When does LICENSED_OLD_KEY come back from the server?

Question

The documentation for licensing applications describes LICENSED_OLD_KEY as a value:

The application is licensed to the user, but there is an updated version of the application that is signed with a different key.

On the other hand, documentation for signing strategies says:

If you sign a new version without using the appropriate certificates, you also need to assign a different package name for the application - in this case, the user installs the new version as a completely new application.

Since applications are identified by package names, this means that you cannot change the signing key for the published application. (Rather, you can change the key and package, but then it will be seen by the market as a new application.)

I can’t come up with a scenario where I can get the answer LICENSED_OLD_KEY . Did I miss something?

Answer 1

The documentation claims that LICENSED_OLD_KEY

... may indicate that the key pair used by the installed version of the application is invalid or compromised.

It looks like this code has been added for cases where the private key has leaked or otherwise can no longer be trusted. Since the current IPC mechanism does not even know which public key is used on the client side, I would assume that the entire packet name is corrupted. The idea is that in this case, the application should ask the user to switch to a new version, which is not corrupted and, presumably, already exists. Since this update will require a switch to a completely new package, how this should be done is unclear. I assume that this mechanism is not actually used at the moment, so the chances of getting this code are very close to zero. In the current version of the official LVL library, this code is processed in the same way as the usual LICENSED answer.

ps Also note that you are confusing the key pair used to sign your applications and the key pair used for the LVL service. These two are completely different and unrelated. Interestingly, with the last key pair, you are not even familiar with the private key. You get your own pre-generated public key (one for each developer) from the publisher’s console and all that you get.