The Certificates that are used to sign Android applications are generated by the user and not checked or signed by any authority. They are RSA or DSA Certificates and as i read on crypt.stackexchange.com it should be nearly impossible to create two identical RSA certificates.

But the question still is open: could it be possible that the same certificate get's generated twice? Or is the certificate a good indicator for the developer? (if the certificate was not leaked) In the past there were problems with ssl keys generated by embedded device, right after the start of the device - which lead to the problem that the entropy level was not high enough and the same keys were generated on many different devices. Is it valid to say, that this will not happen for android certificates?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.