Questions tagged [code-signing]
Code Signing is the process of putting a signature on executables and patches to prove it is genuine, and to prevent attackers from injecting malicious code into end-user's systems.
176
questions
51
votes
2
answers
13k
views
Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?
This commit in my GiHub repo is signed by a key I don't recognize: https://github.com/jonathancross/jc-docs/pull/2/commits/124672699991af75dd2454831670758f08bc74ab
What is going on here?
- 1,710
36
votes
2
answers
26k
views
Smart-Screen filter still complains, despite I signed the executable, why?
First and foremost, this is my very first experience with Code Signing.
I bought Standard Code Signing from Certum for 3 years.
I intend to publish applications in Czech republic mostly.
But to the ...
- 1,707
23
votes
9
answers
30k
views
Deprecation of SHA1 code signing certificates on Windows
EDIT (7/7/2016) - see addition at the end of post
I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables (http:...
- 331
20
votes
4
answers
5k
views
Is signing a file better than issuing a checksum, and does it render a separate checksum useless?
Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work?
Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
- 311
20
votes
4
answers
9k
views
Transferring Microsoft SmartScreen reputation to renewed certificate
I know that even a software signed with a new code signing certificate triggers Microsoft Defender SmartScreen warning:
Windows Defender SmartScreen prevented an unrecognized app from starting
The ...
- 503
16
votes
2
answers
2k
views
How do large companies protect their private (code-signing) keys?
Some time ago I read the canonical answer of our ursine overlord concerning CAs and their private (root) keys.
More recently I stumbled across the question on the question on how to manage code ...
- 9,770
15
votes
2
answers
14k
views
How to become Intermediate Certificate Authority?
I work at government organization. We would like to become Intermediate CA so that we can provide SSL certificates to our branch organizations. We must be able to do code signing, green address bar ...
- 151
11
votes
1
answer
2k
views
Should I sign someone else's code?
I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.
Given that getting new, ...
- 213
11
votes
1
answer
4k
views
Has the leaked D-Link Windows signing key been revoked?
Recently news broke as to D-Link mistakenly publishing a private code-signing key as part of an open source framework:
The D-Link key was leaked in late February, and expired on September 3, it ...
11
votes
2
answers
4k
views
How do systems protect against a stolen code-signing certificate after the certificate expires?
Imagine this scenario:
1st December 2014 - a certificate is stolen and used to sign malware with 2014-12-01 timestamp.
15th December 2014 - the certificate is revoked. Malware will be prevented from ...
- 113
11
votes
1
answer
420
views
Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?
I'm trying to wrap my head around the OCSP revocationTime for D-Link's certificate.
I recently answered another question and ended up drafting a timeline.
That timeline is basically this:
Jul 5 00:00:...
- 18.1k
11
votes
2
answers
971
views
Centralized key management for IOS and Android Code Signing
What is the best way for an enterprise to manage code signing certificates? The default seems to be that Apple and Android keys get stored by each developer on their machines.
I see systems like ...
- 111
10
votes
1
answer
2k
views
How do GPG smart card devices handle large GPG operations?
How do GPG smart card devices (such as a Yubikey) handle large GPG operations? Such as signing binary programs.
My first 2 pet theories are:
There's some way to chunk up GPG operations or use some ...
- 103
10
votes
2
answers
7k
views
Does linux support signed binaries?
I am looking for something similar to what iOS supports. Does it exist in linux?
With a secure boot (based in hardware chain of trust), doesn't it make sense to have signed binaries for security? ...
- 903
10
votes
2
answers
3k
views
Why does Microsoft use a digital signature catalog instead of a signature in the executable?
I own a code signing certificate, so I can add digital signatures on files that contain executable code.
Microsoft seems to use a "new" way and provides most digital signatures not in the file itself ...
- 3,402
10
votes
2
answers
2k
views
AV detection of signed malware
With the massive Sony leaks (including their private keys/certificate), i was wondering:
How do major AVs deal with signed binaries? ie:
Does it influence their detecting ability of the signed ...
- 413
9
votes
1
answer
4k
views
Signing a browser extension
I want to make a browser extension available to users. Can I sign my extension so that users can verify it is authentic, without needing to trust the web site where they got the extension from nor ...
- 99.6k
9
votes
2
answers
4k
views
gpg key size of 4096 and "the future is ECC"
My boss wants to sign our binary. I need to tell him how he can create the signing key.
Most if not all sites I have seen about signing binaries say "use gpg".
OK, so gpg per default has 2048. Their ...
9
votes
1
answer
2k
views
Where to put a code signing server with EV code signing certificate and plugged-in HSM
Microsoft recently started enforcing apps to be signed by EV code-signing certificates instead of just regular certificates. These usually come on an external device such as USB smart card or a HSM, ...
- 389
8
votes
1
answer
1k
views
Possible to sign an imported key with a subkey using gpg?
In the interest of safeguarding my master key I store it offline. I have a gpg subkey with indicator SEA that I keep available on my system. When I download software I verify it using the provided asc ...
7
votes
3
answers
426
views
Automatic detection of a compromised web server
I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker.
Our website, say www....
7
votes
1
answer
2k
views
Why should I sign git commits/tags? Should I sign both commits and tags?
Easy question, but no one has asked it here as far as I see: Why should I sign git commits?
To give some more things to answer there is also this question: Why should I sign git tags (releases)?
And ...
- 1,267
6
votes
2
answers
3k
views
How can I verify signed commits made by other people?
As identified in this related question, github signs commits made from their application with their GPG key 4AEE18F83AFDEB23. Online, I can see commits tagged as 'verified'. But when I attempt to ...
- 163
6
votes
3
answers
3k
views
What happens when the timestamper's certificate expires?
What happens when the timestampers certificate expires?
If the code is now untrusted, can it be re-stamped without re-signing?
If not, what good does this timestamp do me if my cert is valid until the ...
6
votes
3
answers
1k
views
Does a valid code signing certificate mean that an installer has not been tampered with in transit?
Several dominant software vendors distribute updates over HTTP or over HTTPS with bad certificates. In general, it doesn't seem like I can expect to rely on a secure channel to ensure that an ...
- 569
6
votes
1
answer
3k
views
How can a .exe be modified and still keep a valid digital signature?
When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true.
...
- 81
6
votes
1
answer
9k
views
Java Applet - Need Code Signing Certificate vs SSL Certificate
I'm working on a Java Applet that used to be self-signed. Now that java 7u51 is being used, I am working to get the jar for the Applet signed.
I used the certificate/key used for the apache2 ssl ...
- 163
6
votes
1
answer
13k
views
How to check executable code signing signatures?
How can I see all code signing signatures an executable has?
I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers.
...
- 3,402
6
votes
0
answers
3k
views
What Key Usage values are required to support Code Signing?
I have a .pfx that I want to use to sign a Clickonce app. However, on trying to do so, Visual Studio gives me "The selected certificate is not valid for code signing." When I go to certmgr.msc and ...
- 61
5
votes
3
answers
2k
views
Why are non-collision-resistant hash functions considered insecure for signing self-generated information
Let we have a hash function that is second preimage resistant but not collision-resistant.
Then an adversary can create a pair of different messages M and M', M is benign and M' is malicious, for ...
- 900
5
votes
1
answer
3k
views
Does Authenticode still work offline and with a "fake" certificate
Here's our story: We're developing some software (written in C#/.NET) and we're already signing the assemblies with strong names, I do this in Visual Studio with a pfx file that is protected by a ...
- 153
5
votes
1
answer
390
views
Can open source software be digitally signed?
I've read that installing Linux on UEFI PCs requires additional steps to disable the requirement for digitally signed bootloaders.
But I thought that open source software can be digitally signed by ...
- 431
5
votes
3
answers
4k
views
Signtool validation fails when signing and validating are done in different machines
I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
- 151
5
votes
1
answer
3k
views
How is an Authenticode timestamp verified?
For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed ...
- 2,138
5
votes
2
answers
2k
views
Code signing with MD5 on Windows 8
I discovered that a signed installer package that is reported as correctly signed on Windows 7 and earlier, is reported as "corrupt" in IE10 on Windows 8.
Further investigation showed that the ...
- 397
5
votes
1
answer
995
views
What Are Good Code Signing Environment Guidelines? [closed]
Take this scenario as an example: An organization has a few build servers that periodically check out source from a repository and builds everything. When a build finishes the binaries are code signed ...
- 1,229
5
votes
2
answers
1k
views
What to do if you ever lose a smart card?
I want to use an OpenPGP smart card for signing releases, but I'm not sure what to do if I ever lose the card or it breaks.
My idea is to generate the key using GnuPG on an isolated computer, ...
- 427
5
votes
3
answers
4k
views
Why is a .jar signature still valid if a file has been added to the jar?
I was reading the man page for the jarsigner tool that ships with the JDK. This line surprised me:
A verification is still considered successful if none of the files that were in the JAR file when ...
- 153
5
votes
1
answer
1k
views
Having a code-signed binary, how can I tell if it's signed with an Extended Validation (EV) certificate?
I can't seem to find an answer to this seemingly simple question. Say, on Windows, if I have a binary file:
How can I tell if it was signed with an extended validation (EV) code-signing certificate?
...
- 171
4
votes
2
answers
356
views
Code Signing Confusion
I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
- 141
4
votes
6
answers
2k
views
Is a self signed certificate sufficient to prove the integrity of my executable?
I have an EXE file on Windows that I have to distribute around. It's based on tclkit so an adversary could unpack it, change some tcl script inside and repack the exe.
I would like to know if this ...
- 143
4
votes
2
answers
820
views
Why should I go to SHA512withRSA signature for my Android apps?
I have an Android 11 device and many of my apps and system apps use MD5withRSA or SHA1withRSA as signature algorithm by default.
Why should I take my apps SHA256withRSA or SHA512withRSA? Are there any ...
- 41
4
votes
1
answer
438
views
Certificate and key abuse
I made a mistake several years ago by uploading OpenSSL certificate key (.pem and .pk8) into a blog post. The key was used to sign Android apk using SignApk.jar tool. Someone took it and used the key ...
4
votes
2
answers
756
views
Secure Android app development [closed]
I'm beginning with Android App development and I want to make sure that I'm taking the proper security precautions since most apps will handle sensitive data.
What security precautions should be ...
- 73
4
votes
3
answers
1k
views
Will it improve security if I place both SHA1 and SHA256 signatures inside codesigned binary on Windows?
My application targets platforms starting with Windows 7 32bit. Many of them aren't up to date (i.e. may be missing many recommended updates from Microsoft).
Given the constraints I must use SHA1 ...
- 152
4
votes
2
answers
5k
views
Can android application be repacked with original developer's signature?
I am researching on Android application repackaging. I know the original developer self-signs the APK. Is it possible for a hacker to fake the signature and make it appear as the original signature ...
- 141
4
votes
1
answer
366
views
How to validate client side safety in a Zero Knowlegde model
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server ...
- 1,328
4
votes
1
answer
328
views
Strategies for signing sections of a text file to prevent tampering
I'm looking for suggestions from the community on the best way to approach this problem of securing a text file while still making it fairly shareable:
I have a collection of chef recipes in git, ...
- 43
4
votes
1
answer
393
views
Server side code signing
I'm currently implementing a couple of security improvements to a crypto currency trading website that handles all data client-side and uses a static file approach.
One of the things I've been asked ...
- 41
4
votes
1
answer
681
views
Cross-certification between worlds like X.509 and PGP?
Sometimes it can be advantageous to use existing trust relationships in one certification world - X.509 or PGP - to create trust in the other world. At the lowest level I can always take an X.509 cert ...
- 371