Questions tagged [code-signing]
Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.
166
questions
1
vote
1
answer
74
views
How does npm’s ECDSA signing system improve security?
I have not been able to find a single page that actually explains how npm’s
ECDSA signing system works.
The closest I could find is the official documentation, but as far as I can
tell from that ...
- 332
1
vote
1
answer
61
views
How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?
I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times ...
- 13
0
votes
0
answers
161
views
Can't sign commit with yubikey, GPG missing something
I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got:
gpg --list-keys
/home/lz/.gnupg/pubring.kbx
----------...
- 11
1
vote
1
answer
81
views
Interaction of a Code Signature and a Timestamp token from a TSA
I'm currently in the process of writing a program that:
Reads a binary file (a C++ program) and creates a SHA256 hash of the data (like a checksum)
Use this calculated hash and a self signed CA ...
- 13
1
vote
1
answer
155
views
How do I compare a signed .exe file with the unsigned version of the same .exe file?
I have had some binary executable files (.exe) for Windows signed, I have checked the signature of the signed files, but I would also like to check that the file that I sent for signing is indeed ...
17
votes
4
answers
3k
views
Is signing a file better than issuing a checksum, and does it render a separate checksum useless?
Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work?
Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
- 181
9
votes
1
answer
2k
views
How do GPG smart card devices handle large GPG operations?
How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.
My first 2 pet theories are:
There's some way to chunk up GPG operations or use some ...
- 93
0
votes
1
answer
121
views
Are .NET runtime really not signed?
I'm doing a manual install on Linux of the .NET runtime which can be downloaded from dotnet.microsoft.com.
MS do provide a SHA512 checksum of the file on the site, but that can't be use to verify the ...
- 99
1
vote
2
answers
190
views
TPM Endorsement Key usage in secure and trusted boot
Taking into account a Root of Trust in a device using a TPM.
My understanding is that the bootloader, firmware, operating system, applications etc. are all verified on startup by validating signatures ...
- 257
7
votes
1
answer
669
views
How can a .exe be modified and still keep a valid digital signature?
When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true.
...
- 91
3
votes
1
answer
409
views
Secure boot after an OTA update confusion
My understanding is that secure boot works by verifying each stage in the boot process before proceeding. So first, UEFI or booting firmware will validate the signature of the bootloader, then kernel, ...
- 257
0
votes
0
answers
39
views
How To First Strip and Then Sign Kernel Modules at Complie Time
It seems easy to sign kernel modules at compile time. Apparently, you just set CONFIG_MODULE_SIG_ALL=y in your .config file and then the compiler will perhaps give you the appropriate errors until you ...
- 113
0
votes
0
answers
66
views
double hashing for code signing and verification
I have environmental constraints where the cyber and safety functions are segregated such that safety operations are handled by one unit and cyber operations such as firewall, HIDS, secure storage etc....
1
vote
1
answer
112
views
Why does Microsoft SmartScreen require OV certificates to be signed by a trusted CA?
Signing your applications with an OV code signing certificate enables them to build reputation together in Microsoft SmartScreen, rather than each binary building reputation separately. This allows ...
- 233
0
votes
0
answers
76
views
What (if any) are the implications of Apple stop signing iOS 15.1?
I have read on the web ([1], [2]) that Apple has stopped signing the iOS 15.1.
The two articles describe that it will prevent users from downgrading the OS. And the inability to jailbreak the iPhone.
...
- 1
0
votes
1
answer
129
views
Sharing Yubikey via SSH
I have a MacBook which has a Yubikey. I usually don't use my MacBook for any development. I use a remote Linux server. I would like to sign my commits with Yubikey instead of a gpg key.
Can I share my ...
- 103
0
votes
1
answer
264
views
Signing Binaries in CI/CD
I've been considering how continuous integration/delivery environments handle code signing.
If I maintain some open source project which uses a CD environment to build binaries to ship to users, I may ...
- 103
1
vote
0
answers
142
views
How to stop 3rd party libraries from being reported as malicious, if they were part of malicious programs in the past?
Some are standard user space dll’s and another one is actually a windows driver. The libraries alone are not dangerous and are pure utilities but they can be used by bad guys, like most software tools....
- 141
0
votes
1
answer
120
views
Designing an updater with certificate renewal in mind
A program A downloads signed executables and other signed configuration files. Configuration files have a signature appended at the end. To verify their integrity and creator, it uses the public key ...
- 639
1
vote
1
answer
122
views
Software signing : multiple certificates
I'm quite new to the cryptography field, and I'm trying to understand a few things:
I used binwalk on Linux to analyse Minecraft.msi, and I found multiple certificates in the .msi See below:
I'm ...
John
1
vote
1
answer
1k
views
How to update certificates/CRL on Windows 7 systems that are without support contracts?
A quality answer to this question mentions:
"System is regularly updated with latest patch specifically certificate/CRL from trusted source such as Microsoft."
How does one update ...
0
votes
1
answer
328
views
If a file is digitally signed, is posting a hash very useful for security purposes?
In this question I asked about how to handle situations when SHA-256 hashes are not available for a file downloaded from the internet that contains executable code. Another community member ...
0
votes
1
answer
94
views
CSP DLLs still needed to be signed?
I'm developing a custom CSP and I want to use it from Adobe Reader but it is not very clear to me if it still needs to be signed because here there is a note:
"Starting with Windows 8, it is no ...
2
votes
1
answer
483
views
What's the difference between an executable signed with a Windows Digital Signature and one signed with PGP?
I'm trying to figure out how to establish trust in Windows executables that I download from the internet.
Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they ...
- 123
4
votes
2
answers
418
views
Why should I go to SHA512withRSA signature for my Android apps?
I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default.
Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
- 41
0
votes
1
answer
251
views
Spoof publisher info on Windows applications
Let me start by acknowledging that I have absolutely no experience with Windows development and this is purely for academic purposes. I apologize for incorrect terminology and welcome corrections or ...
- 1
1
vote
0
answers
132
views
Is it ok to store my Android app keystore password in a text file on my disk?
I am reading on how to sign and publish my flutter app on android.
When reading through the official docs, they suggest to make a configuration file where I put my password to the keystore in plain ...
- 111
1
vote
0
answers
72
views
Standard for verifying certificates that signed code
When one verifies a certificate that came alongside a signature for some sort of code, is there a standard that specifies what shall be verified?
For example, if I'm to verify a certificate that came ...
- 541
0
votes
0
answers
81
views
Switching CSC certificate issuer and SmartScreen
We have most of our SSL certificates hosted at GoDaddy but have Standard Code signing certificate from GlobalSign, we would like to switch to GoDaddy CSC since our CSC from GlobalSign is expiring in 3 ...
- 101
1
vote
1
answer
78
views
Which practices should i use while generating SMS codes for auth on my project?
Let's imagine that we have an SMS verification auth, and using random 4-digit codes,
i.e. 1234, 5925, 1342 and etc.
I'm using this random inclusive algorithm on my node.js server:
function ...
4
votes
1
answer
301
views
How to validate client side safety in a Zero Knowlegde model
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
- 1,316
1
vote
2
answers
248
views
Why infamous Addtrust certificate is still not expired (same private key) for code signing?
As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
0
votes
2
answers
316
views
How can we verify an installer's validity by checking its signature?
I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted ...
- 263
7
votes
1
answer
2k
views
gpg key size of 4096 and "the future is ECC"
My boss wants to sign our binary. I need to tell him how he can create the signing key.
Most if not all sites I have seen about signing binaries say "use gpg".
OK, so gpg per default has 2048. Their ...
- 427
2
votes
1
answer
7k
views
How to verify a GPG file signature on Linux and Windows without connecting to the Internet?
Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready:
-installation file (eg ...
- 483
0
votes
1
answer
230
views
File authentifications via PGP versus via unique file hashes
Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
- 483
1
vote
0
answers
90
views
Create signed release binaries and distribute with custom repository (debian)
I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther.
I set up a ...
- 427
3
votes
1
answer
185
views
Why does Windows consider a certificate valid even after its expiration time?
I downloaded Google's Cloud SDK installer today, and upon checking the certificate to validate it, I noticed something strange: the expiration date of the certificate appears to be December 22nd 2019 -...
- 33
1
vote
1
answer
372
views
Why does productsign use SHA1 instead of SHA256 to sign the pkg?
I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
- 121
1
vote
2
answers
453
views
Can I use Let's Encrypt to verify my signing key?
I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
- 113
1
vote
0
answers
185
views
Confirming the validity/ownership of a Android Signing Certificate
I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate.
Is there a way to query ...
- 111
1
vote
0
answers
102
views
Can an EXE code signing renew even though it's expired?
I've just downloaded composer from getcomposer.org, but a strange thing had happened.
When I clicked "install for all users" button, the UCA says "Unknown publisher", but when I was checking its ...
user226062
0
votes
1
answer
164
views
Cryptographically signing content / download
Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server.
I would ...
- 1,102
2
votes
1
answer
424
views
How to ensure authenticity and integrity of a directory
I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've ...
- 121
0
votes
0
answers
202
views
Check CRLs of signed JARs
I have a signed JAR. How could I check if the corresponding code-signing certificate was revoked? Technically there seem to be the following options:
The Java TrustStore holds CRLs/revoked ...
- 600
20
votes
3
answers
7k
views
Transferring Microsoft SmartScreen reputation to renewed certificate
I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:
Windows Defender SmartScreen prevented an unrecognized app from starting
The ...
- 493
1
vote
0
answers
86
views
How attackers bypass windows smart screen [closed]
I'm curious to how attackers gain access to valid EV certificates that bypass windows smart screen (for malware delivery/execution) or how they sign these malicious software(s) without access to EV ...
- 11
3
votes
1
answer
530
views
How reliable is Virustotal's file signature check?
I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times ...
- 851
1
vote
0
answers
90
views
What does jarsigner verify in the first place (integrity or authenticity)?
I was reading sth about android code signing and have run into this statement:
The second jarsigner command at v in Listing 3-7 first verifies the
signature block and signing certificate, ...
- 491
1
vote
0
answers
86
views
High Availability Boot processes and only using code-signing certificates
High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as:
"HAB authentication is based on public key cryptography using the RSA algorithm in ...
- 123