dotnet security: Strong names - are these cryptographic?? -- dotnet security

Re: Strong names - are these cryptographic??

Daniel Fisher(lennybacon)
9/28/2004 11:42:32 AM

Hi Sholto

1. You can allways create a stong name assembly without a VeriSignID.
use Sn.exe
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cptools/html/cpgrfStrongNameUtilitySNexe.asp

2. You can sign an with a VeriSignID assembly by using the SignCode.exe
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cptools/html/cpgrfFileSigningToolSigncodeexe.asp

Michael Willers posted this yesterday:

.... strong name garanties referal integrity by providing a unique name.
That's
why versioning works with a strong name only. In addition it garanties code
integrity. It uses public key encryption to create a digital signature that
contains a hash of the assembly. At load time the CLR creates a hash again
and "extracts" the hash embedded in the signature by using the public key.
It then compares both hashes and if they are not equal the assembly has been
tampered with. In this case the CLR will not load it and as a result no code
gets executed. So in order to modify the assembly you need to have the
private key.
This is how a strong name provides code integrity. But where did the
assembly come from? There is no proven identity. And this is where
certificates come into play. They bind a public key to an identity.
So the decision is up to you: If you know the issuer of the assembly
personally and trust him there is no need for a certificate. If not, then
certificates are the way to go....

For more visit his blog http://staff.newtelligence.net/michaelw/

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: http://www.lennybacon.com/

Re: Strong names - are these cryptographic??

Sholto Douglas
9/28/2004 3:57:02 PM

Hi Daniel,
Thanks for answering.
In your response #2, do you mean I can create a strong-name assembly first
and then sign it with SignCode? I was slightly confused by this because a
strong-name assembly already contains a public key. If I sign it with a
VeriSign ID, will this add yet another public key, or does it replace the
existing one? Does it matter?

Cheers,
Sholto

[quoted text, click to view]

Re: Strong names - are these cryptographic??

Michel Gallant
9/28/2004 7:21:00 PM

SignCode will apply another layer of digital signature, called
an "Authenticode" signature to the managed .NET assembly.
This signature layer involves certificate issuer trust verification
(whereas Strong Name signature does not make explicit use of
any certificate issuer trust hierarchy).
An Authenticode signature is identical to the one applied to native PE files
(e.g. for many trusted Microsoft software updated to .exe, .cab etc.. files)
Generally, the public key used with an Authenticode signature is
one encapsulated by a commercially issued code-signing
certificate (e.g. VeriSign, Thawte etc..)

- Mitch Gallant
MVP Security

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.