3

I'm curious about how Windows check the Authenticode signature.

For example, I would sign test.exe

I know that if test.exe doesn't have a TS (timestamp) signature from a TSA (Timestamp Authority), the signature would expire after the certificate's NotAfter datetime.

I used to believe that if test.exe have a Authenticode signature with a valid TS signature, this signature would expire after the TS certificate expire.

However, it seems I'm wrong... When I was cleaning my old computer, I found the PlantsVsZombie!(⊙o⊙) You can download the main file from here ( I'm not sure how long can I keep this link available... )

Its signing certificate expired at 2012/9/21 and its timestamp certificate expired at 2012/6/15. Both of these two certificates expired now. But surprisingly, its signature is still valid (Checked using Powershell command Get-AuthenticodeSignature and viewed from the attributes-Signature tab)

Then I wonder will a signature with timestamp expire? If it would, at which time?

2

I'm curious about how Windows check the Authenticode signature

Microsoft's Authenticode is a mechanism that is based on PKI as any other digital certificate verification process:

  • Public key verification
  • Certificate lifespan
  • Certificate status (revoked?)
  • Trust chain
  • Timestamp (if used)

In case of timestamp, the signature will be valid as long as the certificate is valid. Otherwise, it will expire when the certificate does.

From DigiCert:

Timestamping ensures that code will not expire when the certificate expires because the system validates the timestamp. If you use the timestamping service when signing code, a hash of your code is sent to the timestamp server to record a timestamp for your code. A user’s software can distinguish between code signed with an expired certificate that should not be trusted and code that was signed with a Certificate that was valid at the time the code was signed but which has subsequently expired.

  • I know that it is based on PKI, but I wonder the relationship between signature validity, CodeSign Certificate lifespan and Timestamp Certificate lifespan. – JemmyLoveJenny Aug 3 '18 at 7:18
  • But the PVZ I provide still has a valid signature, although both timestamp and codesign certificate expired. – JemmyLoveJenny Aug 3 '18 at 7:21
  • @JemmyLoveJenny When you sign the executable with a timestamp, you ensure that the executable will be valid forever(as long as the certificate that used to sign it is trusted) the expiration of the certificates indicate that cannot sign another until you will get another valid certificate – Harel M Aug 3 '18 at 11:12
  • You mean that the timestamp certificate's lifespan have no impact at all? – JemmyLoveJenny Aug 4 '18 at 6:37
  • Timestamp isn't just time, it includes the timestamp certificate, current time the corresponding signature. – JemmyLoveJenny Aug 4 '18 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.