How to selecte a hash signature for otp sms?

Question

I'm using google SMS API to detect OTP automatically. I'm generating hash key programmatically. I'm using "SHA-256" as a hash type, but I'm getting a hash signature different for debug and release environment. My broadcast receiver detects the SMS when I use the hash key generated by "SHA-256" hash type. When I use "MD5" as a hash type, I'm getting the same hash key for both debug and release environment. But when I use this hash key for SMS then the broadcast receiver is not detecting it.

I have zero idea about hash signatures, I have my app on play store. I want to choose a hash key for my OTP SMS. I also don't know if google play store will change the hash key of the app after publishing.

AppSignatureHelper

 package com.bizlers.turbo.care.android.utils;

import android.annotation.SuppressLint;
import android.content.Context;
import android.content.ContextWrapper;
import android.content.pm.PackageManager;
import android.content.pm.Signature;
import android.util.Base64;
import android.util.Log;

import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.Arrays;

public class AppSignatureHelper extends ContextWrapper {

    public static final String TAG = AppSignatureHelper.class.getSimpleName();

    private static final String HASH_TYPE = "SHA-256";
    public static final int NUM_HASHED_BYTES = 9;
    public static final int NUM_BASE64_CHAR = 11;

    public AppSignatureHelper(Context context) {
        super(context);
    }

    public ArrayList<String> getAppSignatures() {
        ArrayList<String> appCodes = new ArrayList<>();

        try {
            // Get all package signatures for the current package
            String packageName = getPackageName();
            PackageManager packageManager = getPackageManager();
            @SuppressLint("PackageManagerGetSignatures")
            Signature[] signatures = packageManager.getPackageInfo(packageName, PackageManager.GET_SIGNATURES).signatures;

            // For each signature create a compatible hash
            for (Signature signature : signatures) {
                String hash = hash(packageName, signature.toCharsString());
                if (hash != null) appCodes.add(String.format("%s", hash));

            }
        } catch (PackageManager.NameNotFoundException e) {
            Log.e(TAG, "Unable to find package to obtain hash.", e);
        }
        return appCodes;
    }

    private static String hash(String packageName, String signature) {
        String appInfo = packageName + " " + signature;
        try {
            MessageDigest messageDigest = MessageDigest.getInstance(HASH_TYPE);
            messageDigest.update(appInfo.getBytes(StandardCharsets.UTF_8));
            byte[] hashSignature = messageDigest.digest();

            // truncated into NUM_HASHED_BYTES
            hashSignature = Arrays.copyOfRange(hashSignature, 0, NUM_HASHED_BYTES);

            // encode into Base64
            String base64Hash = Base64.encodeToString(hashSignature, Base64.NO_PADDING | Base64.NO_WRAP);
            base64Hash = base64Hash.substring(0, NUM_BASE64_CHAR);

            Log.e(TAG, String.format("pkg: %s -- hash: %s", packageName, base64Hash));
            return base64Hash;

        } catch (NoSuchAlgorithmException e) {
            Log.e(TAG, "hash:NoSuchAlgorithm", e);
        }
        return null;
    }
}

score 1 · Answer 1 · answered Jul 11 '20 at 12:37

1

The type of hash should be "SHA-256" according to documents :

SMS Retriever Api : Computing your app's hash string

the docs say : "Compute the SHA-256 sum of the combined string."

For publishing app on play store, here is a useful post :

How to generate hash code

answered Jul 11 '20 at 12:37

Nabzi

1,823
1
16
26

Thank you, so this means I need to maintain two different hash keys for development and publishing app? – Parag Rane Jul 11 '20 at 13:16
1

@ParagRane Because the signing of the app is different in debug and release , the hash keys would be different. Docs say : You cannot directly edit the debug signing configuration, but you can configure how you sign your release build. – Nabzi Jul 12 '20 at 06:07
Thank you for the response. I need one more help, I'm getting an error while executing xxd command on windows 10. The error is, 'xxd' is not recognized as an internal or external command. I have added a certificate.jks successfully. – Parag Rane Jul 12 '20 at 06:23

How to selecte a hash signature for otp sms?

1 Answers1