0

I have a system (lets call it signer) that has private keys for doing Authenticode code signing. I have bunch of build systems that want to sign generated build artifacts. Obviously I can't use signtool directly on build systems as private key is not available. Currently we copy binaries to signer box. Copy them back after signing. That is like moving a mountain back and forth instead of asking the priest to deliver his sermon at the mountain. I am looking for a creative solution where I run signtool on build machine using TBD CSP (Crypto Service Provider). The CSP in turn sends the hashes to signer box. Gets signatures back and passes them to signtool. That way I am passing hashes instead of whole file.

I believe commercial HSMs employ similar techniques. I am wondering if there are builtin features in Windows to create a custom CSP like what I want to solve this problem. Otherwise how does one build a custom CSP to support this model for Windows 10+ systems?

I appreciate your pointers.

Improve this question
3
  • Maybe the build machines can have a shared folder that the signer machine has read/write access to. That should use about half the bandwidth as what you're doing now but the signer would still end up reading all of the EXE over the network to calculate its hash.
    – David Grayson
    Nov 30, 2022 at 16:27
  • That is what we are doing now using Windows shares. The file copies over SMB is slow. Thats why looking for alternate method
    – videoguy
    Nov 30, 2022 at 22:43
  • What I was trying to say is that you don't have to copy files, just let the signer machine modify the file in place; point signtool at the network drive. It will end up reading the contents of the files over the network but the writes it does are probably pretty small; I'm not sure though.
    – David Grayson
    Nov 30, 2022 at 23:55

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .