Code signing and trusted sources

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does code signing let a computer check about a piece of software?

A That it contains no bugs at all

B Who published it and that it has not been changed

2. A developer signs an app before releasing it. What does the signature help prove?

A The app came from the named publisher

B The app is encrypted so nobody can read it

3. A signed installer is edited by an attacker after it was signed. What happens when the computer checks the signature?

A The check fails because the code was changed

B The check still passes because the publisher is the same

4. Which sub-theme of code signing is being used when your computer shows the publisher's name before you install?

A Verifying the publisher

B Tamper detection

5. Your computer warns that an app has an 'Unknown publisher'. What is the safest response?

A Click Install anyway because warnings are usually wrong

B Stop and check where the app came from

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1code signing		AAn 'Unknown publisher' warning means the code signature could not be verified, so the software may not come from who it claims. Ignoring it skips the code signing check.
2Verified publisher: Example Pty Ltd		Bsignature_valid = false
3Tamper detection: if even one byte of a signed installer is changed, the signature check fails.		CThe software's signature checked out, so the computer can confirm the named publisher really signed it.
4Only install software from a trusted source, such as the publisher's official site, and check that it is signed.		DAdding a digital signature to software so a computer can check who published it and that it has not been changed since it was signed.
5Unknown publisher - installing anyway because it looks fine		Eif signed and trusted_source: install()
6signed_file = edit(signed_file); still_trusted = true		FChanging a file after it was signed breaks the signature, so it can no longer be trusted. Assuming it is still valid ignores tamper detection.

Definitions

code signing

Fill in the Blanks

Complete each line of code by filling in the missing parts.

signedApp = ____(app, privateKey)

ok = verify(app, signature, _________)

IF newHash __ signedHash THEN warn("File was changed!")

__ signatureValid THEN install(app)

newHash = ____(downloadedFile)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A app ← download('editor.exe')

B sig ← app.signature

C hash ← sha256(app)

D IF verify(sig, hash, privKey)

E THEN install(app)

F ELSE block(app)

Question 2

A cert ← app.publisherCert

B IF cert.expired = TRUE

C trust(cert.publisher)

D ELSE warn('Cert expired')

Question 3

A signedHash ← decrypt(sig, pubKey)

B newHash ← sha256(file)

C IF signedHash = newHash

D DISPLAY 'File was changed'

Question 4

A file ← 'update.exe'

B sig ← sign(file, publicKey)

C publish(file, sig)

Question 5

A hash ← base64(file)

B sig ← sign(hash, privateKey)

C attach(file, sig)

Answer Key

Code signing and trusted sources

Section A: Quick Questions

B — Who published it and that it has not been changed

A — The app came from the named publisher

A — The check fails because the code was changed

A — Verifying the publisher

B — Stop and check where the app came from

Section B: Match the Pairs

code signing → Adding a digital signature to software so a computer can check who published it and that it has not been changed since it was signed.

Verified publisher: Example Pty Ltd → The software's signature checked out, so the computer can confirm the named publisher really signed it.

Tamper detection: if even one byte of a signed installer is changed, the signature check fails. → signature_valid = false

Only install software from a trusted source, such as the publisher's official site, and check that it is signed. → if signed and trusted_source: install()

Unknown publisher - installing anyway because it looks fine → An 'Unknown publisher' warning means the code signature could not be verified, so the software may not come from who it claims. Ignoring it skips the code signing check.

signed_file = edit(signed_file); still_trusted = true → Changing a file after it was signed breaks the signature, so it can no longer be trusted. Assuming it is still valid ignores tamper detection.

Section C: Definitions

code signing — Adding a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

Section D: Fill in the Blanks

signedApp = sign(app, privateKey)

ok = verify(app, signature, publicKey)

IF newHash != signedHash THEN
  warn("File was changed!")

IF signatureValid THEN
  install(app)

newHash = hash(downloadedFile)

Section E: Spot the Error

D — Anyone checking a signature uses the publisher's public key. The private key is kept secret by the publisher, so it should be pubKey, not privKey.

B — The program would trust the publisher only when the certificate has expired. It should check cert.expired = FALSE so only valid certificates are trusted.

C — Tampering is detected when the two hashes do NOT match. With = the warning shows when the file is unchanged. It should be ≠.

B — A publisher signs with its secret private key. The public key is shared with everyone, so anyone could forge a signature with it. It should be privateKey.

A — Base64 is just encoding that anyone can reverse, not a hash. Tamper detection needs a hash function such as sha256 to make a fingerprint of the file.