Questions tagged [code-signing]
Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.
143
questions
0
votes
0answers
34 views
APK file code signing -managing keys
We are developing an android app marketplace platform for connected lighting. 3rd party developer use our SDK to write android app and submit it in the portal and the end-user downloads the app and ...
1
vote
0answers
32 views
Standard for verifying certificates that signed code
When one verifies a certificate that came alongside a signature for some sort of code, is there a standard that specifies what shall be verified?
For example, if I'm to verify a certificate that came ...
0
votes
0answers
25 views
Switching CSC certificate issuer and SmartScreen
We have most of our SSL certificates hosted at GoDaddy but have Standard Code signing certificate from GlobalSign, we would like to switch to GoDaddy CSC since our CSC from GlobalSign is expiring in 3 ...
0
votes
0answers
10 views
OV certificate: How many downloads you need in order to get rid of the smart screen? [migrated]
If I sign my application with an OV certificate, how many downloads I need until reputation builds up and the smart screen goes away?
Of course there are few possible ramifications here:
The OV ...
0
votes
0answers
32 views
Details on why SmartScreen blocked my download
One of our downloads (an installation full of embedded MSI, exe and whatnot) is getting flagged by SmartScreen on run as well as on download in MS Edge. Download in other browsers seems to work fine, ...
1
vote
1answer
34 views
Which practices should i use while generating SMS codes for auth on my project?
Let's imagine that we have an SMS verification auth, and using random 4-digit codes,
i.e. 1234, 5925, 1342 and etc.
I'm using this random inclusive algorithm on my node.js server:
function ...
3
votes
1answer
211 views
How to validate client side safety in a Zero Knowlegde model
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
1
vote
2answers
103 views
Why infamous Addtrust certificate is still not expired (same private key) for code signing?
As many of you know Addtrust certificate https://crt.sh/?id=1 expired 30 May 2020 as well as many other intermediate certs and now we have to update certs on many servers to either root cert https://...
0
votes
2answers
75 views
How can we verify an installer's validity by checking its signature?
I'm working on some software that can be self-hosted, and it includes a component that can be downloaded and installed on end user machines (Windows only). The download comes from the self-hosted ...
0
votes
0answers
33 views
Is SecureBoot of any use if I keep my private key in a root accessible file?
According to the Debian wiki on SecureBoot,
This removes the risk of userland malware potentially enrolling new keys and therefore bypassing the entire point of SB.
So SecureBoot stops users from ...
3
votes
1answer
177 views
gpg key size of 4096 and “the future is ECC”
My boss wants to sign our binary. I need to tell him how he can create the signing key.
Most if not all sites I have seen about signing binaries say "use gpg".
OK, so gpg per default has 2048. Their ...
1
vote
1answer
143 views
How to verify a GPG file signature on Linux and Windows without connecting to the Internet?
Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready:
-installation file (eg ...
0
votes
1answer
61 views
File authentifications via PGP versus via unique file hashes
Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
1
vote
0answers
27 views
Create signed release binaries and distribute with custom repository (debian)
I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther.
I set up a ...
3
votes
1answer
89 views
Why does Windows consider a certificate valid even after its expiration time?
I downloaded Google's Cloud SDK installer today, and upon checking the certificate to validate it, I noticed something strange: the expiration date of the certificate appears to be December 22nd 2019 -...
1
vote
1answer
148 views
Why does productsign use SHA1 instead of SHA256 to sign the pkg?
I have an application which is packed into a pkg file using productbuild and then is signed using productsign. However when I run pkgutil --check-signature only the SHA1 signature is shown. I also ...
1
vote
2answers
153 views
Can I use Let's Encrypt to verify my signing key?
I've made a signing key with GPG and I would like to have it verified since GPG displays a warning whenever a file signed with my key is verified. I've heard of Let's Encrypt but it only talks about ...
1
vote
0answers
77 views
Confirming the validity/ownership of a Android Signing Certificate
I have a certificate that says the application was signed by Google, but on multiple searches I have reason to believe that it's not actually a google signing certificate.
Is there a way to query ...
1
vote
0answers
64 views
Can an EXE code signing renew even though it's expired?
I've just downloaded composer from getcomposer.org, but a strange thing had happened.
When I clicked "install for all users" button, the UCA says "Unknown publisher", but when I was checking its ...
0
votes
1answer
59 views
Cryptographically signing content / download
Let's say that I have an executable running on a client machine, and, it requires to download some updates on a regular basis. The solution uses TLS to communicate with the download server.
I would ...
2
votes
1answer
96 views
How to ensure authenticity and integrity of a directory
I want to do something similar to Ubuntu's signed checksums in distribution and I'm currently stuck on the integrity part. The tutorial here covers most of what I'd like the process to look like (I've ...
0
votes
0answers
95 views
Check CRLs of signed JARs
I have a signed JAR. How could I check if the corresponding code-signing certificate was revoked? Technically there seem to be the following options:
The Java TrustStore holds CRLs/revoked ...
15
votes
2answers
2k views
Transferring Microsoft SmartScreen reputation to renewed certificate
I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:
Windows Defender SmartScreen prevented an unrecognized app from starting
The ...
1
vote
0answers
44 views
How attackers bypass windows smart screen [closed]
I'm curious to how attackers gain access to valid EV certificates that bypass windows smart screen (for malware delivery/execution) or how they sign these malicious software(s) without access to EV ...
2
votes
1answer
109 views
How reliable is Virustotal's file signature check?
I downloaded a setup.msi file from an untrusted website. Virustotal says it's a signed file and valid signature, by the developer company and "GlobalSign Extended Validation CodeSigning CA" 3 times ...
1
vote
0answers
43 views
What does jarsigner verify in the first place (integrity or authenticity)?
I was reading sth about android code signing and have run into this statement:
The second jarsigner command at v in Listing 3-7 first verifies the
signature block and signing certificate, ...
1
vote
0answers
26 views
High Availability Boot processes and only using code-signing certificates
High Availability Boot (HAB) is a technique described here in an NxP application note. This is best summarised as:
"HAB authentication is based on public key cryptography using the RSA algorithm in ...
0
votes
1answer
112 views
Cross-signing certificates for Windows Driver Signing
For testing purposes I want to test cross-signing certificates for Windows driver signing. I understand the general concept: Two root CAs, one root CA cross-signs the other root CA's public key.
...
2
votes
1answer
184 views
Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?
I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:
How can I tell if it was signed with an extended validation (EV) code-signing certificate?
...
1
vote
0answers
74 views
Certificate pinning for device firmware signing
What are common mechanisms to ensure that a device firmware is not only properly signed, but actually signed by the correct device manufacturer? In TLS communications, certificate pinning or public ...
5
votes
3answers
2k views
Why are non-collision-resistant hash functions considered insecure for signing self-generated information
Let we have a hash function that is second preimage resistant but not collision-resistant.
Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
0
votes
2answers
79 views
Signing the same solution (list of files) by multiple CA
We (platform owner) have a requirement to sign a 3rd party (partner) software solution which will be hosted on our platform. The 3rd party solution is signed by the partner with some well known CA. ...
2
votes
0answers
285 views
Can I sign with two Code Signing certs to build reputation on the newer one?
I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon.
Obviously, the new certificate has no ...
1
vote
0answers
207 views
Windows Smart Screen pops up after EV Code Signing
I am code signing my application's installer using an EV Code Signing that we have bought recently at work. The code signing is performed when the installer is created using Inno Setup (version 5.6.1)....
0
votes
2answers
429 views
How to verify a private key has not been compromised?
I have a machine with a process that signs code for users running 24/7 (encrypting the key is not possible), which will be protected as well as possible. Is there a way to set things up such that I ...
1
vote
0answers
117 views
Secure way to sign virtualbox module for secure boot
I'm not sure if the Virtualbox version from the repository of my Linux distribution is already signed and works right away, but since it's not up-to-date I'm installing Virtualbox from the official ...
3
votes
1answer
180 views
How do I verify that my TurboTax software is legitimate
I bought TurboTax software from Amazon (downloaded Mac version). Therefore, I know it is safe to use. However, if one wants to verify the software has not been tampered with, how do we do that? Mac ...
1
vote
1answer
57 views
Code-Signing: Why is the CA process different from web site certificates?
I recently went to renew a code signing certificate. In preparation I went through our usual process (as for web server certificates) of creating a key pair and a CSR with OpenSSL. When I then went ...
0
votes
2answers
123 views
Software Signing Standards
Is there a software signing certificates standard, officially or by popularity?
As I understand the SSL/TLS/https certificates rules are specified by the RFCs. Mixed use of servers and clients from ...
1
vote
2answers
651 views
Are all fields of the PE certificate directory hashed during authenticode signing?
In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
0
votes
2answers
146 views
Deploy verifiable webapp source code
Recently there have been quite some discussions about the security approach of ProtonMail. Since it do crypto stuff at client-side, loading the javascript code in the user's browser, as far as i know, ...
1
vote
0answers
155 views
Working with Security Metadata in APK file
According to this Blog post, Google has added a Security Metadata on top of an APK to verify that it was originally distributed by Google Play. More specifically it adds APK Signing Block to the APK ...
2
votes
3answers
407 views
What happens when the timestamper's certificate expires?
What happens when the timestampers certificate expires?
If the code is now untrusted, can it be re-stamped without re-signing?
If not, what good does this timestamp do me if my cert is valid until the ...
5
votes
2answers
913 views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
2
votes
1answer
189 views
Alert when unsigned code is run?
I know Windows 10 has a lockdown option, to forbid running unsigned code. But in my organization, I'd get shot if I tried to do that. So I'd like the next best thing: a remote alert whenever unsigned ...
0
votes
1answer
310 views
why is it necessary to have both code signing and time stamping certificates?
I have read about the option to create certificates for signing codes and time stamping. why do we need both of them?
I understand that it helps me when I need to increase the validity of my code, ...
6
votes
1answer
869 views
Where to put a code signing server with EV code signing certificate and plugged-in HSM
Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
1
vote
1answer
54 views
Verifying resident program “integrity” before every run
I am aware that operating systems verify authenticity & integrity of a program file while installing a program to a system.
My question is, do popular OS's provide a way to verify (and warn the ...
3
votes
1answer
345 views
Symantec rooted certificates trust and Oracle Java trust store, is Oracle planing to remove trust as well?
We are using Symantec CA rooted certs to sign JARs. Since Google and Mozilla have indicated that they are not trusting Symantec CA, should I be concerned that Oracle will remove trust from Symantec CA ...
1
vote
1answer
91 views
Verification of Python(x,y) installer
I'm an Aerospace Engineer just starting out in my field, I'm planning to start using Python, but I've run into a bit of a conundrum. I downloaded Python(x,y)-2.7.10.0.exe Windows installer from here (...
