CODEWITHSUNDEEP
c#.net.net-assemblydigital-certificatestrongname
xmen
xmen

Reputation: 1967

Proper way to digitally sign the application having referenced assemblies

I have an application that has 1 referenced assembly (test.exe, test.dll)

What I want is when the test.exe runs, it should show publisher name as "TestCompany".

To do that, I digitally signed it and it does what I want. And if I alter one byte of test.exe the publisher name is "Unknown". Which is good.

But if I alter the test.dll, the app runs as nothing happened and shows publisher name as "TestCompany". Which is not good for me.

So I put strong name on test.dll and added <bypassTrustedAppStrongNames enabled="false" /> in app.config.

Again, no difference. So I searched again and found out bypassTrustedAppStrongNames only checks if assemblies has strong name or not. Not the verification. Which is not good for me again.

What I exactly want is to protect the user, not my application. If user runs my application and it says its from me, it must be from me as every single byte. If the app was altered, even a single byte, it must notify user, its not from me. Which is what digitally sign suppose to do along with strong name but they all seems not so good yet. Or am I missing something ?

The last possible way I can think of is to manually check the strong name of assembly.

PS : Target .net framework is 2.0

Upvotes: 21

Views: 1288

Answers (1)

rodrigogq
rodrigogq

Reputation: 1953

Most of my important assemblies are not loaded as reference in my project. What I do is to declare interop interfaces (common to all projects as a base... yes, this on is referenced..) then I load all assemblies at runtime using:

 Assembly assembly = Assembly.Load("myDll, Version=1.0.0.1, Culture=neutral, PublicKeyToken=9b35aa32c18d4fb1");
 Type type = assembly.GetType("MyClass");
 object instanceOfMyType = Activator.CreateInstance(type);

I use this for several reasons. I have different class implementations that I must call depending on user/customer configuration. It also seems a nice option to guarantee that you are loading an specific assembly with my public token and version.

After a little research, I found these posts:

Well, I was kind of shocked after looking at your question.. It raises me concerns about referencing my DLLs now. I don't know how safe this is anymore, but it seems to be pretty safer than just referencing it.

I haven't found any reference in MS documentation for using Assembly.Load and bypassTrustedAppStrongNames. I will run some tests later, but it seems safer to use this.

Upvotes: 1

Related Questions