Signing assembly with Private Key

Question

Dear all I have some confusion, if one of you please help me regarding this. My questions are:

1. Everyone say to sign assembly with private key, but no one say how to get private key means by using sn.exe -K I can create private/public key pair but how to extract private key from it to sign it.

2. If i sign my assembly with private key and then send it to user of this assembly then he will directly add this assembly in global assembly and use, so is it needed to send him public key to use this assembly or public key is with assemblyl so anyone can use this assembly and if anyone can use what is meaning of encrypting it will private key.

Answer 1

I have some confusion

This is a confusing topic.

how to extract private key from it?

You don't need to. The signing tool takes the key file. It is smart enough to extract the private key if it needs to.

is it needed to send him public key to use this assembly?

The public key is embedded in the assembly. You can see it if you look at the strong name of the assembly. However, it is necessary to somehow communicate to the customer what the correct public key is, if you think that someone might be trying to impersonate you! See the next bit for details.

if anyone can use what is meaning of encrypting it with the private key?

The purpose of signing the assembly with the private key is to produce evidence. The evidence means "this assembly was produced by the person who possessed the private key associated with this public key".

For example, Microsoft's public key token is well known. That is why it is called the "public" key: because it is known by the public. When you see an assembly that has Microsoft's public key, that is evidence that Microsoft produced that assembly because an assembly whose signature can be decrypted with Microsoft's public key must have been produced by someone who had access to Microsoft's private key. That key is under heavy guard deep inside Building Seven here in Redmond, so you have good evidence that someone who really did work at Microsoft produced that assembly.

The purpose of this system is to enable people to set policies that turn evidence into permissions. Your customer can have a policy that says "if I have evidence that this assembly was produced by Ashish, then allow the code to do anything that I am allowed to do".

Now, you might reasonably ask "how does the customer know that a given public key is your public key?" That is the "key management" problem, and that is your responsibility. If you have an evil twin out there who is telling your customers that his public key is your public key, then your customers might trust your evil twin, thinking he is you. In that case, it is your responsibility to educate your customers that there is an evil twin out there who is trying to trick them, and teach them how to tell the difference between the public key of the good Ashish and the public key of the evil twin.

You are also required to ensure that your private key stays private. If your evil twin learns of your private key then obviously they can impersonate you as much as they like; remember, the signed assembly provides evidence that the person with access to the private key produced the assembly; if more than one person has access to that key then the evidence does not identify one person.