46 votes
Accepted

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23: From: https://help.github.com/articles/about-gpg/ GitHub will automatically sign commits you make ...
29 votes
Accepted

Smart-Screen filter still complains, despite I signed the executable, why?

Applications that are signed with a standard code signing certificates need to have a positive reputation in order to pass the Smart Screen filter. Microsoft establishes the reputation of an ...
  • 5,541
25 votes
Accepted

How do GPG smart card devices handle large GPG operations?

The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
  • 40.3k
20 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
16 votes
Accepted

Should I sign someone else's code?

When you sign code, it means that you vouch for that code. When people decide to trust your signature, it means that they trust you to only sign code after you verified that it is trustworthy. When ...
  • 48.9k
15 votes
Accepted

Has the leaked D-Link Windows signing key been revoked?

Update 2016-12-28: I finally decided to check the CRL as well. And it turns out: Yup, certificate is in there still. Even long after its original expiration date. $ openssl x509 -in 0.dlink.cer -...
15 votes

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Digital signatures are designed to do three things: Ensure the integrity of the data that has been signed Create some degree of non-repudiation by the signer The purpose you mentioned, which is to ...
  • 35.5k
13 votes

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

To add to @Jonathan Cross's answer... Signature rules When will GitHub sign commits GitHub will sign commits made using the web UI GitHub will sign standard merges made using the web UI GitHub will ...
  • 3,169
12 votes

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Xander's answer is fundamentally correct: the issue is getting someone else to sign a benign message and use the signature for the malicious one. It is worth noting that although when you make a ...
  • 1,818
11 votes

Deprecation of SHA1 code signing certificates on Windows

I've now found an example of an actual download that was signed using an SHA-1 certificate after 1/1/2016. I downloaded KeePass 2.31 using Edge on Windows 10. Edge tells me that "The signature of ...
10 votes

Does linux support signed binaries?

If you're looking for signed binaries you may find elfsign and elfverify to be of interest to you. This doesn't provide a tie in for the linker. It's a manually process that writes the signature into ...
  • 2,325
10 votes
Accepted

Transferring Microsoft SmartScreen reputation to renewed certificate

To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for ...
9 votes

Deprecation of SHA1 code signing certificates on Windows

This is more of an extended comment/fact-finding entry. Not a fully fledged answer in itself. I don't get it either. It is pretty confusing. But I don't feel so bad not understanding that, because ...
8 votes

Can open source software be digitally signed?

While you can sign the software this does not mean that you can store the public key needed for signature validation in the device which should do the verification. Just releasing the public key does ...
8 votes

Smart-Screen filter still complains, despite I signed the executable, why?

If you have a standard code signing certificate, some time will be needed for your application to build trust. Microsoft affirms that an Extended Validation (EV) Code Signing Certificate allows to ...
8 votes
Accepted

How can I verify signed commits made by other people?

Instead of blindly accepting a GPG key from an answer here, I would do the "right" thing and get the public key from a reasonable source. GitHub hosts their web flow GPG public key at the following ...
8 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

It's not uncommon to have both. For example, developers of the Tails operating system sign their ISO's using GPG. See https://tails.boum.org/install/expert/index.en.html#verify for more info. But, ...
  • 19.9k
7 votes

Code Signing Confusion

In order to tell the end user that the YOU are the actual owner of the app, you MUST buy a certificate from a trusted third party (a party which is also trusted by Windows). These third parties are ...
  • 4,259
7 votes
Accepted

Why does Microsoft use a digital signature catalog instead of a signature in the executable?

There are some other interesting benefits around the "WHY": You can catalog sign non-executables. inf, ini etc...That's not possible with an embedded Authenticode signature. Sometimes you want to ...
  • 86
6 votes
Accepted

How do systems protect against a stolen code-signing certificate after the certificate expires?

This is why Microsoft recommends to never remove expired code signing certs from CRLs. An alternative scenario: attacker signs their malware before cert expiry. If they can remain undiscovered past ...
  • 176
6 votes

Deprecation of SHA1 code signing certificates on Windows

There are 3 digests in a timestamped Authenticode signature that you have control over. The digest of your certificate. A recently purchased certificate will use SHA-256. Most CAs switched to ...
6 votes
Accepted

Will digital signature prevent tempering, or at least harden the cracking, of my Windows applications?

Code signing is just that - you add a signature to the file with your private key. This signature shows whoever downloads your file that it was signed in it's current form by the person holding the ...
  • 186
6 votes
Accepted

Is it reasonable to have the software hold something that the user can't tamper with?

No, tamper-resistant applications implemented purely in software are unfortunately impossible. Software which runs on the user's machine is under the user's control. The user can extract any secret ...
  • 48.9k
6 votes
Accepted

Certificate and key abuse

Certificates in general Certificates are complicated, I don't blame you. By far, the most common use-case for certificates is for TLS websites where you need to submit a Certificate Signing Request (...
6 votes

How can a .exe be modified and still keep a valid digital signature?

From https://docs.microsoft.com/en-us/windows/win32/debug/pe-format, emphasis mine: When included in a certificate, the image digest must exclude certain fields in the PE Image, such as the Checksum ...
  • 40.3k
5 votes
Accepted

Did D-Link's certificate revocation really only invalidate 1 day (of a six months long exposure)?

OCSP provides a dynamic mechanism for checking whether a given certificate has been compromised or not and, in case it has been compromised, after what date (and time) should signatures using this ...
  • 18.6k
5 votes

Automatic detection of a compromised web server

There are a number of local processes that will watch files and directories for any changes, writes, deletions, and accesses. When these events occur, the process creates an event log through syslog. ...
  • 123k
5 votes
Accepted

Does a valid code signing certificate mean that an installer has not been tampered with in transit?

The signature is of a hash of the portion of the executable before the code signing block. Best practice is to have both the installer and the application signed. You can study some details by ...
  • 516
5 votes
Accepted

Can the contents of a web page be protected from modification

Use https. This will encrypt and sign all your content between your server and the users web browser. This does not protect from modification on your server, of course, but when your server is ...
  • 48.9k
5 votes

Are Ubuntu updates signed by a central authority?

Answering your direct question: You should read the pages on Secure Apt Ubuntu, and a slightly more thorough page on Secure Apt Debian. The summary is that packages are signed using gpg (aka "...

Only top scored, non community-wiki answers of a minimum length are eligible