50 likes | 148 Views
COEN 351 E-Commerce Security. Code Authentication. Code Authentication. Microsoft Authenticode Code signed in the usual manner. Hash of code, encrypted with private key obtained from a Certifying Authority. Combine hash with certificate in a signature block.
E N D
COEN 351 E-Commerce Security Code Authentication
Code Authentication • Microsoft Authenticode • Code signed in the usual manner. • Hash of code, encrypted with private key obtained from a Certifying Authority. • Combine hash with certificate in a signature block. • Embed result into the file format of the executable.
Code Authentication • When code is downloaded • Browser / client side application extracts the signature block. • E.g. using WinVerifyTrust on a Windows system. • Uses public key of CA to verify / extract certificate. • Rehashes code and compares with signed digest.
Code Authentication • Authenticode applies to • .cab files • .cat files • .ctl files • .dll files • .exe files • .ocx files
Code Authentication • Later versions • add support for certification hierarchies. • add support for Certificate Trust Lists (CTL) and Certificate Revocation Lists (CRL). • SetReg • Sets registry key values that control the behavior of authenticode.