cryptography - How to verify a binary signed with a self-signed certificate? -


We want to add automated software updates to our application, but our company is still not ready to buy code-signing certificates. From the trusted root ca, we will now use self-signed certificates to sign code updates (.exe and .dll) for now.

Question: Self-certificates signed without installing a certificate using Microsoft's cryptography API? To check against the .cer file will be bundled with the application. Or is it easy to use normal crypto library?

You can leave the whole X509 thing, after all you really do not need it if you You are going to use your certificate ...

Whatever you want to do, first you have to generate your RSA Private / Public Key pair and then you store the public key in your application.

When you have an update, sign it on your site, MD5 or SHA-1 or whatever you want to use; So you encrypt the hash with the private key. Get installed and signed (encrypted hash) installed applications; When the application becomes a binary file, it calculates your Hush, then decrypts and compares them to another using the public key. If they are the same then this is a valid update, otherwise you reject it and warn the user or something.

The mechanism is ok with the X509 certificates signed, but there is a bunch of additional data such as the identity of the public key issuer that will be identical to the certificate.


Comments

Popular posts from this blog

python - Overriding the save method in Django ModelForm -

html - CSS autoheight, but fit content to height of div -

qt - How to prevent QAudioInput from automatically boosting the master volume to 100%? -