1838680 - Apk/AAB signing: Update Signing Secure Hash Algorithm to a Stronger Algorithm

Status: NEW

(Cloud Services :: Operations: Autograph, enhancement)

Description

[Roger Yang [:royang]]

Currently Firefox Android Signing Secure Hash Algorithm is SHA1withRSA. Please upgrade this to a stronger hashing algorithm.

Comment 1

[Johan Lorenzo [:jlorenzo]]

I see what's going on. The misconfiguration is on the Autograph side. No matter the APK we provide, Autograph forces[1] the --min-sdk-version flag to either API level 9[2] or 18[3]. Both levels are ancient[4] and actually predate the minimum API level Fenix (and Focus) require[5]. This implementation[6] was suited for Fennec but it's of no use today.

As a matter of fact apksigner uses the value defined in the APK metadata[7]. We should just do that. Here's what happens when I sign an APK without forcing the API level:

wget https://archive.mozilla.org/pub/fenix/releases/114.0/android/fenix-114.0-android-arm64-v8a/fenix-114.0.multi.android-arm64-v8a.apk -O fenix.apk
keytool -genkeypair -alias somealias -keyalg RSA -keystore keystore.jks
apksigner sign --v1-signing-enabled true --v2-signing-enabled true --v3-signing-enabled false --ks keystore.jks fenix.apk
unzip -p fenix.apk META-INF/SOMEALIA.SF | tail

Name: transport-runtime.properties
SHA-256-Digest: NfdWH4HAp6JsGXf69miAW7x4gM+owOeuYpxtCsnvvv0=

I also checked what API level switches to sha256: it's API level 18. Fenix ships API level 21. Therefore, upgrading the digest hash has no risk and is will benefit users.

[1] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L161
[2] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L86
[3] https://github.com/mozilla-services/autograph/blob/8a34847a0f546a9734a16e49460e6ba867ff6d29/signer/apk2/apk2.go#L82
[4] https://developer.android.com/tools/releases/platforms
[5] https://github.com/mozilla-mobile/firefox-android/blob/3a2135d7a564e72c86198da1b43c67b0d6c5387f/android-components/.config.yml#L6
[6] https://github.com/mozilla-services/autograph/commit/8a81bd3b256bb9ddd499e15bcdadd26523b921a6#diff-4ee034ddcad5186c45b707fe39a7a68096d244ccedd6d705d143243cbdc39145R58
[7] https://developer.android.com/tools/apksigner#options-sign-general

Comment 2

[Johan Lorenzo [:jlorenzo]]

Attachment: [mozilla-services/autograph] Bug 1838680 - Do not force --min-sdk-version anymore because of outda… #852

Comment 3

[BMO Github Automation]

Attachment: [mozilla-mobile/firefox-android] Bug 1838680 - Try stronger digest for APK signatures (#2886)

Comment 4

[Chris Peterson [:cpeterson]]

Johan, what's the state of this bug? You posted a PR four months ago, but it was closed recently because it had no recent activity: https://github.com/mozilla-mobile/firefox-android/pull/2886

Also, does this bug need to be synced to Jira? This bug has a [fxdroid] whiteboard tag used to sync a bug to the Android team's FXDROID Jira project, but the Jira automation didn't create a Jira issue because this Bugzilla component (Cloud Services::Operations: Autograph) is not registered as an Android team component.

Comment 5

[Johan Lorenzo [:jlorenzo]]

Thanks for the ping, :cpeterson!

Let me start with the good news first: this ticket is not as important as it used to be. The main reason is: we switched Fenix to AAB which means Google signs APKs for us with the latest signing format. That being said, we still want to provide the latest format on archive.mozilla.org for instance. This means this tickets has to move forward anyway. It's just not as important anymore.

Thanks for the clarification on the whiteboard tag. I don't think we need it to be on Jira. It's just something among RelEng and SecOps. Let's keep it here on Bugzilla, then.

Comment 6

[Johan Lorenzo [:jlorenzo]]

While handling bug 2051963, I see that jarsigner (which is used to validate AABs) now complains about SHA1:

jarsigner -verify -verbose fenix.aab                                                                                                

[...] m  ? 165374008 Thu Jan 01 01:00:00 CET 1970 base/lib/x86_64/libxul.so
 m  ? 135368 Thu Jan 01 01:00:00 CET 1970 base/manifest/AndroidManifest.xml
 m  ?    833 Thu Jan 01 01:00:00 CET 1970 base/assets.pb
 m  ?     68 Thu Jan 01 01:00:00 CET 1970 base/native.pb
 m  ? 18064008 Thu Jan 01 01:00:00 CET 1970 base/resources.pb
      338159 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.SF
        1451 Tue Jan 01 00:00:00 CET 1980 META-INF/APK2_FEN.RSA
      338054 Tue Jan 01 00:00:00 CET 1980 META-INF/MANIFEST.MF

  s = signature was verified
  m = entry is listed in manifest
  k = at least one certificate was found in keystore
  ? = unsigned entry

- Signed by "CN=Release Engineering, OU=Release Engineering, O=Mozilla Corporation, L=Mountain View, ST=California, C=US"
    Digest algorithm: SHA1 (disabled)
    Signature algorithm: SHA1withRSA (disabled), 2048-bit RSA key

WARNING: The jar will be treated as unsigned, because it is signed with a weak algorithm that is now disabled by the security property:

  jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, DSA keySize < 1024, SHA1 denyAfter 2019-01-01

jarsigner -version
jarsigner 26.0.1

Per JDK-8264362, this new behavior was added to all supported versions of OpenJDK in 2022. It's not a blocker but it makes verifying AAB signatures trickier.