Can strong naming an assembly be used to verify the assembly author?

Question

I have been reading the proper article in MSDN, Strong-Named Assemblies and a related Stack Overflow question, Checking an assembly for a strong name.

1. To which extent can a strong-named assembly be verified to avoid tampering?
2. Is it possible to use strong-naming to verify an assembly author?

The first question arises after reading the CSharp411 article .NET Assembly FAQ – Part 3 – Strong Names and Signing, which mentions this, among other problems of using strong names:

"Cannot Stop Full Replacement. Strong names cannot prevent a hacker from removing the strong name signature, maliciously modifying your assembly, re-signing it with his own key, and then passing off his assembly as yours."

The second question intends to find the differences between strong naming and other signing schemes like, say, Authenticode. The same MSDN article mentioned early states:

"Note, however, that strong names in and of themselves do not imply a level of trust like that provided, for example, by a digital signature and supporting certificate."

Am I trying to use strong-naming for much more than it was created for? Was strong-naming created just to avoid name clashes or a new kind of "GAC DLL Hell"?

Answer 1

When you sign an assembly with a strong name based on a private key that you create, this has the following benefits:

• A strong name guarantees the uniqueness of an assembly's identity by adding a public key token and a digital signature to the assembly.
• A strong name can be matched to a public key to prove that the assembly comes from the publisher with that public key, and only that publisher.
• A strong name provides a strong integrity check. Passing the .NET Framework security checks guarantees that the contents of the assembly haven't been changed since it was last built.

Is it possible to use strong-naming to verify an assembly author?

Yes, as discussed above strong-naming can verify the assembly's latest author. But it doesn't verify the original author. If an attacker replaces your assembly's strong name, then all that can be verified is that you weren't the latest author of the assembly. If he removes the strong name, then no author verification can be done at all.

To which extent can a strong-named assembly be verified to avoid tampering?

The following C# code verifies that an attacker hasn't tampered with the public key token that was written to your assembly when you applied the strong name. It doesn't avoid tampering, but it can detect some types of tampering. The method below accepts a byte array containing your public key token, and compares it with the actual token of the assembly. Note that for this technique to be effective, your obfuscator of choice should encrypt the string containing your public key token, and only decrypt it on the fly as it's used. And also be aware that you need to have FullTrust permission for this code to work because it uses reflection underneath the hood.

// Check that public key token matches what's expected. private static bool IsPublicTokenOkay_Check(byte [] tokenExpected) {     // Retrieve token from current assembly     byte [] tokenCurrent = Assembly.GetExecutingAssembly().GetName().GetPublicKeyToken();      // Check that lengths match     if (tokenExpected.Length == tokenCurrent.Length)     {         // Check that token contents match         for (int i = 0; i < tokenCurrent.Length; i++)             if (tokenExpected[i] != tokenCurrent[i])                  return false;     }     else     {         return false;     }     return true; } 

As long as you're running under a version of the .NET Framework before .NET 3.5 SP1, you can also force verification of the strong name signature in case the strong name was removed by an attacker or the strong name check was disabled in the registry. The following code demonstrates a call into a static method of another class called NativeMethods. This is where the verification will be enforced.

// Check that this assembly has a strong name. private bool IsStrongNameValid_Check() {     byte wasVerified = Convert.ToByte(false);       byte forceVerification = Convert.ToByte(true);     string assemblyName = AppDomain.CurrentDomain.BaseDirectory +                            AppDomain.CurrentDomain.FriendlyName;      return NativeMethods.CheckSignature(assemblyName,                                          forceVerification,                                          ref wasVerified); } 

The actual signature verification is done using P/Invoke as shown below. The usage of the StrongNameSignatureVerificationEx API is quite convoluted - for a decent explanation, see this blog entry.

// P/Invoke to check various security settings // Using byte for arguments rather than bool,  // because bool won't work on 64-bit Windows! [DllImport("mscoree.dll", CharSet=CharSet.Unicode)] private static extern bool StrongNameSignatureVerificationEx(string wszFilePath,                                                               byte fForceVerification,                                                               ref byte pfWasVerified);  // Private constructor because this type has no non-static members private NativeMethods() { }  public static bool CheckSignature(string assemblyName,                                    byte forceVerification,                                    ref byte wasVerified) {     return StrongNameSignatureVerificationEx(assemblyName,                                               forceVerification,                                               ref wasVerified ); } 

Note that this won't work by default for applications using .NET 3.5 SP1 or higher, which has the strong name bypass feature. It's possible to disable this feature for your application by adding a setting to its config file. But of course any attacker with read/write access to that config file can reverse your decision.

Answer 2

Authenticode relies on a third party certificate authority for certificate validation. Strong naming works like a self-signed certificate and can be treated as such. It does use standard digital signatures, but the problem lies in verifying the public key of the assembly author is indeed valid. If you get it separately via a trusted channel from the author and you trust that channel, then yes, you can verify it just like a self-signed certificate.

As long as you are sure the strong name private key is kept safe by the author and you know author's public key, you can make sure it's not tampered with (to the extent you can make sure a digitally signed email is not tampered with). By the way, don't get me wrong: the quote is completely true and an attacker can easily resign the assembly or remove the existing signature. However, the resulting assembly will have a **different* digital signature that can be checked against the original (if you have the original public key).

In this case, it's similar to a self-signed certificate. If you can somehow be sure of the author's public key, you can verify the authority. However, unlike Authenticode which relies on a certificate authority, there is no straightforward, system-defined, way to distribute the public key.