Should each project being signed with a separate Strong Name Key (.snk)?

Question

Within my Visual Studio solution I have a web site and 4-5 class library projects which are referenced., some of which reference external third party assemblies as well.

I've been given the task of signing the assemblies for these projects.

My understanding is that the purpose of signing is that not everyone being able to use our assembly without providing its public key and version details, right?

Should I use one single Strong Name Key (.snk) to sign all the assemblies of these projects or each assembly should be signed with a separate strong name key?

What's the purpose of password protection for strong name keys?

How would you do that?

Many thanks,

Answer 1

that the purpose of signing is that not everyone being able to use our assembly without providing its public key and version details, right?

No. Signing verifies you, the publisher. It prevents others from making 'fake' versions of your assemblies.

Should I use one single Strong Name Key (.snk) to sign all the assemblies of these projects or each assembly should be signed with a separate strong name key?

The key is your signature so use 1 for all your projects.

What's the purpose of password protection for strong name keys?

The whole signing process hinges on you being the only one who possesses the key. There is no certificate involved. Partial signing and protected keys can help you limit the number of people who have access to the key.

Answer 2

The purpose of strong named assemblies is to be able to differentiate among versions of the same assembly, not to determine the creator of it.

On the other hand, digitally signing an assembly identifies the builder of that assembly.

The difference between the two kind of signatures is that the first one doesn't need to use the same certificate, because it won't be used to recognize the creator, just to differentiate among different versions of the same binary.
That way you would be able to load two versions of the same assembly within the same process, allowing you to use two versions of the same class without collisions.

The other signature, called Code Signing, uses specially crafted certificates just for code signing, and bundles together with the binary the public certificate with a name usually identifying the builder, together with the certificate chain validating the signature up to a Certification Authority, that can be seen in the file properties using Windows Explorer, the first case can't be seen in Windows Explorer and it could use a self signed certificate created in visual studio without any problem.

Actually, digitally signing code is for all kind of code, it doesn't have to be a .NET assembly, it can be a plain Win32 API DLL or EXE.