Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Do I need to secure my strong name key file for an open-source project?

I'm creating a starter kit that installs the compiled assemblies from an open-source project into the GAC to make it easier to reference the assemblies in the template. Since they're going in the GAC, they need to be signed.

Do I need to password protect and secure the key file, or is it okay to leave it open and include the file in source control?

like image 888
Daniel Schaffer Avatar asked May 08 '09 13:05

Daniel Schaffer


People also ask

What is a strong name key file?

A strong name consists of the assembly's identity—its simple text name, version number, and culture information (if provided)—plus a public key and a digital signature. It is generated from an assembly file using the corresponding private key.

What is the use of SNK file in Visual Studio?

Key pair files usually have an . snk extension. In Visual Studio, the C# and Visual Basic project property pages include a Signing tab that enables you to select existing key files or to generate new key files without using Sn.exe.

What is .SNK file?

Software key file created by Strong Name Tool (Sn.exe), a cryptographic program included with Microsoft's . NET framework; contains a public key and private key pair; used to digitally sign and authenticate an application.


1 Answers

Strong name signing has several purposes (though not for actual protection against tampering with the program, as is common misconception) - in your case the usage of a strong key for uniquely identifying (and verifying) a specific version of a specific assembly, which is required by the GAC. The other usage, which is preventing spoofing by other assemblies, doesn't seem necessary in this case (correct me if I'm wrong). For this reason, I would believe that it's perfectly acceptable to leave the key open (not password protected) and include the file in source control. As far as I can see, you're not going to stop anything you don't want by password protecting the key. (However, if you could provide more detail on the security context, I might have to revise that view.)

Also, see this MSDN article for a great thorough discussion of how to properly use strong name signing in general.

like image 124
Noldorin Avatar answered Sep 23 '22 03:09

Noldorin