My basic understanding of how a sign tool works is:

  1. Load the zip-file (may be exe, jar, ddl, apk, etc.) which has to be signed to its memory (cache memory of the sign tool).

  2. Verify it and unzip the file again into its memory

  3. Generate the hash of all the files inside the zip-file.

  4. Encrypt the hash-code using the digital certificate from CA.

  5. Append the encrypted values to the zip-file and return the signed file.

I am confused by the memory used by the sign tool to load, unzip and generate hash code. How does that work? If the memory is managed by the sign tool, how will that work when we sign a huge file, i.e. several gigabytes?

  • 1
    The data can be streamed to the hashing function. There is no need for more than a few megabytes of memory to be used in order to efficiently calculate a hash. – Jonathan Gray Dec 16 '15 at 11:08
  • @JonathanGray , Say example we need to sign an jar file of 1GB , the sign tool will have to extract the jar file to verify it, So how will this happen? – Goutham Nithyananda Dec 22 '15 at 9:01
  • The signtool doesn't need to extract the jar file. It simply needs to calculate the hash of the contents. It does this by reading the jar file a chunk at a time and feeding the bytes into a hashing function. When all of the data has been streamed to the hashing function it simply takes the hash and uses it to create a digital signature of the file. Then the digital signature basically gets appended to the end of the file. – Jonathan Gray Dec 23 '15 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.