3 is is not enabled by default at all Since Phocid supports only Android 11+, this implies nothing under Android 9 is supported, which makes it a candidate to disabling v2 signing and having only v3 enabled. This can be done like this on the build.gradle: ``` enableV2Signing = false enableV3Signing = true ```

TJYSunset commented

2025-08-19 20:35:43 +03:00

(Migrated from github.com)

Is there actually any benefit in doing so besides the ability to rotate keys? Since Android is an unpredictable mess as far as I know it, I'm not very into testing what bugs this will bring in the wild if all it does is making the version number pretty.

MateusRodCosta commented

2025-08-19 21:08:42 +03:00

(Migrated from github.com)

Is there actually any benefit in doing so besides the ability to rotate keys? Since Android is an unpredictable mess as far as I know it, I'm not very into testing what bugs this will bring in the wild if all it does is making the version number pretty.

Ok, so I did search a bit and found this presentation by a Google expert: https://speakerdeck.com/akexorcist/why-app-signing-matters-for-your-android-apps-android-bangkok-conference-2024

So, basically, v1 is very insecure and basically any v2+ version is good enough, but v3 seems to be mostly useful for Google Play App Signing.
Since you don't actually publish to the Play Store right now nor has any interest in doing so in the future, there might be no benefits for you particularly.

In any case, while I did suggest disabling v2 signing and only enabling v3, it should be possible to have both v2 and v3 at the same time. But again I can't say you will have any big benefits.

Hey, thanks for looking into it. APK signing v3 (along with uncompressed DEX) were some of the reasons I dropped pre-Android 9 support from my apps, they might not be changes that relevant but I think it's worth taking a look. > Is there actually any benefit in doing so besides the ability to rotate keys? Since Android is an unpredictable mess as far as I know it, I'm not very into testing what bugs this will bring in the wild if all it does is making the version number pretty. Ok, so I did search a bit and found this presentation by a Google expert: https://speakerdeck.com/akexorcist/why-app-signing-matters-for-your-android-apps-android-bangkok-conference-2024 So, basically, v1 is very insecure and basically any v2+ version is good enough, but v3 seems to be mostly useful for Google Play App Signing. Since you don't actually publish to the Play Store right now nor has any interest in doing so in the future, there might be no benefits for you particularly. In any case, while I did suggest disabling v2 signing and only enabling v3, it should be possible to have both v2 and v3 at the same time. But again I can't say you will have any big benefits.

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

novvux/Blissid#164

No description provided.

Rows
Columns