› › › › ›

APK Signature Scheme v3 is coming with support for Key Rotation

Encrypting your link and protect the link from viruses, malware, thief, etc! Made your link safe to visit.


  • The biggest headlining feature of v3, meant to be a revision of v2, will be key rotation support.(Source - XDA)


Application signing allows developers to identify the author of the application and to update their application without creating complicated interfaces and permissions. Every application that is run on the Android platform must be signed by the developer. Applications that attempt to install without being signed will be rejected by either Google Play or the package installer on the Android device.
On Google Play, application signing bridges the trust Google has with the developer and the trust the developer has with their application. Developers know their application is provided, unmodified, to the Android device; and developers can be held accountable for behavior of their application.
On Android, application signing is the first step to placing an application in its Application Sandbox. The signed application certificate defines which user ID is associated with which application; different applications run under different user IDs. Application signing ensures that one application cannot access any other application except through well-defined IPC.
When an application (APK file) is installed onto an Android device, the Package Manager verifies that the APK has been properly signed with the certificate included in that APK. If the certificate (or, more accurately, the public key in the certificate) matches the key used to sign any other APK on the device, the new APK has the option to specify in the manifest that it will share a UID with the other similarly-signed APKs.
Applications can be signed by a third-party (OEM, operator, alternative market) or self-signed. Android provides code signing using self-signed certificates that developers can generate without external assistance or permission. Applications do not have to be signed by a central authority. Android currently does not perform CA verification for application certificates.
Applications are also able to declare security permissions at the Signature protection level, restricting access only to applications signed with the same key while maintaining distinct UIDs and Application Sandboxes. A closer relationship with a shared Application Sandbox is allowed via the shared UID featurewhere two or more applications signed with same developer key can declare a shared UID in their manifest.

Current APK signing schemes :
Android supports two application signing schemes, one based on JAR signing (v1 scheme) and APK Signature Scheme v2 (v2 scheme), which was introduced in Android Nougat (Android 7.0).
For maximum compatibility, applications should be signed both with v1 and v2 schemes. Android Nougat and newer devices install apps signed with v2 scheme more quickly than those signed only with v1 scheme. Older Android platforms ignore v2 signatures and thus need apps to contain v1 signatures.