0

What steps should I take to make sure that the certificate of a file can be trusted. Or is there really a way to be absolutely sure about that?

I am currently implementing this validation using the WinAPI. The validation of a file's digital signature is done using WinVerifyTrust. As the certificate verification, I am extracting all the information about the certificate (like its thumbprint, all root CAs, etc.). However, I don't know how to use it to verify its authenticity.

Any other tips and information about verifying the digital signature and certificate of a file is appreciated.

Improve this question
3
  • Depends on what exactly you want to make sure. If you only want to trust files signed by Oracle, you should check that the file is actually signed with a known-good Oracle CA. And so on. What bad thing do you want to avert by checking signatures?
    – StackzOfZtuff
    Nov 20, 2016 at 18:35
  • Well I am working on something like anti-malware software and certificate validation is just another layer of security. I know that certificates can easily be faked, so maybe I should focus on certificate validity and authenticity rather than it being trustworthy. What do you think?
    – akz
    Nov 20, 2016 at 18:55
  • Cert validity on its own is pretty useless. Imagine you are a security guard at a company. If you just let in everybody with a valid photo ID, you don't really gain ANY security. You need to have something else in addition to "valid photo ID". Like a whitelist/blacklist of wanted/unwanted names. The same applies for certs. "Certificate validity" is a useless lego building block if used on its own. It needs more. The blacklist/whitelist approach is about the easiest useful thing you can compare a known good signature against.
    – StackzOfZtuff
    Nov 21, 2016 at 9:21

1 Answer 1

Reset to default
1

This answer has an implementation in C++:

BOOL bIsSuccess;
DWORD dwEncoding, dwContentType, dwFormatType;
HCERTSTORE hStore = NULL;
HCRYPTMSG hMsg = NULL;
PVOID pvContext = NULL;

// fill szFileName
...

// Get message handle and store handle from the signed file.
bIsSuccess = CryptQueryObject (CERT_QUERY_OBJECT_FILE,
                               szFileName,
                               CERT_QUERY_CONTENT_FLAG_ALL,
                               CERT_QUERY_FORMAT_FLAG_ALL,
                               0,
                               &dwEncoding,
                               &dwContentType,
                               &dwFormatType,
                               &hStore,
                               &hMsg,
                               &pvContext);

To verify the signature of the file I would recommend you to use CertGetCertificateChain and CertVerifyCertificateChainPolicy to verify not only that the certificate is valid in general, but that it (or all its parents) is valid for authenticode (szOID_PKIX_KP_CODE_SIGNING). CertGetCertificateChain can be used for different revocation scenarios. You should do two separate calls with CERT_CHAIN_POLICY_AUTHENTICODE and CERT_CHAIN_POLICY_AUTHENTICODE_TS to verify that both Authenticode chain policy and Authenticode Time Stamp chain policy are valid.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .