Could you provide the PCK encryption for building Android using non-APK extensions?

[mikuYongh]

Describe the project you are working on

I am developing a 2D game that includes a lot of scripts.

Describe the problem or limitation you are having in your project

The game I created is about 2GB. I want to encrypt it and generate an APK file. However, when I need to encrypt the PCK file, I have to select the APK extension, which requires a secret key from the Google Play Console. But I don't want to use this key to encrypt my game, maybe for other reasons. When 4.0 removed the GD script encryption function that was present in 3.x, I wondered if it was possible to achieve encryption in 4.x without requiring the APK extension, because leaving the PCK file unencrypted would be very insecure for the game.

Describe the feature / enhancement and how it helps to overcome the problem or limitation

Can you provide an APK build that does not depend on APK expansion using GDScript encryption or other encryption methods?

Describe how your proposal will work, with code, pseudo-code, mock-ups, and/or diagrams

I am not very familiar with how encryption works, but I would like to have more considerations for the security of the game.

If this enhancement will not be used often, can it be worked around with a few lines of script?

It is not possible.

Is there a reason why this should be core and not an add-on in the asset library?

Using encryption can improve the security of the APK in Godot 4.x. If the game is not encrypted, it can be easily cracked, so I believe that using only this encryption method is insufficient for security considerations.

[bruvzg]

However, when I need to encrypt the PCK file, I have to select the APK extension, which requires a secret key from the Google Play Console. But I don't want to use this key to encrypt my game, maybe for other reasons.

PCK / APK extension is encrypted using the key which is set in the export options (Encryption tab), and you have to rebuild the export template with the same key. A key from the Play Console is not related to PCK encryption.

[mikuYongh]

However, when I need to encrypt the PCK file, I have to select the APK extension, which requires a secret key from the Google Play Console. But I don't want to use this key to encrypt my game, maybe for other reasons.

PCK / APK extension is encrypted using the key which is set in the export options (Encryption tab), and you have to rebuild the export template with the same key. A key from the Play Console is not related to PCK encryption.

But the document says that to enable PCK encryption when building the APK, you need to open the APK extension, and to open the APK extension, you must fill in the public key. The public key should be the public key of the Play Console, right? If not provided, PCK encryption cannot be used, right?

[bruvzg]

A public key from the Play Console is required, but it's not an encryption key, it's used by APK extension downloader to validate the license.

So to enabled encryption:

• APK extension should be enabled, and public key set in the Options tab of export.
• PCK encryption should be enabled, and AES encryption specified in theEncryption tab (as well as filters for files to encrypt).
• A custom export template, that was built with the same AES encryption key, should be used.

[mikuYongh]

A public key from the Play Console is required, but it's not an encryption key, it's used by APK extension downloader to validate the license.

So to enabled encryption:

• APK extension should be enabled, and public key set in the Options tab of export.
• PCK encryption should be enabled, and AES encryption specified in theEncryption tab (as well as filters for files to encrypt).
• A custom export template, that was built with the same AES encryption key, should be used.

So now, I think the security of Godot 4.x APKs requires filling in the key from the Play Console to encrypt the APK using PCK. Without filling in the key from the Play Console, the security of the APK cannot be guaranteed. First of all, I think not every developer wants to use the Play Console or upload to the store. Shouldn't this strategy, which requires enabling APK expansion to ensure the security of the APK, be improved or other encryption methods provided? Using the Play Console in China is not an easy task. Generating an APK without being able to use the Play Console has been a headache for me. Is there a way to run OBB data packages without enabling APK expansion? Godot 4 is a very good game engine, and now many Chinese people are using it. I hope to see improvements or adjustments made, thank you very much.

[geekley]

+1
I don't see any reason why asset encryption should require a separate PCK or OBB. We should be able to use the existing encryption feature in single APK too. For when distributing APK outside of Play Store (e.g. itch, etc).