Can one build a new release APK file using the original SHA1 key when using a reverse engineered app?

Question

I am concerned that users may reverse engineer my app, edit it, and publish it using the same SHA1 key. That way Google Play Games would verify the unofficial app and would make it able to post invalid scores to the leaderboard.

Is this possible?

Answer 1

SHA-1 is designed so that creating a different input (app in this example) with the same signature is VERY VERY difficult - Don't worry about that.

On the other hand, reverse engineering it and creating their own version with a different key would be much more feasible. I don't know how Google Play Games would handle that, but I suspect Google has planned for this situation.