Re: Digitally sign my own DLL?
"Alec S." <nospam@127.0.0.1> wrote in message
news:eFhw2jCdJHA.5540@TK2MSFTNGP05.phx.gbl...
I tried out Thawte for a bit, but that was probably just a free trial.
Digital signatures have always annoyed me because they serve two purposes,
not
just one, and so should be available in two modes. One purpose is to
verify
authenticity (determine if a file has been tampered with, eg by a virus),
and
the other is to vouche for the authorship of the file (ie to prove that it
is by
someone trustworthy). There should be an easy way for us to sign our own
apps
for the first purpose (eg like with a public key), built into the compile
process. The second purpose is the one that should require an external
authrority.
I purchased my Code Signing Cert from Comodo, the cheapest I could find at
the time. There are two ways to get a code signing certificate; one you can
produce your own with a MS utility (I think one is called makecert, but it
is old and has been replaced). This is easy, but because the cert was
produced by an untrusted root authority (you), any app signed by it will
have the signature ignored by anyone you give your app to. The only reason
it works on your PC is you can manually add the cert to the Trusted Root
Certificate Authorities and Trusted Publishers branches using the
Certificate snap-in to MMC.EXE. So on your PC, the cert is trusted, but not
on any other PC.
The other is to purchase one through a third party such as Verisign or
Comodo, etc. Since those are Trusted Root Certificate Authorities, anything
you sign with that cert will be recognized as authentic by others.
Separating the two functions of code signing as you suggest is not feasible.
Even if you did generate a hash of your app and certified that it hadn't
been tampered with, what's to prevent a malware hacker from altering your
app with a virus and generating a new hash of it and then claiming it is OK?
The only thing preventing that is that you are identified with your digital
signature, whereas the hacker can't produce that.
-- David