Proper way to digitally sign the application having referenced assemblies

Question

I have an application that has 1 referenced assembly (test.exe, test.dll)

What I want is when the test.exe runs, it should show publisher name as "TestCompany".

To do that, I digitally signed it and it does what I want. And if I alter one byte of test.exe the publisher name is "Unknown". Which is good.

But if I alter the test.dll, the app runs as nothing happened and shows publisher name as "TestCompany". Which is not good for me.

So I put strong name on test.dll and added <bypassTrustedAppStrongNames enabled="false" /> in app.config.

Again, no difference. So I searched again and found out bypassTrustedAppStrongNames only checks if assemblies has strong name or not. Not the verification. Which is not good for me again.

What I exactly want is to protect the user, not my application. If user runs my application and it says its from me, it must be from me as every single byte. If the app was altered, even a single byte, it must notify user, its not from me. Which is what digitally sign suppose to do along with strong name but they all seems not so good yet. Or am I missing something ?

The last possible way I can think of is to manually check the strong name of assembly.

PS : Target .net framework is 2.0

Thinnish

I think maybe you'll have to run Sn.exe (the Strong Name Tool) with the -vf parameter, and test the return code. Or maybe even capture and parse the output. – Rabe

msdn.microsoft.com/en-us/library/cc713694%28v=vs.110%29.aspx There's a registry setting that might do what you want. – Rabe

@RenniePet: Yes, I can manually check using StrongNameSignatureVerificationEx but I was expecting something that check itself as it was intended to. They disabled the verification from framework 3.5 to speed up the startup of app. But even disabling that is broken too. – Thinnish

When you say "manually" I'm wondering if we mean the same thing. I was suggesting that you run the sn.exe program at runtime by launching it with Process.Start(). (I agree that the whole strong name business is a bit of a mess. I think I read something about improvements coming in the next version of .Net but can't find it now.) Edit: Ah, now I see what you mean by using StrongNameSignatureVerificationEx, that would be better than launching sn.exe. – Rabe

yes its same thing, I would stick to framework 2.0. Its easily available to almost all common Windows versions. – Thinnish

How about using ILMerge to combine your .exe and your .dll into one .exe, and then your digital certificate should ensure the whole thing has not been tampered with? research.microsoft.com/en-us/people/mbarnett/ilmerge.aspx – Rabe

or sign the DLL file as well – Dowager

tried signing the DLL, nothing happened when I modified it. It needs to be validated manually too. – Thinnish

How/when/where is the user shown the publisher etc? Is it mainly just thru an About box or are you trying to create some process to test your components and perhaps warn them? – Carlita

@Plutonix, it does when an application runs as admin while UAC is enabled. – Thinnish

Answer 1

Most of my important assemblies are not loaded as reference in my project. What I do is to declare interop interfaces (common to all projects as a base... yes, this on is referenced..) then I load all assemblies at runtime using:

 Assembly assembly = Assembly.Load("myDll, Version=1.0.0.1, Culture=neutral, PublicKeyToken=9b35aa32c18d4fb1");
 Type type = assembly.GetType("MyClass");
 object instanceOfMyType = Activator.CreateInstance(type);

I use this for several reasons. I have different class implementations that I must call depending on user/customer configuration. It also seems a nice option to guarantee that you are loading an specific assembly with my public token and version.

After a little research, I found these posts:

• How to prevent spoofing of DLLs in .NET
• http://ianpicknell.blogspot.com.br/2010/02/evading-strong-name-integrity-check.html

Well, I was kind of shocked after looking at your question.. It raises me concerns about referencing my DLLs now. I don't know how safe this is anymore, but it seems to be pretty safer than just referencing it.

I haven't found any reference in MS documentation for using Assembly.Load and bypassTrustedAppStrongNames. I will run some tests later, but it seems safer to use this.

Addison

Yes I've been reading over internet, those links are one of them and strong name seems broken plus its uses SHA1. Microsoft introduced EnhancedStrongName that uses SHA256 but its from .net 4.5. – Thinnish