tags:

views:

124

answers:

3

I have noticed that in some C# code I have taken over (in VS2005) that the assemblies are all signed with the same .snk file.

  • Why would the previous author have signed the assemblies in this way?
  • Is signing assemblies necessary and what would be wrong with not signing?
  • What disadvantages are there in signing assemblies - does it cause delays?
+3  A: 

You need to sign assemblies if you want to put them in the GAC.

If you sign an executable, then any class libraries it links to also needs to be signed, this can be difficult if you're using a 3rd party library (especially if you need to use an ActiveX control or similar).

Richard Grimes have written a good workshop about security in .Net and that includes a chapter about this: Security Workshop

The reason for all the assemblies being signed with the same .snk could be if he used unit testing with code coverage. To be able to do code coverage (at least with the tools built into the testing version of VS2005) if the assemblies are signed you need to specify what .snk files that are used for the signing, but I think you can only specify one .snk file for the whole solution, so if you sign the various class libraries with different .snk files you can only check the code coverage on one of them at a time.

ho1
+6  A: 

Why would the previous author have signed the assemblies in this way?

No idea, maybe he wanted all his assemblies to be signed with the same key.

Is signing assemblies necessary and what would be wrong with not signing it?

No, it is not necessary but it is a mechanism allowing you to ensure the authenticity of an assembly. It allows you to ensure that an assembly hasn't been tampered with and indeed it origins from this author. It is also necessary if you want to put them into the GAC.

What disadvantages are there in signing assemblies - does it cause delays?

Signed assemblies can only load other signed assemblies. Also they are tied to a specific version meaning that you need to use binding redirects or recompile the application if you wanted to use a different version. There's a little performance overhead as well due to the verification of the signature but it is so little that you shouldn't be concerned about.

Darin Dimitrov
+2  A: 

A very important reason to sign an assembly is so you can be sure it is your assembly. Since the private key is yours, nobody else can sign an assembly with that same key. This means that when the public key of an assembly is one you know (you can retrieve this using the GetType().Assembly.GetName().GetPublicKey() function), the assembly is yours and it has not been tampered with.

Pieter