[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-27 (世界標準時間)。"],[],[],null,["# APK signature scheme v3\n\nAndroid 9 supports [APK\nkey rotation](https://developer.android.com/about/versions/pie/android-9.0#apk-key-rotation), which gives apps the ability to change their signing key as\npart of an APK update. To make rotation practical, APKs must indicate levels of\ntrust between the new and old signing key. To support key rotation, we updated\nthe [APK signature\nscheme](/docs/security/features/apksigning/v2) from v2 to v3 to allow the new and old keys to be used. V3 adds\ninformation about the supported SDK versions and a proof-of-rotation struct to\nthe APK signing block.\n| **Note** : APK key rotation is **not** recommended for Android 12 (API level 31) and earlier. In Android 13 (API level 33) and higher, `checkSignatures` recognizes the proof-of-rotation and returns the newest signature. Developers enrolled in Play App Signing can request a [key\n| upgrade](https://support.google.com/googleplay/android-developer/answer/9842756?visit_id=637956329958708614-3522265763&rd=1#upgrade&zippy=%2Crequest-a-key-upgrade-for-new-installs-not-suitable-for-all-apps%2Crequest-a-key-upgrade-for-all-installs-on-android-t-api-level-and-above-recommended) through the Play console.\n\nAPK signing block\n-----------------\n\n\nTo maintain backward-compatibility with the v1 APK format, v2 and v3 APK\nsignatures are stored inside an APK signing block, located immediately before\nthe ZIP Central Directory.\n\n\nThe v3 APK signing block format is the [same\nas v2](/docs/security/features/apksigning/v2#apk-signing-block-format). The v3 signature of the APK is stored as an ID-value pair with ID\n0xf05368c0.\n\nAPK signature scheme v3 block\n-----------------------------\n\n\nThe v3 scheme is designed to be very similar to the [v2\nscheme](/docs/security/features/apksigning/v2#apk-signature-scheme-v2-block). It has the same general format and supports the same [signature\nalgorithm IDs](/docs/security/features/apksigning/v2#signature-algorithm-ids), key sizes, and EC curves.\n\n\nHowever, the v3 scheme adds information about the supported SDK versions and the\nproof-of-rotation struct.\n\n### Format\n\n\nAPK signature scheme v3 block is stored inside the APK signing block under ID\n`0xf05368c0`.\n\n\nThe format of the APK signature scheme v3 block follows that of v2:\n\n- length-prefixed sequence of length-prefixed `signer`:\n - length-prefixed `signed data`:\n - length-prefixed sequence of length-prefixed `digests`:\n - `signature algorithm ID` (4 bytes)\n - `digest` (length-prefixed)\n - length-prefixed sequence of X.509 `certificates`:\n - length-prefixed X.509 `certificate` (ASN.1 DER form)\n - `minSDK` (uint32) - this signer should be ignored if platform version is below this number.\n - `maxSDK` (uint32) - this signer should be ignored if platform version is above this number.\n - length-prefixed sequence of length-prefixed `additional\n attributes`:\n - `ID` (uint32)\n - `value` (variable-length: length of the additional attribute - 4 bytes)\n - `ID -`**0x3ba06f8c**\n - `value -` Proof-of-rotation struct\n - `minSDK` (uint32) - duplicate of minSDK value in signed data section - used to skip verification of this signature if the current platform is not in range. Must match signed data value.\n - `maxSDK` (uint32) - duplicate of the maxSDK value in the signed data section - used to skip verification of this signature if the current platform is not in range. Must match signed data value.\n - length-prefixed sequence of length-prefixed `signatures`:\n - `signature algorithm ID` (uint32)\n - length-prefixed `signature` over `signed data`\n - length-prefixed `public key` (SubjectPublicKeyInfo, ASN.1 DER form)\n\nProof-of-rotation and self-trusted-old-certs structs\n----------------------------------------------------\n\n\nThe proof-of rotation struct allows apps to rotate their signing cert without\nbeing blocked on other apps with which they communicate. To accomplish this, app\nsignatures contain two new pieces of data:\n\n- assertion for third parties that the app's signing cert can be trusted wherever its predecessors are trusted\n- app's older signing certs which the app itself still trusts\n\n\nThe proof-of-rotation attribute in the signed-data section consists of a\nsingly-linked list, with each node containing a signing certificate used to sign\nprevious versions of the app. This attribute is meant to contain the conceptual\nproof-of-rotation and self-trusted-old-certs data structures. The list is\nordered by version with the oldest signing cert corresponding to the root node.\nThe proof-of-rotation data structure is built by having the cert in each node\nsign the next in the list, and thus imbuing each new key with evidence that it\nshould be as trusted as the older key(s).\n\n\nThe self-trusted-old-certs data structure is constructed by adding flags to each\nnode indicating its membership and properties in the set. For example, a flag\nmay be present indicating that the signing certificate at a given node is\ntrusted for obtaining Android signature permissions. This flag allows other apps\nsigned by the older certificate to still be granted a signature permission\ndefined by an app signed with the new signing certificate. Because the whole\nproof-of-rotation attribute resides in the signed data section of the v3\n`signer` field, it is protected by the key used to sign the containing apk.\n\n\nThis format precludes [multiple signing keys](#multiple-certificates)\nand convergence of [different ancestor\nsigning certificates](#multiple-ancestors) to one (multiple starting nodes to a common sink).\n\n### Format\n\n\nThe proof-of-rotation is stored inside the APK signature scheme v3 block under\nID `0x3ba06f8c`. Its format is:\n\n- length-prefixed sequence of length-prefixed `levels`:\n - length-prefixed `signed data` (by previous cert - if exists)\n - length-prefixed X.509 `certificate` (ASN.1 DER form)\n - `signature algorithm ID` (uint32) - algorithm used by cert in previous level\n - `flags` (uint32) - flags indicating whether or not this cert should be in the self-trusted-old-certs struct, and for which operations.\n - `signature algorithm ID` (uint32) - must match the one from the signed data section in the next level.\n - length-prefixed `signature` over the above `signed\n data`\n\n### Multiple certificates\n\nMultiple signers are not supported and Google Play does not publish\napps signed with multiple certificates.\n\nVerification\n------------\n\nIn Android 9 and higher, APKs can be verified according to the APK Signature\nScheme v3, v2 scheme, or v1 scheme. Older platforms ignore v3 signatures and try\nto verify v2 signatures, then v1.\n\n\n**Figure 1.** APK signature verification\nprocess\n\n### APK signature scheme v3 verification\n\n1. Locate the APK signing block and verify that:\n 1. Two size fields of APK signing block contain the same value.\n 2. ZIP Central Directory is immediately followed by ZIP End of Central Directory record.\n 3. ZIP End of Central Directory is not followed by more data.\n2. Locate the first APK signature scheme v3 block inside the APK signing block. If the v3 block is present, proceed to step 3. Otherwise, fall back to verifying the APK [using v2 scheme](/docs/security/features/apksigning/v2#v2-verification).\n3. For each `signer` in the APK signature scheme v3 block with a min and max SDK version that is in range of the current platform:\n 1. Choose the strongest supported `signature algorithm ID` from `signatures`. The strength ordering is up to each implementation/platform version.\n 2. Verify the corresponding `signature` from `signatures` against `signed data` using `public\n key`. (It is now safe to parse `signed data`.)\n 3. Verify the min and max SDK versions in the signed data match those specified for the `signer`.\n 4. Verify that the ordered list of signature algorithm IDs in `digests` and `signatures` is identical. (This is to prevent signature stripping/addition.)\n 5. [Compute\n the digest of APK contents](/docs/security/features/apksigning/v2#integrity-protected-contents) using the same digest algorithm as the digest algorithm used by the signature algorithm.\n 6. Verify that the computed digest is identical to the corresponding `digest` from `digests`.\n 7. Verify that SubjectPublicKeyInfo of the first `certificate` of `certificates` is identical to `public key`.\n 8. If the proof-of-rotation attribute exists for the `signer` verify that the struct is valid and this `signer` is the last certificate in the list.\n4. Verification succeeds if exactly one `signer` was found in range of the current platform and step 3 succeeded for that `signer`.\n\n| **Caution**: APK must not be verified using the v1 or v2 scheme if a failure occurs in step 3 or 4.\n\nValidation\n----------\n\n\nTo test that your device supports v3 properly, run the\n`PkgInstallSignatureVerificationTest.java` CTS tests in\n`cts/hostsidetests/appsecurity/src/android/appsecurity/cts/`."]]
