[HTC EVO 3D] dragonfyre13:
It's been asked a few times, and a fair question. Hopefully, this response is something we can point people to that have questions, (ideally, assuming my understanding isn't fundamentally flawed)

The update.zip files (what you flash with, by downloading an OTA) are signed in the same way an apk is signed. There's a utility called jarsigner that hashes (via SHA1) each individual file within a zip/jar/apk, then signs the file containing the hashes of those files. Apksigner, which is the way apks and update.zip files are signed, is a very, very close equivalent to this tool (for practical purposes, assume it's the exact same thing). By signs, that means it uses a 2048 bit RSA key to cryptographically sign the "manifest" file (file with the hashes in it, of all the other files).

This manifest file, when your system goes to install an APK or update.zip, is first checked against the RSA public key. Attempting to change the key used to sign, or the manifest would make you as a signer "untrusted" by either failing to verify the signiture, or failing to identify as a trusted source and thus deny the update, very much like trying to install a custom rom on an unrooted system. So this RSA key is used to validate that the manifest file is intact and unchanged.

The manifest file is the ONLY thing in in the update.zip which is signed, but it contains SHA1 hashes for each of the other files. The manifest, once validated it's untampered with and signed by a trustee, is used to validate that no other files in the update have been modified. Android rehashes each of the files in the update, and compares those with the manifest, in order to confirm this.

This means an attack on this would be one of two things:

A) An attack on the SHA-1 hash, against which there are multiple attacks present. Currently, the fastest theoretically you can compute a collision with these is 2^52 operations. In real world terms, there are examples that someone could pick up to do this in 2^69 operations. Assuming you can tackle 2^32 ops/sec. (About 4 billion, so assuming each op is one cycle, about 4 GHz... Gross oversimplification, but it makes the math pretty easy.) So, how long would it take to do 2^69 ops? 2**37 seconds of CPU time. About 4000 years. (So that one is right out)

B) An attack on RSA. I haven't researched this one quite as much, but it's much in the same state. Likely a much easier entry point than SHA1, probably only looking at about 1000 years here. This is based on a public/private key (2) system, so theoretically much easier to break than a hashing algorithm, since it's meant to eventually be decrypted. However, this key is 2048 bits, meaning that it's a very, very large number.

RSA is based on specifically very difficult to compute math, which takes a very considerable amount of time to reverse. It can be brute forced, but that would take much, much, much longer than SHA1, since this is a very considerably larger key. There may be some potential here, given the available exploits and attacks against RSA, if you were looking at the order of at least a number of years. However in practical terms, most of the exploits out there for RSA are targeted at encryption, not signing, which means any existing methods would have to be adapted, and here we're talking about above post graduate mathematics kind of work to do it right. This is the type of thing serious, lifelong math geeks have wet dreams about (pardon the imagery).

Here's a very, very good visual explaination of RSA for the non-mathmatically minded among us: http://cryptool.org/media/RSA/RSA-Flash-en/player.html

Now, both of these things are taking into account the latest published RSA and SHA1 attacks as of about 2 months ago when I last looked into it (for work, I'm not THAT much of a geek. :P). This also is NOT something that's likely to have a "hidden gotcha" that some black hat has up his sleeve. Cryptography, especially breaking existing forms and publishing the results, is serious money. If an exploit is found, it would likely very quickly be published, or at least people would be let know who found it if not the specific method.