11

I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my company's code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?

Improve this question
3
  • related: Internal code-signing certificate on Windows
    – SEJPM
    Commented Apr 4, 2016 at 20:10
  • @SEJPM how's that related. I'm talking about using an external, trusted CA provided cert to sign drivers that are part of product we sell. Its not internal, and we use it successfully to sign drivers we've written for our custom hardware.
    – Grhm
    Commented Apr 4, 2016 at 20:16
  • the last three paragraphs of the answer given in that question seem relevant (a) Windows may break and b) you may get your certificate revoked if any signed file leaves your network
    – SEJPM
    Commented Apr 4, 2016 at 20:22

1 Answer 1

Reset to default
16

When you sign code, it means that you vouch for that code. When people decide to trust your signature, it means that they trust you to only sign code after you verified that it is trustworthy.

When you abuse that trust and someone finds malware with your signature on it, you can expect them to never trust your signature again. When your certificate has a special trust status by any operating systems or distribution platforms, you can expect that this trust will likely be revoked if it comes to the attention of the maintainers that you signed malware with it.

So if you decide to sign 3rd party device drivers, you should only do so when you feel you can wholeheartedly take responsibility for whatever that driver does. If you can not do that with a clear conscience, it's better to leave it unsigned and let the user decide if they trust it. Or better, find a more trustworthy alternative.

Improve this answer
6
  • 2
    In summary: "never being trusted again" vs "time and effort required to track down 3rd parties".
    – Pharap
    Commented Apr 5, 2016 at 0:42
  • 1
    @Pharap : ... vs. time and effort and expense of simply creating another signature?
    – TOOGAM
    Commented Apr 5, 2016 at 2:17
  • 3
    @TOOGAM: ...and building up customer trust again from scratch, with a black mark against you already.
    – Wildcard
    Commented Apr 5, 2016 at 2:34
  • 6
    @TOOGAM Remember that it is not the trust in your certificate which got compromised, but the trust in the QA processes of your organization. Just replacing the certificate won't do, as people will now distrust your organization. You will not convince people you won't do this ever again simply by changing your certificate.
    – Philipp
    Commented Apr 5, 2016 at 7:46
  • 1
    @Philipp: That's helpful thanks. None of this suggests any legal ramifications or precedents, just potential damage to reputation.
    – Grhm
    Commented Apr 5, 2016 at 11:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .