Nowadays, SHA-1 is considered inadequate for secure hashing and it is highly recommended to use SHA-2 digest. This command will generate a signature based on the SHA-1 hash of the file content. snk file, e.g.Ĭsc.exe /keyfile:TestLib.snk /t:library TestLib.cs

Both accept the /keyfile parameter, in which we provide the path to the just generated.

Next, depending on our scenario, we may use either the C# compiler (csc.exe) or assembly linker (al.exe). snk file format, have a look at my 010 editor template): snk file, which will store the RSA keys details (if you are interested in the details of the. Having examined the strong name signature structure, let’s focus on tools we may use to create it. If you would like to see C# code implementing the validation, have a look at the StrongNameSigner.cs file from the dnLib library. To calculate the RSA signature, we need to own the private key corresponding to the public key listed in the previous paragraph. The signature is later stored in the PE file text section at an offset saved in the COR20 header: Before counting this hash, we need to fill with zeros the following bytes of the file: the authentication signature entry (we will get to it in a moment), the strong name blob and the PE header checksum. The second part is the RSA signature of the hash of the assembly content. The Public Key Token, which is used to uniquely reference the assembly, is a hex representation of the low 8 bytes of the SHA-1 hash of the Public Key in a reverse byte order. The image below lists the elements which build the Public Key block: The first part is the public key, which is part of the #Blob stream in the assembly metadata (screenshot shows a part of the dnSpy window): Two parts of the assembly binary code play role in the strong name verification process. Though, it does not say anything about the identity of the signer. It also uniquely identifies a given assembly. Strong name signature and Public Key tokenĪ valid strong name signature ensures the recipients that the assembly they received has not been tampered. We will also have a look at certificate-based signatures and, in the end, we will examine the assembly verification process. But do you know how this token is calculated? Or do you know the structure of the strong name signature? In this post, I will go into details how strong naming works and what are its shortcomings. You also probably know that the hex string at the end represents a public key token, which is a sign that the assembly has a strong name signature. If the above line means anything to you, you are probably a.

Fully sign a dll file