Purpose of android app certificates

Question

I want to clarify a confusion I have related to Android app certificates (used during installation).

In the web, certificates are used to map a public key with domain / identity (organization). The hash of the details is signed by CA, then verified by the browser.

An Android app ships with a public key. Based on my understanding, the developer could use his own private key, sign the hash of the app, then ship app with his public key. This information is used by installer.

My questions are:

1. Even if some CA was used, app would still be shipped with CA's public key - does it matter who owns the signing public key ? it could be anyone, as installer will just use it.

2. Is integrity checking the only thing android app certificate is used for ? App has a no public key like a website, so certificate is not being used to associate some public key with the app. Is there any other purpose for the certificate ?

Answer 1

does it matter who owns the signing public key ?

No. Usually, they are self-signed.

Is integrity checking the only thing android app certificate is used for ?

It is also used to answer two permission-related questions:

1. Is App A signed by the same signing key as App B? If yes, then those apps may be able to interoperate more closely than two arbitrary apps.

2. Is App A signed by the same signing key that signed the firwmare? If yes, then App A can hold certain permissions that are reserved for device manufacturers and custom ROM developers.

Also, developers can validate the signature of other apps, which can be useful for ensuring that you are talking to the proper app.

Answer 2

does it matter who owns the signing public key ? it could be anyone, as installer will just use it.

• Yes it will. Anyone can write an app, self-sign the certificate, and publish apps using it. The private key is still controlled by the owner, and he/she gets to control all the app's capabilities and any future updates to the app, as explained below.

Is integrity checking the only thing android app certificate is used for ?

Nope, it serves more than that:

• When installing Over-the-Air app updates, the device will confirm that the updated app's certificates match the existing one. If the developer were to sign the app with a new key, he/she should change the package name; without this, Google Play does not let the developer update the application. If the developer does want to change the signing keys, he/she will be forced to change the Application's package name, and hence this will show up as a new application altogether in the Play Store.

• Two or more applications using the same public key can share data amongst each other. Permissions can be signature based for instance to allow this.

• It is also possible for 2 or more applications signed using the same key to run in the same process group, and even share code and state.

More details available in the Android Developer page - https://developer.android.com/tools/publishing/app-signing.html#considerations