iToken - APK Verification

Recently, there has been feedback from the community that fake iToken APK packages created by malicious individuals are circulating in the market, posing a threat to users' asset security. These malicious actors decompile legitimate APK files and inject code that can steal private keys and mnemonic phrases, then package and distribute them through other websites or channels for fraudulent activities.

When users download and use the wallet through search engines or recommendations from others, their private keys or mnemonic phrases may be compromised, resulting in the loss of all their assets. Users can follow this tutorial to verify whether the APK package they are currently using is genuine using SHA256/PGP verification.

The iToken Android APK package verification currently supports the following verification methods:

1. SHA256 verification

2. PGP verification

Below is the relevant iToken official website APK package PGP public key information:

Public Key: 342CF9D309E63E057919A8F241336B599A145D0C

User ID: build_iToken <feedback@itoken.com>

SHA256 (Secure Hash Algorithm 256-bit) is a cryptographic hash function that calculates the hash value of an APK package using the SHA256 algorithm. Users can compare the SHA256 value of the downloaded APK package with the SHA256 value provided by the official source to verify if the file content has been tampered with. Compared to the commonly used MD5 algorithm, SHA256 is more secure but computationally more intensive.

PGP (Pretty Good Privacy) is an advanced encryption and signature scheme used for integrity verification and trusted source verification. In PGP encryption, the RSA algorithm is used to calculate the file digest of the APK, and then the file digest is encrypted with the official iToken private key (stored in hardware) to create a signature file. Users can import the iToken PGP public key from a PGP key server and use this public key along with the signature file to decrypt and compare the file digest of the local APK. If they match, it indicates that the APK is intact, ensuring it hasn't been tampered with, and also verifies that the APK is an official release from iToken (as others cannot access iToken's official private key to sign the file digest).

The signature file refers to the encrypted file created using the PGP encryption method. It involves calculating the file digest of the APK using the RSA algorithm and encrypting it with the official iToken private key (stored in hardware) to create an encrypted file. It is primarily used to verify if the APK package is an official release from iToken.

APK package - SHA256 value and signature file