The code-signing tag has no wiki summary.
2
votes
2answers
55 views
What to do if you ever lose a smart card?
I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks.
My idea is to generate the key using GnuPG on an isolated computer, ...
3
votes
1answer
58 views
Internal code-signing certificate on Windows
I'm looking to improve defense-in-depth on a system, primarily by closing some holes in injected DLLs. Certain applications installed on the system cause helper DLLs (e.g. shell extensions, BHOs, ...
1
vote
0answers
77 views
How to check executable code signing signatures?
How can I see all code signing signatures an executable has?
I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers.
...
1
vote
1answer
1k views
Java Applet - Need Code Signing Certificate vs SSL Certificate
I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed.
I used the certificate/key used for the apache2 ssl ...
3
votes
1answer
93 views
How is an Authenticode timestamp verified?
For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
0
votes
1answer
99 views
What protection certificates would be required for an application that consists of setup, loading utility and main application?
Say we have an InnoSetup installer script, a native C++ QT files loading application and a .Net client application that we load/update each time and which is the main application. We load files via ...
3
votes
3answers
320 views
Why a self-signed digital certificate (X.509) cannot be altered?
I'm not experienced in code signing but I was thinking about this: as you know, there are various tools for self-signing digital certificate generation (as makecert from Windows or OpenSSL). Now, It ...
4
votes
2answers
619 views
What is the impact of the Bluebox Android APK integrity vulnerability?
Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media.
The title of the post is "Uncovering Android Master Key" - ...
7
votes
1answer
258 views
Signing a browser extension
I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
4
votes
1answer
395 views
Does Authenticode still work offline and with a “fake” certificate
Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
1
vote
2answers
134 views
How does a code signing vender charge for creating certificate chains?
I have a question about creating digital signatures for pdf files.
I want to have a certificate for my company and have children certificates as many as the number of company's employees who can ...
4
votes
1answer
789 views
Code signing with MD5 on Windows 8
I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8.
Further investigation showed that the ...
4
votes
1answer
129 views
Strategies for signing sections of a text file to prevent tampering
I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable:
I have a collection of chef recipes in git, ...
3
votes
6answers
541 views
Is a self signed certificate sufficient to prove the integrity of my executable?
I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe.
I would like to know if this ...
