How to sign .apk with SHA256 algorithm

Question

I have a .keystore certificate(which was generated 10 yrs ago) to sign the apk and I'm signing it using android sigingCOnfig function and it's signing with SHA1 hash algorithm, Can anyone let me tell how to sign with SHA256 signing algorithm with existing .keystore certificate?

Answer 1

SHA1 and SHA256 are not signing algorithms but hash (a.k.a digest) algorithms. Hashing is just one operation used during the signing process, and the strength of the key (usually, the number of bits used in the key) is an equally important consideration in the security model since security is as good as its weakest link.

Although you can choose the strength of your key (when you initially generate the keystore), you cannot choose which hash algorithm to use during the signing process. Apksigner (which Android Gradle plugin uses) will automatically choose the strongest hash algorithm supported by the Android platform your app supports. In other words, the hash algorithm used will depend on the value of minSdkVersion you define in your app and the type of key (e.g. RSA, DSA, etc.). This is because support for stronger pairs of signing/hashing algorithms were added in more recent versions of Android.

Watch also not to fall for a common pitfall which is to look at the hash algorithm of the signature of the certificate itself (rather than the signature of the APK). This signature has no bearing on the Android security model so it wouldn't matter which hashing algorithm was used.