使用.snk的私钥对任意数据进行签名
我正在开发一个 .NET 包管理器，让我思考的一件事是安全性。
鉴于任何人都可以将程序集上传到存储库，我如何验证所述程序集来自可信来源？例如，如果 NHibernate.dll 是用 NHForge 人员的私钥签名的，我会更加信任它。为了确保这一点，我所要做的就是使用 NHForges 的公钥验证程序集签名。
现在，考虑到这一点，如何建立这种关系（这个特定的公钥属于这个特定的人）？我想到的一个想法如下：
- 项目作者创建一个 XML 文件，其中包含有关项目和作者的信息（姓名、电子邮件等）。
- 此 XML 文件使用从
中提取的作者私钥进行签名。 snk文件，稍后用于对程序集本身进行签名 - 作者将此签名的 XML 文件上传到存储库，在存储库中对其进行检查并建立作者和公钥之间的关系
实现这一点（这是一个可行的想法吗，顺便说一句？），我需要一种编程方式来访问 .snk 文件并读取 PK。 .NET 中有这方面的东西吗？
I'm developing a .NET package manager and one thing that got me thinking is security.
Given that anybody can potentially upload an assembly to the repository, how do I verify that said assembly comes from a trusted source? For example, I'd trust NHibernate.dll much more if it was signed with a private key of guys from NHForge. To ensure this, all I'd have to do is to verify assembly signature with NHForges' public key.
Now, with that in mind, how can one establish this relationship (that this particular public key belongs to this particular person)? An idea I came up with is as follows:
- Project author creates an XML file which contains information about the project and about an author (name, email, etc)
- This XML file is signed with authors' private key extracted from a
.snkfile which is later used to sign the assembly itself - Author uploads this signed XML file to the repository, where it gets checked and a relationship between an author and a public key is established
To implement this (is this a viable idea, BTW?), I need a programmatic way of accessing .snk files and reading PK. Is there something for this in .NET?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
首先，强名称不应该用作安全机制——它们仅用作程序集标识机制。对于这样的事情，我会研究 Authenticode，它是专门为验证程序集的发布者/源而设计的（即安全性而不仅仅是身份）。
话虽这么说，您概述的想法按原样是不可行的，因为您无法对 XML 文件进行强名称签名 — 强名称签名仅适用于 .NET 程序集。理论上，您可以做的是维护每个公钥到特定发布者的某种映射（也许通过发布者注册过程或其他方式？），然后在将程序集添加到存储库之前验证程序集的强名称签名。
至于技术方面，您可以通过
StrongNameGetPublicKey函数（它是非托管强命名 API 的一部分）。不过，您必须自己将.snk文件加载到内存中。First off, strong names should not be used as a security mechanism—they are only intended to be used as an assembly identity mechanism. For something like this, I'd look into Authenticode, which was specifically designed for verifying the publisher/source of an assembly (i.e. security instead of just identity).
That being said, the idea you outlined wouldn't be feasible as-is because you can't strong name sign an XML file—strong name signing only works on .NET assemblies. Theoretically, what you could do is maintain some kind of mapping for each public key to a specific publisher (perhaps through a publisher registration process or something?), and then verify assemblies' strong name signatures before they are added to the repository.
As for the technical aspect, you can extract the public key from a
.snkfile via theStrongNameGetPublicKeyfunction (which is part of the unmanaged strong naming API). You'll have to load the.snkfile into memory yourself, though.