CODEWITHSUNDEEP
androidrsasha1android-security
sejn
sejn

Reputation: 2644

How to update the android keystore Signature algorithm name: SHA1withRSA (weak) to a strong key

How to update the android keystore Signature algorithm name: SHA1withRSA (weak) to a strong key

Signature algorithm name: SHA1withRSA (weak)
Subject Public Key Algorithm: 1024-bit RSA key (weak)
Version: 3

Warning:
The certificate uses the SHA1withRSA signature algorithm which is considered a security risk. This algorithm will be disabled in a future update.
The certificate uses a 1024-bit RSA key which is considered a security risk. This key size will be disabled in a future update.

Upvotes: 3

Views: 9418

Answers (1)

Maarten Bodewes
Maarten Bodewes

Reputation: 94018

As the warning indicates, there are two problems. It is not possible to "update an algorithm ... to a strong key".

The certificate uses the SHA1withRSA signature algorithm which is considered a security risk. This algorithm will be disabled in a future update.

This is because the collision resistance of SHA-1 has been SHAttered. Use signatures with SHA-256 ("SHA256withRSA") or SHA-512 ("SHA512withRSA") to counter this. You could also take a look into PSS signtures, although the PKCS#1 v1.5 signature format that "SHA256withRSA" implements is still considered secure.

The certificate uses a 1024-bit RSA key which is considered a security risk. This key size will be disabled in a future update.

To have a 128 bit security it is necessary to upgrade to 3072 bit RSA key pairs. This means regeneration of the key pair and probably requesting a new certificate as well. 2048 bit RSA keys are still in common use, but I would only use this minimum key size for backwards compatibility reasons (or, indeed, if larger key sizes are not feasible for either you or your CA).

Upvotes: 5

Related Questions