0

I'm working on a piece of software in Visual Studio. I created a PKCS#12 archive in Visual Studio to strong name sign my assemblies. I then extracted the public key from the archive using OpenSSL.

I realise that I must remove the PKCS#12 archive from the VS solution before making it publicly available but what do I do with the public key?

Should I bundle it with my solution or make it available for download online where my solution is hosted?

How would a user verify my assemblies with the public key?

If I remove the archive from the solution then Visual Studio will complain because it is still configured to strong name sign the solution. A third party who has obtained the source code will receive such an error when they attempt to compile it with whatever modifications they have made. Should I expect them to plug in their own key or disable it?

1

If you use public and private keys to sign, you are using what is called Public-key cryptography.

The private key is yours. Take care to never let it leak. The public key is, like its name, public. This is what you distribute so other people can verify if something (a code, a document, (...)) is signed by you.

The signature algorithm take the data and your private key to generate the signed data.

The verify algorithm take a signed data and your public key to verify if it was you that signed.

To verify your signed data the user will need the public key.

The signature itself will contain the public key. And the verification algorithm can verify the integrity of the contents.

But not the identity of the signer.

To solve this you can distribute your public key you using a Public-key certificate. It will encapsulate your key in X.509 structure with a lot of information about you, and others like revocation and Certificate Authority (CA). This will establish a relation between the public key and your personal info.

The Certificate Authority can say if a certificate is valid or not.

So you will need to get your certificate - generated by whatever tool - to a CA. Whey will put your certificate in their chain of trust, thus validating your certificate. chain of trust article

You will then ship your signed library to the world. The signature itself will contain everything that the checker will need to verify the signature.

If your certificate doesn't have a CA, only the people that have your public key will accept the signature as valid.

signature_verify_flow

  • I'm thinking about best practices. Do I share my public key on my website or in the folder with the binaries or in the folder with the source code? – user651351 Dec 12 '16 at 20:51
  • read again. You don't do neither. The signature itself will contain your public key. Period. It's there already. The verify algoritms will use this to verify the integrity of the library. The second part is verify identity. To do it your certificate must be on a CA chain of trust. – linuxunil Dec 12 '16 at 22:01
  • But it's self-signed via Visual Studio. – user651351 Dec 12 '16 at 22:03
  • you have a PKCS#12 right? – linuxunil Dec 12 '16 at 22:16
  • Yes, generated by Visual Studio. – user651351 Dec 12 '16 at 22:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.