dotnet security: Do all the .Net products get signed using digital signatures? -- dotnet security

You're in the

dotnet security

group:

Do all the .Net products get signed using digital signatures?

Rahul Kumar
9/27/2004 1:44:57 PM

dotnet security: Hi

This is a question for all those .Net gurus who have ssen umpteen .Net
products come and go so far. The question is fairly simple -- Do the
softeware houses really obtain digital signatures from (eg. Verisign) and
sign their assemblies before releasing them for production? How important it
is to sign the assemblies (with digital signature obtained from Verisign or
otherwise) before it is installed on the client machine? More so, if the
product is supposed to be a stand alone product which very rarely accesses a
networked resource like a configuration file?

Regards

Rahul

Re: Do all the .Net products get signed using digital signatures?

Daniel Fisher(lennybacon)
9/27/2004 2:59:43 PM

Only if you got the money for VerySign - a StrongName will work too ;-)

Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: http://www.lennybacon.com/

Re: Do all the .Net products get signed using digital signatures?

Michael Willers
9/27/2004 5:09:43 PM

[quoted text, click to view]

Hi Rahul

A strong name garanties referal integrity by providing a unique name. That's
why versioning works with a strong name only. In addition it garanties code
integrity. It uses public key encryption to create a digital signature that
contains a hash of the assembly. At load time the CLR creates a hash again
and "extracts" the hash embedded in the signature by using the public key.
It then compares both hashes and if they are not equal the assembly has been
tampered with. In this case the CLR will not load it and as a result no code
gets executed. So in order to modify the assembly you need to have the
private key.
This is how a strong name provides code integrity. But where did the
assembly come from? There is no proven identity. And this is where
certificates come into play. They bind a public key to an identity.
So the decision is up to you: If you know the issuer of the assembly
personally and trust him there is no need for a certificate. If not, then
certificates are the way to go.

Hope that helps
Michael

--
http://staff.newtelligence.net/michaelw/

Re: Do all the .Net products get signed using digital signatures?

Rahul Kumar
9/28/2004 10:42:57 AM

Thanks Michael for your response. However my question is - what is the
percentage of
professional .Net product companies, who sign their assemblies and how many
among them sign with a digital certificate? I have to make a presentation in
my company to make a case in favour of signing the assemblies and preferably
using digital certificates ( to increase trust and ensure that our code is
not tampered with).

Regards

Rahul

[quoted text, click to view]

Re: Do all the .Net products get signed using digital signatures?

shawnfa NO[at]SPAM online.microsoft.com (
9/29/2004 11:18:43 PM

Hi Rahul,

One thing you might want to consider is that signing with an authenticode
certificate, while it will provide assurance that you are who you say you
are, also has the downside that when loading the assembly, the CLR has to
verify the entire certificate chain, so assembly load times will be slower
than with strongly named assemblies. I'm not trying to discourage the use
of authenticode, however that data point is good to have when you are
deciding between the signature technologies.

-Shawn
http://blogs.msdn.com/shawnfa
--
This posting is provided "AS IS" with no warranties, and confers no rights.

Note:
For the benefit of the community-at-large, all responses to this message
are best directed to the newsgroup/thread from which they originated.
--------------------
[quoted text, click to view]
cpmsftngxa06.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP11
.phx.gbl
[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.

home · blog · groups

Questions? Comments? Contact the dn