Category Archives: code signing

How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?

Posted on by

I am trying to reason about how native apps can avoid the problems web apps have in dealing with the "Browser Cryptography Chicken and Egg" problem, which has been discussed numerous times on this site, perhaps most notably here:… Continue reading How to deal with targeted attacks from publisher when verifying the integrity of native applications and validating their source code?→

How do I compare a signed .exe file with the unsigned version of the same .exe file?

Posted on by

I have had some binary executable files (.exe) for Windows signed, I have checked the signature of the signed files, but I would also like to check that the file that I sent for signing is indeed identical to the signed file that I got bac… Continue reading How do I compare a signed .exe file with the unsigned version of the same .exe file?→

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Posted on by

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work?
Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum for it.
My understanding is that this is… Continue reading Is signing a file better than issuing a checksum, and does it render a separate checksum useless?→

How can a .exe be modified and still keep a valid digital signature?

Posted on by

When a Windows .exe installer is code-signed, I thought that modifying a single byte (thus changing its SHA256 hash) would make the digital signature invalid, but surprisingly, this is not true.
Indeed, as reported two days ago in Each Fir… Continue reading How can a .exe be modified and still keep a valid digital signature?→