I have developed the application and now it's time to distribute to my users. I was reviewing my application and reading security best practises and found below statement in one of the article.

Published software should provide the user with the message digest so that user can validate the accuracy and completeness of the software

Now, the question is how can I do it practically? How do I sign my MSI package or application? Where I can find the process and steps? How user validate my application accuracy?

  • 3
    The body and the title ask different question. In the body it is about accuracy and completeness, i.e. essentially that the software was not deliberately (attacker) or accidentally (broken download, flipped bit during transport). In the title you instead ask about trust which means that the user can believe that the app does what it is expected to do and will not harm the user (i.e. no backdoor, trojan, ...). Please adjust your question to make clear what you really want to know. – Steffen Ullrich Aug 18 '19 at 5:08
  • in that case, accuracy and completeness are to do with release notes and digest is about trust. Am I right? – kudlatiger Aug 18 '19 at 8:12
  • I have no idea what release notes have to do with accuracy and completeness. And no, a simple digest does not provide any trust. It just provides a way to find out if the download was correct - provided the digest itself was not tampered with by an attacker. Apart from that it is still unclear what you are asking since you did not change your question. I recommend that you focus on what you want to achieve and not the technology to use for this, since it looks like that you have the wrong understanding of what can be achieved with a specific technology. – Steffen Ullrich Aug 18 '19 at 8:28

You should provide the user with a message digest (ex - sha256) so that user can validate the accuracy and completeness of software. Digests are designed in a way that even a single bit flip in your application will result in a different digest.

You can calculate the sha256 digest using following command on a mac machine (Tested on mojave)

openssl dgst -sha256 <file.msi>

You should provide the hash algorithm used i.e., sha256 along with the digest from the above command which a user can validate on their own machine after downloading your application. If the digest matches the one mentioned on your website then only the accuracy of your application is validated.

| improve this answer | |
  • This is really only helpful if the download is from a mirror. If the download isn't from a mirror and doesn't use TLS it's marginally useful in the event there is a collision in TCP checksums, but that's unlikely, and if the download is over TLS as is increasingly common, there is no real benefit at all. – AndrolGenhald Aug 18 '19 at 17:16
  • @AndrolGenhald then what will be the better solution? I am basically sharing the MSI using internal network share. chances are less someone break in to it. But just trying to be safe because this application going to be installed on hundreds of devices and I do not wish surprises on the field! – kudlatiger Aug 19 '19 at 14:41

Not the answer you're looking for? Browse other questions tagged or ask your own question.