I'm creating a starter kit that installs the compiled assemblies from an open-source project into the GAC to make it easier to reference the assemblies in the template. Since they're going in the GAC, they need to be signed.
Do I need to password protect and secure the key file, or is it okay to leave it open and include the file in source control?
A strong name consists of the assembly's identity—its simple text name, version number, and culture information (if provided)—plus a public key and a digital signature. It is generated from an assembly file using the corresponding private key.
Key pair files usually have an . snk extension. In Visual Studio, the C# and Visual Basic project property pages include a Signing tab that enables you to select existing key files or to generate new key files without using Sn.exe.
Software key file created by Strong Name Tool (Sn.exe), a cryptographic program included with Microsoft's . NET framework; contains a public key and private key pair; used to digitally sign and authenticate an application.
Strong name signing has several purposes (though not for actual protection against tampering with the program, as is common misconception) - in your case the usage of a strong key for uniquely identifying (and verifying) a specific version of a specific assembly, which is required by the GAC. The other usage, which is preventing spoofing by other assemblies, doesn't seem necessary in this case (correct me if I'm wrong). For this reason, I would believe that it's perfectly acceptable to leave the key open (not password protected) and include the file in source control. As far as I can see, you're not going to stop anything you don't want by password protecting the key. (However, if you could provide more detail on the security context, I might have to revise that view.)
Also, see this MSDN article for a great thorough discussion of how to properly use strong name signing in general.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With