Signatures of exposure keys provided by servers are not verified
cgrigis opened this issue · 7 comments
The exposure key files provided by servers are signed using a PHA-specific private key, whose public counterpart is provided to Google for allowlisted apps.
When an app receives exposure key files from a server, it passes them to GAEN via an API that validates them and checks their signature before seeking for matches.
As microG does not have the PHA-specific public signature keys, the exposure key files are currently not verified before matching is attempted.
After discussion with @gannimo and @francozappa:
We should get the pub keys (they are public anyway 🙂 ) and then verify the signatures with some extra code.
Received the public key for the Swiss back-end server.
Tested both public keys received (dev/test and prod), and incorporated them into the microG branch.
Discussion ongoing regarding how the user decides what to do when a key-file does not verify.