C# - InternalsVisibleTo 属性的安全问题
将 InternalsVisibleTo 属性与强名称程序集一起使用是否存在任何安全问题？据我所知，以这种方式接收信息的程序集必须具有私钥才能解密消息，并且在 InternalsVisibleTo 属性中以明文形式指定公钥。有人是否可以更改 InternalsVisibleTo 属性中的程序集 dll 和公钥，以将内部函数共享给最初不打算共享的程序集？
Are there any security concerns with using the InternalsVisibleTo attribute with strong-named assemblies? I understand that the assembly receiving information this way must have the private key to decrypt the messages, and that within the InternalsVisibleTo attribute you specify the public key in clear text. Would it be possible for someone to alter the assembly dll and public key in the InternalsVisibleTo attribute to share internal functions to assemblies that weren't originally intended to be shared to?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
它与加密无关。 InternalsVisibleTo 程序集的强名称是一项硬性要求。它所证明的是，无论谁创建了该程序集，都可以像您一样访问相同的秘密。私钥。有一个非常有力的保证，即任何修改程序集或尝试创建模拟程序集的人都无法提供相同的证明。如果无法访问该私钥，他们就无法以相同的方式对其进行签名。
这足以保证信任。前提是你保管好私钥。
It has nothing to do with encryption. And a strong name for an InternalsVisibleTo assembly is a hard requirement. All that it proves is that whomever created the assembly had access to the same secret as you did. The private key. With a very strong guarantee that whomever modifies the assembly or tries to create one that impersonates the assembly cannot provide the same proof. They can't get it signed the same way without having access to that private key.
This is sufficient to guarantee trust. Provided you guard the private key.