20

Google Chrome is using alpha numeric hashes as identifiers for the Chrome extensions. For eg. "ajpgkpeckebdhofmmjfgcjjiiejpodla" is the identifier for XMarks Bookmark Sync extension.

Which algorithm is in use here to generate such strings? How are they ensuring uniqueness?

0

8 Answers 8

34

To be precise, it's the first 128 bits of the SHA256 of an RSA public key encoded in base 16.

Another random bit of trivia is that the encoding uses a-p instead of 0-9a-f. The reason is that leading numeric characters in the host field of an origin can wind up being treated as potential IP addresses by Chrome. We refer to it internally as "mpdecimal" after the guy who came up with it.

3
  • Is there a "get ID" JS method for extensions? This is especially useful when debugging since the ID changes every time you load an unpacked extension. Dec 26, 2010 at 4:56
  • 2
    beriberikix: yes, chrome.i18n.getMessage("@@extension_id") Jan 31, 2011 at 4:34
  • 3
    chrome.runtime.id is now the preferred way of accessing the extension ID. Apr 10, 2013 at 12:59
19

Here's a linux one liner:

cat FILE.PEM | openssl rsa -pubout -outform DER | openssl dgst -sha256 | awk '{print $2}' | cut -c 1-32 | tr '0-9a-f' 'a-p'

nicely formatted for readability

cat FILE.PEM | \
openssl rsa -pubout -outform DER | \
openssl dgst -sha256 | \
awk '{print $2}' | \
cut -c 1-32 | \
tr '0-9a-f' 'a-p'
3
  • you rock! thanks for providing the solution -- err except it didnt generate the right key
    – qodeninja
    Apr 18, 2012 at 17:28
  • 1
    Shorter version: openssl rsa -pubout -outform DER < FILE.PEM | sha256sum | head -c32 | tr 0-9a-f a-p Be careful with newlines, when storing the output of openssl in a variable, use echo -n "$var" instead of plain echo to avoid adding a newline.
    – Lekensteyn
    Jan 21, 2013 at 13:23
  • NOTE: do not use variables, (nul) bytes get eaten which will corrupt the hash. See github.com/Lekensteyn/apk-downloader/commit/… on the wrong way to do it and an alternative that correctly calculates the hash.
    – Lekensteyn
    Feb 5, 2013 at 11:08
18

Chromium generates the id via public key. If you use the extension gallery, they handle all that for you.

From the source:

bool Extension::GenerateId(const std::string& input, std::string* output) {
  CHECK(output);
  if (input.length() == 0)
    return false;

  const uint8* ubuf = reinterpret_cast<const unsigned char*>(input.data());
  SHA256Context ctx;
  SHA256_Begin(&ctx);
  SHA256_Update(&ctx, ubuf, input.length());
  uint8 hash[Extension::kIdSize];
  SHA256_End(&ctx, hash, NULL, sizeof(hash));
  *output = StringToLowerASCII(HexEncode(hash, sizeof(hash)));
  ConvertHexadecimalToIDAlphabet(output);

  return true;
}

Take a look at extension.cc file it has more detailed information such as generating the .pem file exncoding/decoding, etc.

1
  • 1
    NOTE: when loading an extension from file, that file path (without a trailing newline) is used to compute the hash.
    – Lekensteyn
    Jan 21, 2013 at 13:23
8

I've posted a short Ruby script to calculate the extension id from the private key: http://supercollider.dk/2010/01/calculating-chrome-extension-id-from-your-private-key-233. This pretty much follows Erik Kay's description of the format.

0
2

A nice little bash script for a "idiot proof" way to find out your extensions id. Thanks to A-Tuin for the oneliner command.

#!/bin/bash
txtred=$(tput setaf 1) # Red

echo "Script to generate extension id from your extensions .pem file"
sleep 2
while true; do
read -e -p "Enter local file path for your pem file " PEMFILE
if [[ $PEMFILE != *.pem ]]; then
        echo "That is not a .pem file. Please enter a correct .pem file"
        sleep 2
else
        break
fi
done
PEMFILEGEN=`cat $PEMFILE | openssl rsa -pubout -outform DER | openssl dgst -sha256 | awk '{print $2}' | cut -c 1-32 | tr '0-9a-f' 'a-p'`
echo "Your extension id is:${txtred} $PEMFILEGEN${textred}"
tput sgr0
exit 0
1

I made crx_appid gem to calculate appid easily.

https://rubygems.org/gems/crx_appid

$ gem install crx_appid
$ crx_appid extension.pem
0

To be even more precise, the input to the SHA256 hash is the X.509 SubjectPublicKeyInfo block, DER-encoded. This is the 5th field in the crx header as described in CRX Package Format. It is also the byte sequence you get if you take the value of "key" in the manifest and base-64 decode it.

0

Here is the easy way in bash (and openssl) to get the X.509 SubjectPublicKeyInfo block, DER-encoded:

openssl rsa -pubout -outform DER < "$pem" > "$pub" 2>/dev/null

Where $pem is the private key file, RSA encoded.

To get the SHA256 Digest you need to run the following on the file resulting from the previous line:

openssl dgst -sha256 $pub | awk '{print $2}' | cut -c 0-32

All that remains is to take the resulting 32 char string and change it from regular hex ([0-9][a-f]) to ([a-p]) where a matches 0 and p matches f.

With a bit of effort, I'm pretty sure these two steps could be made into a one-liner. I hope you find it helpful and if so, please let me know.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.