dataset · Zenodo (CERN European Organization for Nuclear Research)
Cryptographic verification of Android applications relies on clients and verifiers deriving identical cryptographic leaves from the application manifest. An empirical analysis of eighty-four Android finance applications examined leaf derivation directly from binary manifests across six string-canonicalisation policies, comparing set semantics against sequence semantics. Repeated permission declarations occurred across twenty-one application-permission pairs spanning fourteen distinct permissions. The evaluation assessed whether repeated elements were exact duplicates and whether attributes extended beyond the standard name attribute. Cross-checks using independent tools evaluated ordered lists, multisets, and repeat counts against the primary binary extraction. Testing also included running an existing reference verifier across one thousand iterations on an affected application, alongside control tests on prominent financial software including PayPal and Venmo. The results demonstrate how under-specified leaf derivation policies produce structural discrepancies during manifest integrity checks.
Financial applications require robust integrity checks to prevent tampering and maintain user trust. When security verifiers and client devices interpret application manifests differently due to duplicate permissions or ambiguous canonicalisation rules, cryptographic checks can fail incorrectly. Establishing precise leaf derivation rules ensures that security verification mechanisms behave consistently across different platforms and tools.
The findings are relevant to mobile security developers, application store operators, and financial technology vendors who build automated compliance and app-vetting pipelines. The work represents applied research tested on active, commercial banking and payment software. Integrating unambiguous leaf-derivation rules could improve mobile app shielding systems, app-store integrity scanners, and runtime verification tools, preventing false validation rejections in commercial distribution channels.
AI-generated from the published abstract. Always read the original work before citing.
Data and code supporting the paper “Repeated Permission Declarations in Android Finance-Category Applications: A Prevalence Study of Under-Specified Leaf Derivation in Manifest Integrity Verification” (Alsaedy, Ghalwash, Yousif, Azzam; submitted to Automated Software Engineering, 2026). A cryptographic scheme that commits to an application’s declared permissions is correct only when the client and the verifier derive the same leaves from the same manifest. This deposit contains the measurement behind the paper: 84 current Android finance-category applications, scanned by reading permissions directly from the binary manifest with no text decoder in the extraction path, and the leaf counts each manifest yields under six string-canonicalisation policies and under set versus sequence semantics. The archive contains: S1 — one row per application: package, versionCode, SHA-256, declaration count, exact-duplicate count, and the leaf count under each policy with its delta; S2 — every application-permission pair where a name is declared more than once (21 pairs over 14 distinct permissions); S3 — for each of those pairs, whether the repeated elements are identical and whether any attribute beyond android:name is present; S4 — an independent extraction of all 84 packages with Apktool 3.0.3, compared as ordered lists, as multisets, and on every repeat count; S5 — the run of the unmodified E-AAPIV reference verifier against an affected application, over 1,000 iterations; S6 to S8 — the positive controls, PayPal 8.97.0 and Venmo 26.6.0, plus PayPal 10.10.0 for the temporal comparison; the extraction, measurement and cross-check code, and the reference verifier. The application packages themselves are not redistributed, because their publishers restrict redistribution. Every reported result depends only on the manifest, and each row of S1 carries the SHA-256 of the package that produced it, so the extraction can be confirmed against the same builds. A README inside the archive documents each file, states which claim in the paper comes from which file, and gives the corpus sampling rule.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.5281/zenodo.22648081
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
