I have a dll file signed with my private key, here is the signature info in Windows Explorer:

Windows signature details on test.dll

Now, using the public key found in the certificate, how can I verify the integrity of the file?

Image of my signing certificate

I am shipping the exe to the client and need the exe to verify its own signature at startup. Which c++ API or Windows default commands can I use to implement this?

  • 2
    This is a very unconventional way to use digital signatures. "Decrypting the signature to get the hash" may work in this case because it's RSA, but it wouldn't work with any other signature algorithm. If you have the file and you're trying to get the hash, why not just hash the file? Basically, can you explain what you're trying to accomplish, because right now this seems like an XY Problem. – Mike Ounsworth Oct 11 '18 at 12:46
  • No i am going to hash the file again and compare it with the hash decrypted from the message digest.This is to make sure that the application is not affected with some malicious payload – Kethiri Sundar Oct 11 '18 at 12:48
  • 2
    I see. If you Google for "how to verify an rsa signature" you'll get plenty of articles, most of which are pretty mathy because, well, this is tricky to do properly. Why not use a pre-built RSA_verify() from a library like openssl or libsodium? – Mike Ounsworth Oct 11 '18 at 12:57
  • I am shipping the exe to the client. I cant expect openssl libsodium libraries in his environment.I need to do it within the application itself.So I need some functions or windows inbuilt tools to achieve this – Kethiri Sundar Oct 11 '18 at 13:06
  • 2
    I would caution that "self-verifying EXEs" don't give you as much security as you think; an attacker who is moderately skilled with reverse-engineering can modify your file, re-sign it with their own certificate, and then replace the certificate that's embedded in the exe. The better approach is to get a publicly-trusted code signing certificate from a public CA so that the Windows OS can verify the signature for you. – Mike Ounsworth Oct 11 '18 at 13:20

With all due respect, you are trying to reinvent the wheel for something that you don't understand very well. You are trying to hand-roll your own RSA signature verification code so that your app can verify its own signature at startup.

This is a solved problem through the Windows Code Signing system. What you should do is buy a proper code signing certificate so that Windows automatically verifies the signature on your app every time it is run:

Windows code signing dialog box

Crypto is very tricky and hard to get right, so I highly advise you to use the built-in Windows mechanisms rather than trying to do this from scratch.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.