Skip to content

MASTG-TEST-0225: Usage of Insecure Signature Key Size

Content in BETA

This content is in beta and still under active development, so it is subject to change any time (e.g. structure, IDs, content, URLs, etc.).

Send Feedback

Overview

For Android apps, the cryptographic strength of the APK signature is essential for maintaining the app's integrity and authenticity. Using a signature key with insufficient length, such as an RSA key shorter than 2048 bits, weakens security, making it easier for attackers to compromise the signature. This vulnerability could allow malicious actors to forge signatures, tamper with the app's code, or distribute unauthorized, modified versions.

Steps

  1. List the additional signature information using Obtaining Information about the APK Signature.

Observation

The output should contain the information about the key size in a line like: Signer #1 key size (bits):.

Evaluation

The test case fails if any of the key sizes (in bits) is less than 2048 (RSA). For example, Signer #1 key size (bits): 1024.