Skip to main content
53 votes
Accepted

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

GitHub itself is signing commits made through the online editor using the key 0x4AEE18F83AFDEB23: From: https://help.github.com/articles/about-gpg/ GitHub will automatically sign commits you make ...
Jonathan Cross's user avatar
31 votes
Accepted

Smart-Screen filter still complains, despite I signed the executable, why?

Applications that are signed with a standard code signing certificates need to have a positive reputation in order to pass the Smart Screen filter. Microsoft establishes the reputation of an ...
void_in's user avatar
  • 5,621
26 votes
Accepted

How do GPG smart card devices handle large GPG operations?

The only secret information involved in the digital signature process is the private key. Everything else is public info. So you can hash the large "message" (file, whatever) in software, ...
CBHacking's user avatar
  • 49.2k
21 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
Mike Ounsworth's user avatar
16 votes
Accepted

Should I sign someone else's code?

When you sign code, it means that you vouch for that code. When people decide to trust your signature, it means that they trust you to only sign code after you verified that it is trustworthy. When ...
Philipp's user avatar
  • 49.4k
15 votes

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Digital signatures are designed to do three things: Ensure the integrity of the data that has been signed Create some degree of non-repudiation by the signer The purpose you mentioned, which is to ...
Xander's user avatar
  • 35.8k
14 votes

Who owns the gpg key 4AEE18F83AFDEB23 and how did it sign a commit in my GitHub repo?

To add to @Jonathan Cross's answer... Signature rules When will GitHub sign commits GitHub will sign commits made using the web UI GitHub will sign standard merges made using the web UI GitHub will ...
jrtapsell's user avatar
  • 3,197
12 votes

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Xander's answer is fundamentally correct: the issue is getting someone else to sign a benign message and use the signature for the malicious one. It is worth noting that although when you make a ...
Josiah's user avatar
  • 1,878
10 votes

Does linux support signed binaries?

If you're looking for signed binaries you may find elfsign and elfverify to be of interest to you. This doesn't provide a tie in for the linker. It's a manually process that writes the signature into ...
Evan Carroll's user avatar
  • 2,843
10 votes
Accepted

How can I verify signed commits made by other people?

Instead of blindly accepting a GPG key from an answer here, I would do the "right" thing and get the public key from a reasonable source. GitHub hosts their web flow GPG public key at the following ...
taylorthurlow's user avatar
10 votes
Accepted

Transferring Microsoft SmartScreen reputation to renewed certificate

To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for ...
Martin Prikryl's user avatar
9 votes

Smart-Screen filter still complains, despite I signed the executable, why?

If you have a standard code signing certificate, some time will be needed for your application to build trust. Microsoft affirms that an Extended Validation (EV) Code Signing Certificate allows to ...
Maxim Masiutin's user avatar
9 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

It's not uncommon to have both. For example, developers of the Tails operating system sign their ISO's using GPG. See https://tails.boum.org/install/expert/index.en.html#verify for more info. But, ...
mti2935's user avatar
  • 23.6k
8 votes
Accepted

How do systems protect against a stolen code-signing certificate after the certificate expires?

This is why Microsoft recommends to never remove expired code signing certs from CRLs. An alternative scenario: attacker signs their malware before cert expiry. If they can remain undiscovered past ...
wmjdgla's user avatar
  • 196
8 votes

Can open source software be digitally signed?

While you can sign the software this does not mean that you can store the public key needed for signature validation in the device which should do the verification. Just releasing the public key does ...
Steffen Ullrich's user avatar
7 votes
Accepted

Why does Microsoft use a digital signature catalog instead of a signature in the executable?

There are some other interesting benefits around the "WHY": You can catalog sign non-executables. inf, ini etc...That's not possible with an embedded Authenticode signature. Sometimes you want to ...
Alnoor's user avatar
  • 86
7 votes
Accepted

What happens when the timestamper's certificate expires?

What happens when the timestampers certificate expires? Literally, nothing. If the code is now untrusted, can it be re-stamped without re-signing? it is not correct statement. Timestamped ...
Crypt32's user avatar
  • 6,391
6 votes
Accepted

Will digital signature prevent tempering, or at least harden the cracking, of my Windows applications?

Code signing is just that - you add a signature to the file with your private key. This signature shows whoever downloads your file that it was signed in it's current form by the person holding the ...
mzhaase's user avatar
  • 186
6 votes
Accepted

Is it reasonable to have the software hold something that the user can't tamper with?

No, tamper-resistant applications implemented purely in software are unfortunately impossible. Software which runs on the user's machine is under the user's control. The user can extract any secret ...
Philipp's user avatar
  • 49.4k
6 votes
Accepted

Certificate and key abuse

Certificates in general Certificates are complicated, I don't blame you. By far, the most common use-case for certificates is for TLS websites where you need to submit a Certificate Signing Request (...
Mike Ounsworth's user avatar
6 votes
Accepted

gpg key size of 4096 and "the future is ECC"

Does this still apply 2020? Can I safely recommend to my boss to use 2048 key size? This would be to a certain extent a matter of opinion and as such likely not suitable for discussion on ...
Hubert Jasieniecki's user avatar
6 votes

How can a .exe be modified and still keep a valid digital signature?

From https://docs.microsoft.com/en-us/windows/win32/debug/pe-format, emphasis mine: When included in a certificate, the image digest must exclude certain fields in the PE Image, such as the Checksum ...
CBHacking's user avatar
  • 49.2k
5 votes

Why does Microsoft use a digital signature catalog instead of a signature in the executable?

Catalog files have actually been around since Windows 2000/XP. They are an alternative to signing single binaries as you attach one signature to the catalog file rather than a signature to every ...
Mark Burnett's user avatar
  • 2,830
5 votes
Accepted

Why should I sign git commits/tags? Should I sign both commits and tags?

Why is it useful? Generally it is all about thread models. And there are several examples in the past, where it would have helped. E.g. gitea introduced it after their bot account has been ...
rugk's user avatar
  • 1,257
5 votes
Accepted

SHA-256 Timestamp not recognized in windows 7 when dual signed

Windows 7 doesn't support SHA256 signatures by default. You need to apply this update, in order to get the desired functionality.
bayo's user avatar
  • 687
5 votes
Accepted

Application Whitelisting Approaches/Options on non-Enterprise Windows PCs

I think Software Restriction Policies are what you're looking for. It is basically the predecessor to Applocker, and it is still supported for application whitelisting or blacklisting. It isn't as ...
justanotherperson's user avatar
5 votes
Accepted

Possible to sign an imported key with a subkey using gpg?

“Signing” a user’s key (in fact, that’s signing his identity) requires the “Certify” capability. As far as I know, GnuPG does not allow you to create a subkey with the “Certify” capability (I don’t ...
user2233709's user avatar
5 votes

How to verify a private key has not been compromised?

You need a Hardware Security Module (HSM), as there's no reliable way to detect if someone else have your key. It's the same issue of knowing if someone have your password: you can only know if ...
ThoriumBR's user avatar
  • 54.5k
5 votes

Why are non-collision-resistant hash functions considered insecure for signing self-generated information

Well, in theory you would be right. In some very specific cases those hashes would not be completely broken. However, you would need to be extra cautious, and supposedly some "self-generated" data ...
Ángel's user avatar
  • 18.9k
5 votes

gpg key size of 4096 and "the future is ECC"

Even though this question is 3+ years old, I am answering just in case someone finds the answer useful. You did NOT mention the platform on which the binaries will be used: If you want to sign ...
ARGYROU MINAS's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible