Questions tagged [code-signing]

Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.

Filter by
Sorted by
Tagged with
0
votes
1answer
35 views

Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?

Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
0
votes
0answers
47 views

What (if any) are the implications of Apple stop signing iOS 15.1?

I have read on the web ([1], [2]) that Apple has stopped signing the iOS 15.1. The two articles describe that it will prevent users from downgrading the OS. And the inability to jailbreak the iPhone. ...
0
votes
1answer
58 views

Sharing Yubikey via SSH

I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key. Can I share my ...
0
votes
1answer
87 views

Signing Binaries in CI/CD

I've been considering how continuous integration/delivery environments handle code signing. If I maintain some open source project which uses a CD environment to build binaries to ship to users, I may ...
1
vote
0answers
120 views

How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?

Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
0
votes
1answer
72 views

designing updater with certificate renewal in mind

A program A downloads signed executables and other signed configuration files. Configuration files have signature appended at the end of files. To verify their integrity and creator, it uses the ...
1
vote
1answer
66 views

Software signing : multiple certificates

I'm quite new to the cryptography field, and I'm trying to understand a few things: I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below: I'm ...
0
votes
1answer
302 views

How to update certificates/CRL on Windows 7 systems that are without support contracts?

A quality answer to this question mentions: "System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft." How does one update ...
0
votes
1answer
141 views

If a file is digitally signed, is posting a hash very useful for security purposes?

In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
0
votes
0answers
60 views

CSP DLLs still needed to be signed?

I'm developing a custom CSP and I want to use it from Adobe Reader but it is not very clear to me if it still needs to be signed because here there is a note: "Starting with Windows 8, it is no ...
2
votes
1answer
205 views

What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?

I'm trying to figure out how to establish trust in Windows executables that I download from the internet. Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
3
votes
2answers
243 views

Why should I go to SHA512withRSA signature for my Android apps?

I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default. Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
0
votes
1answer
132 views

Spoof publisher info on Windows applications

Let me start by acknowledging that I have absolutely no experience with Windows development and this is purely for academic purposes. I apologize for incorrect terminology and welcome corrections or ...
1
vote
0answers
85 views

Is it ok to store my Android app keystore password in a text file on my disk?

I am reading on how to sign and publish my flutter app on android. When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
1
vote
0answers
51 views

Standard for verifying certificates that signed code

When one verifies a certificate that came alongside a signature for some sort of code, is there a standard that specifies what shall be verified? For example, if I'm to verify a certificate that came ...
0
votes
0answers
52 views

Switching CSC certificate issuer and SmartScreen

We have most of our SSL certificates hosted at GoDaddy but have Standard Code signing certificate from GlobalSign, we would like to switch to GoDaddy CSC since our CSC from GlobalSign is expiring in 3 ...
1
vote
1answer
51 views

Which practices should i use while generating SMS codes for auth on my project?

Let's imagine that we have an SMS verification auth, and using random 4-digit codes, i.e. 1234, 5925, 1342 and etc. I'm using this random inclusive algorithm on my node.js server: function ...
4
votes
1answer
263 views

How to validate client side safety in a Zero Knowlegde model

What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
1
vote
2answers
190 views

Why infamous Addtrust certificate is still not expired (same private key) for code signing?

As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
0
votes
2answers
212 views

How can we verify an installer's validity by checking its signature?

I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted ...
6
votes
1answer
996 views

gpg key size of 4096 and "the future is ECC"

My boss wants to sign our binary. I need to tell him how he can create the signing key. Most if not all sites I have seen about signing binaries say "use gpg". OK, so gpg per default has 2048. Their ...
2
votes
1answer
5k views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
136 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
1
vote
0answers
55 views

Create signed release binaries and distribute with custom repository (debian)

I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther. I set up a ...
3
votes
1answer
133 views

Why does Windows consider a certificate valid even after its expiration time?

I downloaded Google's Cloud SDK installer today, and upon checking the certificate to validate it, I noticed something strange: the expiration date of the certificate appears to be December 22nd 2019 -...
1
vote
1answer
300 views

Why does productsign use SHA1 instead of SHA256 to sign the pkg?

I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
1
vote
2answers
347 views

Can I use Let's Encrypt to verify my signing key?

I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
1
vote
0answers
126 views

Confirming the validity/ownership of a Android Signing Certificate

I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate. Is there a way to query ...
1
vote
0answers
80 views

Can an EXE code signing renew even though it's expired?

I've just downloaded composer from getcomposer.org, but a strange thing had happened. When I clicked "install for all users" button, the UCA says "Unknown publisher", but when I was checking its ...
0
votes
1answer
104 views

Cryptographically signing content / download

Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server. I would ...
2
votes
1answer
310 views

How to ensure authenticity and integrity of a directory

I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've ...
0
votes
0answers
162 views

Check CRLs of signed JARs

I have a signed JAR. How could I check if the corresponding code-signing certificate was revoked? Technically there seem to be the following options: The Java TrustStore holds CRLs/revoked ...
18
votes
3answers
5k views

Transferring Microsoft SmartScreen reputation to renewed certificate

I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning: Windows Defender SmartScreen prevented an unrecognized app from starting The ...
1
vote
0answers
61 views

How attackers bypass windows smart screen [closed]

I'm curious to how attackers gain access to valid EV certificates that bypass windows smart screen (for malware delivery/execution) or how they sign these malicious software(s) without access to EV ...
3
votes
1answer
359 views

How reliable is Virustotal's file signature check?

I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times ...
1
vote
0answers
61 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
1
vote
0answers
58 views

High Availability Boot processes and only using code-signing certificates

High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as: "HAB authentication is based on public key cryptography using the RSA algorithm in ...
0
votes
1answer
220 views

Cross-signing certificates for Windows Driver Signing

For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key. ...
4
votes
1answer
464 views

Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?

I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file: How can I tell if it was signed with an extended validation (EV) code-signing certificate? ...
1
vote
0answers
104 views

Certificate pinning for device firmware signing

What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
5
votes
3answers
2k views

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Let we have a hash function that is second preimage resistant but not collision-resistant. Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
2answers
104 views

Signing the same solution (list of files) by multiple CA

We (platform owner) have a requirement to sign a 3rd party (partner) software solution which will be hosted on our platform. The 3rd party solution is signed by the partner with some well known CA. ...
2
votes
0answers
346 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
1
vote
0answers
339 views

Windows Smart Screen pops up after EV Code Signing

I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
0
votes
2answers
674 views

How to verify a private key has not been compromised?

I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
1
vote
0answers
179 views

Secure way to sign virtualbox module for secure boot

I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
3
votes
1answer
265 views

How do I verify that my TurboTax software is legitimate

I bought TurboTax software from Amazon (downloaded Mac version). Therefore, I know it is safe to use. However, if one wants to verify the software has not been tampered with, how do we do that? Mac ...
1
vote
1answer
75 views

Code-Signing: Why is the CA process different from web site certificates?

I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
0
votes
2answers
188 views

Software Signing Standards

Is there a software signing certificates standard, officially or by popularity? As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from ...
1
vote
2answers
1k views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...