Strong Naming
Posted by Sebastien Lachance on May 24, 2005
All about Strong Naming in .NET.
This is my attempt to explain Strong Name to myself. All the stuff here come from Patterns & Practices : Improving Web Application Security from Microsoft.
Strong Name
A strong name consist of a text name, version number, maybe a culture, public key, and a digital signature.
There are some reasons why you would want to add a strong name to an assembly.
1. To protect your code from partial trust assembly.
2. To share your assembly with others applications.
3. Uniquely identify the assembly. Giving cryptographically strong evidence for code access security.
There is also some security benefits, some of wich are:
1. Digital signature. This, protect your assembly from any modification. Any tampering cause the application to fail.
2. Cannot be called form partially trusted code.
3. Allows administrators to grant specific permission to assembly.
To strong name assembly, here are the steps.
1. Generate a key file.
sn.exe –k keypair.snk
2. Add the AssemblyKeyFile attribute to the Assembly.vb or Assembly.cs file of your project. Reference the key file.
[AssemblyKeyFile("@..\..\keypair.snk")]
You now have a string named assembly.
Delay signing.
You might want to delay sign your assembly in development version. It means that your assembly is available for code security, but not temper proof. You can do modification to your assembly without re-signing.
Your private key, at this moment could be kept safe from any source until development is complete. And the public key will be used to represent your organization. This will centralize the key.
To implements delay signing, you must first create the key.
sn.exe –k keypair.snk
Then you extract the public key.
sn.exe –p keypair.snk publickey.snk
You can now take keypair.snk and put it in a safe location, then distribute the public key to the development teams.
This is not all. You must now delay sign your assembly. To do this, you first add the AssemblyKeyFile attribute to your Assembly file.
[assembly: AssemblyKeyFile(“@..\..\publickey.snk”)]
Then add the AssemblyDelaySign attribute to true.
[assembly: AssemblyDelaySign(true)]
You will remark that your assembly will fail verification at load time. You will need to disable verification.
1. For a specific assembl :
sn –Vr assembly.dll
2. For all application who use the key:
sn –Vr *,publickeytoken
To extract the public key and key token, you can do that this way:
sn –Tp assembly.dll
Now your assembly has a delayed signing. If you want to complete the process and render your assembly tamper proof. You will now need the private key.
sn –r assembly.dll keypair.snk
Posted in .NET | No Comments »
