Compute the application binding key

Overview

In NFC Wallet, the Android application binding key is the signer public key SHA-256 digest.

It is the SHA-256 hash of the signer public key extracted from the application signing certificate.

Retrieve the signer public key SHA-256 digest using one of the options below, then share the resulting hex value with the Thales delivery team.

This restricts NFC Wallet usage to a registered digital wallet application.

You might need to share multiple values if your signing setup differs per environment (for example: PreProd, Production).

Share the hash exactly as printed. Do not add separators or spaces.

Pick the option that matches your signing setup. See Android app signing for background.

Option 1: Inspect the signed application package

This is the simplest option. You need access to the signed APK on a workstation.

For Production, you often install the app from Google Play, then pull the APK from a test device.

You also need apksigner from the Android SDK Build Tools. Example location: %ANDROID_HOME%\build-tools\33.0.1\.

Once the application package is available its signature could be examined with a single command. For example:

apksigner verify -v --print-certs Sample-sandbox-debug.apk
Verifies
Verified using v1 scheme (JAR signing): false
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): false
Verified using v3.1 scheme (APK Signature Scheme v3.1): false
Verified using v4 scheme (APK Signature Scheme v4): false
Verified for SourceStamp: false
Number of signers: 1
Signer #1 certificate DN: CN=D1
Signer #1 certificate SHA-256 digest: 591411c6efdc32c0a48ebf023583af589a50fd34914b9277377954ecff91b325
Signer #1 certificate SHA-1 digest: 2829a0da71747ae11cce49e77a361267f1abf58d
Signer #1 certificate MD5 digest: d14c33afe4217372edfa4eea92ede878
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 2048
Signer #1 public key SHA-256 digest: b8e36f1efe7e4c827aeb390fafbf500d971c7e09a0bb62f84cfbaf8e0c770496
Signer #1 public key SHA-1 digest: 3df52267537eebfed228f704af7ab02e54f47172
Signer #1 public key MD5 digest: 97fb0a170b1499956ead185500ea3738

Use the value from Signer #1 public key SHA-256 digest.

In the example above, share:

b8e36f1efe7e4c827aeb390fafbf500d971c7e09a0bb62f84cfbaf8e0c770496

Option 2: Retrieve from a local Java keystore file

The examples below use a Thales PreProd keystore shipped with the Training App.

Use your own signing keys for Sandbox, PreProd, and Production.

Step 1: Inspect the keystore file

Using a Java keytool utility, you can inspect the keystore file as follows:

keytool -v -list -keystore <keystore file name>

Example:

Example: keytool -list output for the keystore

Step 2: Extract the public key certificate

The Java keytool is used again to extract a public key certificate for the particular key entry identified by the alias.

Command:

keytool -export -alias <key alias> -keystore <keystore file name> -rfc -file <output certificate file name>

Example:

c:\Temp>keytool -export -alias gto -keystore release.keystore -rfc -file public.cert
Enter keystore password:
Certificate stored in file <public.cert>

Step 3: Get the hash

If Thales provided PKPinGenerator.jar, use it to generate the public key hash.

Command:

java -jar PKPinGenerator.jar <output certificate file name from previous step>

Example:

c:\Temp>java -jar PKPinGenerator.jar public.cert
**************************************************
** Public Key Hash Generator **
**************************************************

Public Key Hash #1: E7F85A18D065DF41A3DD59ECB5FF5807CACABAE8DFACCDE12DB24BD658299C54

Share the hash printed in the output.

In this example:

E7F85A18D065DF41A3DD59ECB5FF5807CACABAE8DFACCDE12DB24BD658299C54

Option 3: Retrieve from the Google Play app signing certificate

Step 1: Download the certificate from Google Play Console

Download the app signing certificate from Google Play Console

Step 2: Extract the public key and its hash

There are various ways to achieve the same result, but it is recommended to use the following sequence of commands using OpenSSL:

openssl x509 -in deployment_cert.der -inform DER -out deployment_cert.crt
openssl x509 -noout -in deployment_cert.crt -pubkey | openssl asn1parse -noout -inform pem -out deployment_cert.key
openssl dgst -sha256 -hex deployment_cert.key
SHA256(deployment_cert.key)= [public key hash to share with Thales]