I am developing a. NET application. One of my DLLs manages all the security (data encryption, license management, etc).
I was wondering if someone could somehow substitute this DLL file with one of its own, in order to trick my Application.
Is there any kind of digital signature undertaken by the compiler or would I need to hard-type hash values of the referenced DLL in my main file to verify integrity ?
I have found this interesting article which explains how to make sure the DLL referenced has not been changed for another : at compilation a build manifest is generated. This manifest includes the hash value of all files included in the build at that time. The manifest is then signed. If the signature can be verified then the manifest and its hash values can be trusted and compared with the hash of the actual files. If it is a match, we can trust the entire assembly. This check is done each time the application is run, not only at setup.
So now my question can be rephrased to address the security issue from the other side: how can I prevent someone from using the DLL provided in an assembly? Let's assume an assembly is made of 2 files:
- A manages the user interface, and
- B contains the core of the intellectual property associated with the software.
How can I prevent someone from developing their own A which would just need to make a reference to B and use it like any DLL ?