3

I have a dll file signed with my private key, here is the signature info in Windows Explorer:

Windows signature details on test.dll

Now, using the public key found in the certificate, how can I verify the integrity of the file?

Image of my signing certificate

I am shipping the exe to the client and need the exe to verify its own signature at startup. Which c++ API or Windows default commands can I use to implement this?

Improve this question
10
  • 2
    This is a very unconventional way to use digital signatures. "Decrypting the signature to get the hash" may work in this case because it's RSA, but it wouldn't work with any other signature algorithm. If you have the file and you're trying to get the hash, why not just hash the file? Basically, can you explain what you're trying to accomplish, because right now this seems like an XY Problem.
    – Mike Ounsworth
    Commented Oct 11, 2018 at 12:46
  • No i am going to hash the file again and compare it with the hash decrypted from the message digest.This is to make sure that the application is not affected with some malicious payload
    – Kethiri Sundar
    Commented Oct 11, 2018 at 12:48
  • 2
    I see. If you Google for "how to verify an rsa signature" you'll get plenty of articles, most of which are pretty mathy because, well, this is tricky to do properly. Why not use a pre-built RSA_verify() from a library like openssl or libsodium?
    – Mike Ounsworth
    Commented Oct 11, 2018 at 12:57
  • Ok, I'm getting closer to understanding your question. But, ... you want your exe to verify its own signature (ie the file test.exe checks the signature on test.exe)?
    – Mike Ounsworth
    Commented Oct 11, 2018 at 13:10
  • 3
    I would caution that "self-verifying EXEs" don't give you as much security as you think; an attacker who is moderately skilled with reverse-engineering can modify your file, re-sign it with their own certificate, and then replace the certificate that's embedded in the exe. The better approach is to get a publicly-trusted code signing certificate from a public CA so that the Windows OS can verify the signature for you.
    – Mike Ounsworth
    Commented Oct 11, 2018 at 13:20

2 Answers 2

Reset to default
5

With all due respect, you are trying to reinvent the wheel for something that you don't understand very well. You are trying to hand-roll your own RSA signature verification code so that your app can verify its own signature at startup.

This is a solved problem through the Windows Code Signing system. What you should do is buy a proper code signing certificate so that Windows automatically verifies the signature on your app every time it is run:

Windows code signing dialog box

Crypto is very tricky and hard to get right, so I highly advise you to use the built-in Windows mechanisms rather than trying to do this from scratch.

Improve this answer
1
  • "buy a certificate" or use a free certificate from lets encrypt
    – milahu
    Commented Nov 18, 2021 at 12:24
2

I created a tool that uses Windows CryptAPI and WintrustAPI to verifiy signatures. It is built as a GUI with some management capabilities. It is open-source, you can get executables and source code here:

https://github.com/inamozov/SigInfoGUI

Maybe this code will help you to better understand how Wintrust and CryptAPI works in Windows

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .