Using .snk's private key to sign arbitrary data

Question

I'm developing a .NET package manager and one thing that got me thinking is security.

Given that anybody can potentially upload an assembly to the repository, how do I verify that said assembly comes from a trusted source? For example, I'd trust NHibernate.dll much more if it was signed with a private key of guys from NHForge. To ensure this, all I'd have to do is to verify assembly signature with NHForges' public key.

Now, with that in mind, how can one establish this relationship (that this particular public key belongs to this particular person)? An idea I came up with is as follows:

• Project author creates an XML file which contains information about the project and about an author (name, email, etc)
• This XML file is signed with authors' private key extracted from a .snk file which is later used to sign the assembly itself
• Author uploads this signed XML file to the repository, where it gets checked and a relationship between an author and a public key is established

To implement this (is this a viable idea, BTW?), I need a programmatic way of accessing .snk files and reading PK. Is there something for this in .NET?

Answer 1

First off, strong names should not be used as a security mechanism—they are only intended to be used as an assembly identity mechanism. For something like this, I'd look into Authenticode, which was specifically designed for verifying the publisher/source of an assembly (i.e. security instead of just identity).

That being said, the idea you outlined wouldn't be feasible as-is because you can't strong name sign an XML file—strong name signing only works on .NET assemblies. Theoretically, what you could do is maintain some kind of mapping for each public key to a specific publisher (perhaps through a publisher registration process or something?), and then verify assemblies' strong name signatures before they are added to the repository.

As for the technical aspect, you can extract the public key from a .snk file via the StrongNameGetPublicKey function (which is part of the unmanaged strong naming API). You'll have to load the .snk file into memory yourself, though.