firebase / firebase/firebase-android-sdk

Migrate internal SHA-1 usage to stronger cryptographic algorithms

Open
#8,458 0 comments 0 reactions 0 assignees View on GitHub
api: core type: feature request
Dominant language
Java
Stars
2.6k
Forks
710
Avg merge
2d 9h
Merged PRs (30d)
31

Description

### Background

During an independent penetration test, the assessment identified internal SHA-1 usage within the Firebase Android SDK. Based on our technical review, this implementation is limited to identifier generation and compatibility purposes. It is not used for authentication, password protection, encryption of sensitive information, digital signatures, or other security-sensitive functions, and therefore is not considered exploitable within our application's context.

### Request

As part of our regulatory remediation programme, we are required to establish a remediation plan for all identified third-party dependencies containing deprecated cryptographic algorithms.

We would appreciate it if the Firebase team could consider replacing or migrating internal SHA-1 usage to stronger cryptographic algorithms in future Firebase Android SDK releases, where technically feasible and without impacting backward compatibility.

If there is already a roadmap for this enhancement, or if there are recommended migration paths for application developers, we would appreciate any guidance.

Thank you for your continued efforts in maintaining and improving the Firebase Android SDK.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named in the issue. Start by locating the Firebase Android SDK's internal SHA-1 usage, then review identifier-generation and compatibility constraints; the work is done when a technically feasible migration or remediation plan, including developer guidance, is established without breaking backward compatibility.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, firebase, java
Domain
mobile-dev, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.