CODEWITHSUNDEEP
androiddigital-signaturepublic-key
knokej
knokej

Reputation: 71

Where does Android get the public key to validate an APK signature?

I see in internet sources that the APK contains the signature, but I see nothing about the public key needed to validate the signature. Does the Play Store download the public key (or certificate) along with the APK? Does Android have to ask the Play Store for the public key when needed? Am I missing something and the APK itself contains both the signature and the public key (which seems like a security problem)?

I realize that the Play Store will have the public key, either because it generated the key pair or because the developer uploaded the public key.

Note that I am not asking about the licensing key or upload key.

Upvotes: 1

Views: 1648

Answers (1)

Robert
Robert

Reputation: 42575

You don't need a separate public key because it is included in the signing certificate and the signing certificate is included in the signature.

Therefore you just need the APK files for verifying it's signature. Of course a verified signature does not get you any information about it's authenticity as nearly all APK signatures are created by self-signed certificates.

Upvotes: 1

Related Questions