用于数字签名的签名二进制文件
http://en.wikipedia.org/wiki/Digital_signature#Using_digital_signatures_only_with_trusted_applications 警告“恶意应用程序诱骗用户签署任何文档的可能性通过在屏幕上显示用户的原始文档，但向签名应用程序提供攻击者自己的文档。”
着眼于不可否认性，如何才能真正确保文档查看者，或签名应用程序，或者两者都没有被恶意代码取代？
即使二进制文件已签名，似乎也没有办法 防止代码在内存中被修改。即使有办法，攻击者难道不能简单地修改查看器和签名应用程序吗？
这个问题不是特定于 Windows 的。我愿意使用任何操作系统。
http://en.wikipedia.org/wiki/Digital_signature#Using_digital_signatures_only_with_trusted_applications warns about the possibility of "malicious application to trick a user into signing any document by displaying the user's original on-screen, but presenting the attacker's own documents to the signing application."
With an eye on non-repudiation, how can one truly ensure that the document viewer, or signing application, or both have not been replaced by malicious code?
Even if the binaries were signed, there doesn't seem to be a way to prevent the code from being modified in memory. Even if there way, couldn't the attacker simply modify both the viewer and the signing application?
This question is not Windows-specific. I am willing to entertain the use of any operating system.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
用户机器的安全对于所有涉及安全的事情都是至关重要的。如果您不能信任您的操作系统和安装的应用程序，那么每个签名机制都可能被破坏或被欺骗。
是的，他可以。
可以考虑最薄弱的安全机制来评估计算机的安全性。如果您的操作系统已被泄露，那么建立强大的加密工作根本没有用。
编辑：
好吧，您永远无法绝对确定您的操作系统是安全的。有许多不同的事情需要考虑：
我对此一无所知。也许你可以。但是，如果有人可以利用您计算机上运行的服务（例如具有 root 权限的服务器应用程序），那么只读驱动器将无法拯救您。
首先尝试评估您的系统真正需要的安全级别。也许您无法实现完美的安全性。然后尝试达成一个良好的妥协。
请记住，安全性和可用性可能会成为一种权衡。如果您强制执行安全策略，系统的可用性可能会降低。
对于我个人的建议：
The security of the user machine is essential for everything concern security. If you can't trust your operating system and installed applications, then every signature mechanism could be broken or tricked.
Yes he can.
The security of your computer could be evaluated considering the weakest of your security mechanism. Build up strong cryptographic effort, isn't useful at all if your operating system has been compromised.
EDIT:
Well, you could never be absolutely certain that your OS is secure. There are many different things to take in consideration:
I don't know about that. Maybe you can. But if someone can exploit a service running on your machine (for example a server application with root privileges), than read-only drive won't save you.
First of all try to evaluate the level of security that your system really need. Probably you can't achieve perfect security. Then try to get a good compromise.
Remember that security and usability could become a trade-off. If you enforce your security policy, usability of your system may decrease.
For what concern my personal advices:
不可否认性是一个非常有争议的话题。欧盟有一项指令 (1999/93/EC)，对此类不可否认签名做出了类似于“所见即所签”的规定。正如您已经提到的，棘手的部分是 - 我们如何才能提供这一保证？
如果您的操作系统受到损害，即攻击者可以在操作系统级别扰乱您的计算机，那么仅靠安全签名设备（例如智能卡）就无法拯救您。尽管设备是安全的，但攻击者可以在屏幕上显示与您最终签名的内容非常不同的内容。
签名的、因此受信任的代码也无法解决这个困境。该软件可能是典型的安全性，但您仍然可以摆弄输入和输出，无论是在文件系统上还是在内存中等。
因此，确保所见即所得原则的唯一真正安全的方法是一个安全的硬件设备，它可以做到 >两者都签名和显示带外数据，即与受感染操作系统的窥探断开连接。理想情况下，它还负责输入 PIN（密码键盘等），因为在安装了键盘记录器的计算机上输入 PIN 并不安全。只有这样，用户才能确定他们在显示屏上看到的内容正是传输到设备上的内容，然后才能决定是否应用其不可否认签名。
这些设备是存在的（至少我在现实生活中见过它们，除了显示方面——关于那些我只听到人们谈论的设备），但目前它们仍然很少见，因为向大众推广它们仍然太昂贵。
Non-repudiation is a very debatable subject. In the EU there exists a Directive (1999/93/EC) that stipulates something along the lines of "What You See Is What You Sign" for such non-repudiation signatures. The tricky part is, as you already mentioned - how can we give this guarantee?
If your OS is compromised, that is an attacker can mess with your machine at the OS level, then a secure signature device (e.g. smart card) alone can't save you. Although the device is secure, an attacker can display something on the screen that is very different from what you are finally signing.
Signed and therefore trusted code is also no solution to this dilemma. The software may be exemplary secure, but still you can fiddle with the inputs and outputs, be it on the file system, in memory etc.
So the only really secure way to ensure this WYSIWYS principle would be a secure hardware device that does both signing and displaying the data out-of-band, that is disconnected from the prying eyes of your infected OS. Ideally it also takes care of entering the PIN (a pin pad or s.th.), because entering a PIN on a machine with a key logger installed - not secure. Only then can users be sure that what they see on the display was exactly what was transferred to the device - and can then decide whether to apply their non-repudiation signature or not.
These devices exist (at least I've seen them in real life minus the display aspect - about those I've only heard people talking) but for now they remain rare because still being too expensive for rolling them out to the masses.