New answers tagged

2

Yes, this is true, though the timing differences between two short messages (e.g. 100 and 1000 bytes) are negligible. Computing the SHA256 hash of a gigabyte of data understandably takes much longer than computing the SHA256 hash of a few hundred bytes.


0

Not as a full answer, but for some additional overview information, including signtool example lines for dual signing (XP/Vista compatibility) I managed to switch nicely to dual-signing in my build chain according to this very good blog post from ksoftware.net, our certificate supplier. I wrote a small batch file to dual-sign a file with the two ...


0

I just went through the same issue with our Windows apps. So here's some info for you: A) As you pointed out SHA-1 hash is being phased out due to it's inadequate collision resistance. Or, in other words, it doesn't produce code signatures that are strong enough by today's crypto-standards. B) To code-sign your executable you'll need to have a code-signing ...


5

I've now found an example of an actual download that was signed using an SHA-1 certificate after 1/1/2016. I downloaded KeePass 2.31 using Edge on Windows 10. Edge tells me that "The signature of this file is corrupt or invalid." If I right-click and select "run anyway", our double-click the file in Windows Explorer, SmartScreen blocks the file: ...


1

There are 3 digests in a timestamped Authenticode signature that you have control over. The digest of your certificate. A recently purchased certificate will use SHA-256. Most CAs switched to issuing SHA-256 certificates during 2014. They only provide SHA-1 certificates on special request. A quick way to check your certificate is to right-click on an ...



Top 50 recent answers are included