views:

413

answers:

3

To sign an assembly A you have to make sure all assemblies B, C, D that are used by A are signed, and then all assemblies that are used by B, C, D, and so on. I don't understand what's the security benefit of this. I think it's supposed to prevent tampering, but assembly A is allowed to open any file, and these can be tampered. The same goes for an external webserver.

Also, it's too easy to sign an assembly with a .snk file that you make public, sidestepping the requirement.

+2  A: 

Another reason for strong naming is versioning. If you reference a strong named assembly, you get that specific version - and it will load its dependencies at the specific versions it relies upon.

EDIT

Example scenario: If you put an assembly in the GAC, it has to be strong named to allow side-by-side versioning. You couldn't put it in the GAC, though, unless its dependencies were also there (otherwise, they'd fail to load at run time). In order for those assemblies to be loaded reliably, they need to be strong named too, and in the GAC.

Yes. I agree there are benefits to strong naming. What I don't see is the benefit of the transitivity requirement.
Bruno Martinez
+1  A: 

It's because the a strongly named assembly implies that it can be trusted, and levels of granted security are based on the idea that the code is from a legitimate source. This means that all other items that it interacts with must also be trusted, because it executes under the same security context.

If strongly named objects didn't work this way, a method of attack would be to replace the items which aren't signed with rogue code the attacker wants to execute. The rogue code would execute under the trusted security context of the signed item.

Kevin
You can overwrite normal files assembly A depends on, or fake webservers it connects to. Maybe A builds runtime code from these sources, and the security risk is the same.It's A's call to use unsigned assemblies and open itself to attack. Note that A already can do this: just sign B with a key and make it public. It's just inconvenient.
Bruno Martinez
+5  A: 

The point is that otherwise you could replace assembly B/C/D with a different (hacked) one, and A would never notice; it would load them and execute the code. With strong naming, you can't do this without either re-signing the hacked B/C/D with the same key, or by hacking A.

Marc Gravell
You wouldn't be able to replace B/C/D if they were signed, only if they weren't. It's A's call.
Bruno Martinez
@Bruno - that being my point...
Marc Gravell
But that's not how it works now. A can't decide whether to depend on signed or unsigned B/C/D. They must be signed because A is.
Bruno Martinez
I know that... hence "otherwise"...
Marc Gravell
It is NOT A's call. It is A's client's call. If the A's client trusts A, A cannot turnaround and throw the trust away by using untrusted assemblies. If you trust me with your secret, then I should only give the secret to people I trust, for YOUR sake.
Lucas
For info, Eric Lippert blogged about this very recently: http://blogs.msdn.com/ericlippert/archive/2009/06/04/alas-smith-and-jones.aspx
Marc Gravell