C# Strong Naming of dll, not detecting modifications

Question

It is my understanding that strong naming creates a cryptographic Hash of the a assembly to which is used as a strong name to load the dll.

I was hoping to use this feature to detect corruption of a binary to inform the user there is a problem with the software and they need to reinstall it.

This works for some changes to the binary, however i've found modifying the binary, especially static strings within the binary, does not cause the application to report that it cannot locate a dll of the appropriate strong name.

Can anyone explain to me what data from an assembly is used to create the strong name, and why strong naming does not always detect the modification of the dll? Is there a way that i can force it to include additional information in the strong naming?

Is there a alternate way i can detect a corruption of a binary?

Cheers

Ryan

Answer 1

You should take a look here: Authenticode Signatures and Strong Name Signatures and How do I Sign .Net assemblies with Authenticode signature?

These two signatures are completely independent of each other. A strong name helps to provide a unique identity for an assembly. Authenticode allows you to verify who the author of the assembly is.

And

If both types of signatures are applied to an assembly, the strong name signature is wrapped within the Authenticode signature. Meaning that I could modify the bytes of the Authenticode signature so that it is no longer valid without invalidating the strong name signature. The reverse is not true -- modifying the bytes of the strong name signature would invalidate both it and the Authenticode signature.

Answer 2

As far as I know, the hash used in strong-naming includes the entire file, so I am not sure why some changes are not tripping the verification.

Is there any chance your assembly is added in skip-verification list?