Code signing and trusted sources

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does code signing let a computer check about a piece of software?

A It came from the named publisher and has not been changed since signing

B It is free to download and has no bugs

2. Your computer shows a warning that an app is from an 'unknown publisher'. What is the best response?

A Stop and check where the app came from before installing

B Click through the warning because it is probably fine

3. Which download source is the safest choice for a new app?

A The official app store or the publisher's own website

B A link sent by a stranger in a chat message

4. A program has a valid digital signature from its publisher. What does this tell you?

A The code can never contain any security flaws

B The code has not been altered since the publisher signed it

5. A website publishes a hash next to its download. How do you verify the file?

A Check that the file name looks the same as the one on the website

B Calculate the hash of your downloaded file and check it matches the published one

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Publisher: Unknown publisher		AIgnoring an unsigned software warning. The software has no valid signature, so you cannot tell who made it or whether it was changed. Stop and get it from the official source instead.
2sha256sum setup.exe		BDigital signature: Valid \| Publisher: Mozilla Corporation
3Download software only from the official source, where the publisher controls the file.		CComparing a hash that came from the same untrusted place as the file. An attacker could change both. The hash must come from the official publisher's own website.
4A valid digital signature lets the computer check the software came from the named publisher and has not been changed.		DAn unsigned software warning: the installer has no valid digital signature, so the computer cannot confirm who made it or that it is unchanged.
5Warning: Unknown publisher. Click Run anyway.		ECreates a hash of the downloaded file so you can compare it with the hash the publisher published and check the file has not been changed.
6Hash on download site = Hash from the same site's mirror, so file is safe		Fhttps://www.mozilla.org/firefox/

Definitions

Code signing

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF computedHash _ publishedHash THEN

_________ installer.exe

IF signatureValid = _____ THEN warnUser

IF signed = TRUE THEN install(file) ____ block(file) ENDIF

IF ___ fromOfficialSite THEN cancel(file)

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A file <- get(official_site)

B IF file_exists(file) THEN

C install(file)

D ELSE delete(file)

Question 2

A published <- 'a3f9'

B actual <- sha256(file)

C IF actual = published THEN

D print('File was changed')

E ELSE print('Do not install')

Question 3

A app <- open_installer()

B IF app.signed = true THEN

C show_warning()

D cancel_install()

Question 4

A trusted <- ['vendor.com']

B site <- 'vendor.com'

C IF site NOT IN trusted THEN

D download(site)

Question 5

A sig <- file.signature

B ok <- verify(file, sig, priv)

C IF ok THEN run(file)

Answer Key

Code signing and trusted sources

Section A: Quick Questions

A — It came from the named publisher and has not been changed since signing

A — Stop and check where the app came from before installing

A — The official app store or the publisher's own website

B — The code has not been altered since the publisher signed it

B — Calculate the hash of your downloaded file and check it matches the published one

Section B: Match the Pairs

Publisher: Unknown publisher → An unsigned software warning: the installer has no valid digital signature, so the computer cannot confirm who made it or that it is unchanged.

sha256sum setup.exe → Creates a hash of the downloaded file so you can compare it with the hash the publisher published and check the file has not been changed.

Download software only from the official source, where the publisher controls the file. → https://www.mozilla.org/firefox/

A valid digital signature lets the computer check the software came from the named publisher and has not been changed. → Digital signature: Valid | Publisher: Mozilla Corporation

Warning: Unknown publisher. Click Run anyway. → Ignoring an unsigned software warning. The software has no valid signature, so you cannot tell who made it or whether it was changed. Stop and get it from the official source instead.

Hash on download site = Hash from the same site's mirror, so file is safe → Comparing a hash that came from the same untrusted place as the file. An attacker could change both. The hash must come from the official publisher's own website.

Section C: Definitions

Code signing — Code signing adds a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

Section D: Fill in the Blanks

IF computedHash = publishedHash THEN

sha256sum installer.exe

IF signatureValid = FALSE THEN warnUser

IF signed = TRUE THEN install(file)
ELSE block(file)
ENDIF

IF NOT fromOfficialSite THEN cancel(file)

Section E: Spot the Error

B — The check must test the digital signature, not just whether the file exists. A file can exist and still be fake or changed. It should be IF signature_valid(file) THEN.

D — When the hash you calculate matches the published hash, the file has not been changed. The message should be print('File unchanged').

B — The unsigned software warning should appear when the app is NOT signed. The condition should be app.signed = false, not true.

C — Downloads should only happen when the site IS in the trusted list of official sources. NOT IN would allow downloads from untrusted sites. It should be IF site IN trusted THEN.

B — A signature is checked with the publisher's public key. The private key stays secret with the publisher. It should be verify(file, sig, pub).