Skip to content

Update IP phone app teams signature constants to use SHA-512 format #2700

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jul 2, 2025
Merged

Update IP phone app teams signature constants to use SHA-512 format #2700

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
73e0573
Update IP phone app signature constants to use SHA-512 format
p3dr0rv Jul 1, 2025
8f5bc38
update changelog
p3dr0rv Jul 1, 2025
5871fca
Add comment to clarify usage of Cipher.getInstance in ProviderFactory
p3dr0rv Jul 2, 2025
70c34a7
Merge branch 'dev' into pedroro/update-teams-signature
p3dr0rv Jul 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
vNext
----------
- [MINOR] Update IP phone app teams signature constants to use SHA-512 format (#2700)
- [MINOR] Updating handling of ssl error received in Android WebView's onReceivedSslError callback (#2691)
- [MINOR] Fixing the sign in screens when edge to edge is enabled (#2665)
- [MINOR] Showing webcp flow in webview (#2673)
Expand Down
4 changes: 2 additions & 2 deletions ...on/src/main/java/com/microsoft/identity/common/adal/internal/AuthenticationConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1194,13 +1194,13 @@ public static String computeMaxHostBrokerProtocol() {
* The only supported detection of this phone is the application install state.
* App signature of Teams Phone app to detect it for the MDM Device CA redirect.
*/
public static final String IPPHONE_APP_SIGNATURE = "fcg80qvoM1YMKJZibjBwQcDfOno=";
public static final String IPPHONE_APP_SHA512_RELEASE_SIGNATURE = "iPULpH0pq8ms1Qy7cOzGsVRQN7/zW4IbW+UKcajvtrTrzM5o5VcaghNEA1Ho4Wq7ay0efqqJcalxa8eHxVnHKA==";

/**
* Signing certificate thumbprint of the DEBUG-signed Teams IP Phones (Sakurai devices)
* to unblock any teams local debug development.
*/
public static final String IPPHONE_APP_DEBUG_SIGNATURE = "VCpKgbYCXucoq1mZ4BZPsh5taNE=";
public static final String IPPHONE_APP_SHA512_DEBUG_SIGNATURE = "FOoI98kyj+dXPZYW191TjF6017ljKj47G+RCQPYjIcXD7uhhTpw7pqznTABB0ZjB1/DZetRgr284pyLumvXN6A==";
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How are these signatures generated?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

teams provided the APKS, and we run package inspector (package-inspector/src/main/java/com/microsoft/inspector/MainActivity.java) a test app inside MSAL.
More details in this PR
https://github.com/AzureAD/microsoft-authentication-library-for-android/pull/2324/files


/**
* The value for pkeyauth redirect.
Expand Down
12 changes: 6 additions & 6 deletions common/src/main/java/com/microsoft/identity/common/internal/broker/PackageHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,9 @@

package com.microsoft.identity.common.internal.broker;

import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_DEBUG_SIGNATURE;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_PACKAGE_NAME;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_SIGNATURE;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_SHA512_DEBUG_SIGNATURE;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_SHA512_RELEASE_SIGNATURE;

import android.content.Context;
import android.content.pm.ApplicationInfo;
Expand Down Expand Up @@ -124,7 +124,7 @@ private static String getSigningCertificateThumbprintForPackage(final PackageInf
final Signature[] signatures = getSignatures(packageInfo);
if (signatures != null && signatures.length > 0) {
final Signature signature = signatures[0];
MessageDigest md = MessageDigest.getInstance(useSha512 ? "SHA-512" : "SHA");
MessageDigest md = MessageDigest.getInstance(useSha512 ? "SHA-512" : "SHA"); // CodeQL [SM05136] MSAL still uses SHA-1 format in redirect url.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SHA or SHA-1?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"SHA" is a standard alias for SHA-1 in Android.

md.update(signature.toByteArray());
return Base64.encodeToString(md.digest(), Base64.NO_WRAP);
}
Expand Down Expand Up @@ -293,9 +293,9 @@ public boolean verifyIfValidTeamsPackage(final String packageName) {

if (packageName.equals(IPPHONE_APP_PACKAGE_NAME) &&
isPackageInstalledAndEnabled(IPPHONE_APP_PACKAGE_NAME)) {
final String currentSignatureForTeamsApp = getSha1SignatureForPackage(IPPHONE_APP_PACKAGE_NAME);
if (IPPHONE_APP_SIGNATURE.equals(currentSignatureForTeamsApp) ||
IPPHONE_APP_DEBUG_SIGNATURE.equals(currentSignatureForTeamsApp)) {
final String currentSignatureForTeamsApp = getSha512SignatureForPackage(IPPHONE_APP_PACKAGE_NAME);
if (IPPHONE_APP_SHA512_RELEASE_SIGNATURE.equals(currentSignatureForTeamsApp) ||
IPPHONE_APP_SHA512_DEBUG_SIGNATURE.equals(currentSignatureForTeamsApp)) {
return true;
}
}
Expand Down
4 changes: 2 additions & 2 deletions .../com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.AMAZON_APP_REDIRECT_PREFIX;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.COMPANY_PORTAL_APP_PACKAGE_NAME;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_PACKAGE_NAME;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_SIGNATURE;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.IPPHONE_APP_SHA512_RELEASE_SIGNATURE;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.PLAY_STORE_INSTALL_APP_PREFIX;
import static com.microsoft.identity.common.adal.internal.AuthenticationConstants.Broker.PLAY_STORE_INSTALL_PREFIX;
import static com.microsoft.identity.common.java.AuthenticationConstants.AAD.APP_LINK_KEY;
Expand Down Expand Up @@ -607,7 +607,7 @@ private boolean isDeviceCaRequest(@NonNull final String url) {
private boolean shouldLaunchCompanyPortal() {
final PackageHelper packageHelper = new PackageHelper(getActivity().getPackageManager());
return packageHelper.isPackageInstalledAndEnabled(IPPHONE_APP_PACKAGE_NAME)
&& IPPHONE_APP_SIGNATURE.equals(packageHelper.getSha1SignatureForPackage(IPPHONE_APP_PACKAGE_NAME))
&& IPPHONE_APP_SHA512_RELEASE_SIGNATURE.equals(packageHelper.getSha512SignatureForPackage(IPPHONE_APP_PACKAGE_NAME))
&& packageHelper.isPackageInstalledAndEnabled(COMPANY_PORTAL_APP_PACKAGE_NAME);
}

Expand Down
2 changes: 1 addition & 1 deletion common4j/src/main/com/microsoft/identity/common/java/crypto/ProviderFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ public static Cipher getCipher(@NonNull final String algorithm,
@Nullable final Provider provider) throws ClientException {
try {
if (provider != null) {
return Cipher.getInstance(algorithm, provider);
return Cipher.getInstance(algorithm, provider); // CodeQL [SM05136] Used to decrypt SK, and the algorithm used is defined by ESTS.
}
return Cipher.getInstance(algorithm);
} catch (final NoSuchAlgorithmException e) {
Expand Down