9

我想用两件事作为这个问题的开头，这样我就可以缩小我的实际问题所在：

a) 我以前做过软件开发，虽然从来没有做过安卓

b) 我熟悉 PKI 和加密、散列和数字签名等等等等

话虽如此，我无法找到有关 Android 在何处以及如何验证应用程序创建者的更多信息。我听到了很多不同的信息，所以我试图综合以更好地了解工作流程。

我知道每个应用程序开发人员都有自己的私钥/公钥对，他们通过对 APK 进行哈希处理（如果我没记错的话，大部分时间使用 SHA-1）来签署他们的应用程序，然后就可以了。您上传它并且（我相信）公钥进入 APK 内的 META INF。这点我明白了。

我的问题是这与用户下载应用程序本身时有何关系。我知道电话会检查以确保应用程序已有效签名，并且签名还包含有关作者等的信息。但我也读到应用程序是自签名的，Google Play（或他们现在称之为 Market 的任何东西）没有实现 CA，并且没有身份验证？但我的问题是，什么会阻止人们以其他开发人员的名义上传应用程序（众包除外）？

如果手机只检查有效签名，这是否意味着在上传应用程序时完成了唯一的身份验证方式？如果是这种情况，应用市场如何检查呢？这是通常的 - 使用文件中的私钥并验证签名吗？还是开发者必须向市场提供他们的私钥来进行身份验证？

4

1 回答 1

11

In short, Android and Google Play essentially don't care about what's in actual certificate. Google Play will validate it indeed, and check if it is valid for 30 years or more, but they don't really use (at least currently, AFAIK) the actual info in the cert. You could use your own name/company name in the CN, but no one will validate this, and users won't see this info at all. What Android does is:

  • check the signature to make sure the APK hasn't been tampered with
  • then compare the singing certificate as a binary blob to the one of the currently installed version of the app to make sure that the two versions have been signed with the same key/certificate (e.g., by the same person/company)
  • it does the same thing to enforce permission if you are using using sharedUid or signature permissions with two or more apps.

So, to answer your question, someone can easily create a certificate with your name on it, but Android and Google Play don't really care. As long as they don't have your private key, they won't be able produce an app signature that is the same as yours and thus they wouldn't be able to overwrite/update your app with theirs, or get any special permissions.

于 2012-06-08T02:19:36.323 回答