load authorized dll

[Eugene]

Consider a system that has exe and dlls, how can i ensure that only the
authorized .net assembly can work with my system. For example, consider your
sys got an exe, that would use dll A, B, and C; how do you ensure, other
people cannot create a dll D, that has the same interface, from being invoke
from your exe. Considering, your exe is created to dynamically load the dll,
for future extensibility, meaning, as new dll comes, you don't need to change
your exe.

thanks
Eugene

[Dave]

> how do you ensure, other

people cannot create a dll D, that has the same interface, from being invoke
from your exe.
Are you loading a dynamic assembly, finding all Types that implement a certain interface defined in your assembly, and then
consuming them?

If so, just ensure that all references to your assembly must be signed with your unique key:

Find the sn.exe utility installed in "%programfiles% \Microsoft Visual Studio .NET 2003\SDK\v1.1\B in\sn.exe"

Use sn.exe to generate a strong-name public/private key pair from the command-line.

sn.exe -k "c:\mykey.s nk"

You can then use an assembly-level attribute to sign your main assembly (.exe) with your key:

[assembly: AssemblyKeyFile (@"c:\mykey.snk ")]

Also, sign all your dynamic assemblies with this key. In your code, you can check to make sure that each assembly you load has your
public key:

public void TestLoadAsm()
{
System.Reflecti on.Assembly thisAsm = System.Reflecti on.Assembly.Get ExecutingAssemb ly();
System.Reflecti on.Assembly asm = System.Reflecti on.Assembly.Loa dFile(@"c:\Test Library1.dll", thisAsm.Evidenc e);

System.Reflecti on.AssemblyName dynamicName = asm.GetName();

System.Security .Permissions.St rongNamePublicK eyBlob key =
new System.Security .Permissions.St rongNamePublicK eyBlob(thisAsm. GetName().GetPu blicKey());
System.Security .Permissions.St rongNamePublicK eyBlob dynaKey =
new System.Security .Permissions.St rongNamePublicK eyBlob(dynamicN ame.GetPublicKe y());

if (!key.Equals(dy naKey))
throw new System.Security .SecurityExcept ion(asm.FullNam e + " has an invalid key signature.");

Type type = asm.GetType("Te stLibrary1.Clas s1");
TestLibrary2.IC lass obj = Activator.Creat eInstance(type) as TestLibrary2.IC lass;

Console.WriteLi ne("{0}: {1}", dynamicName.Nam e, dynamicName.Ver sion);
Console.WriteLi ne(obj.GetType( ).FullName);
}
So, how do you stop them from plugging in a malicious assembly? Don't give them your key file.
--
Dave Sexton
dave@www..jwaon line..com
-----------------------------------------------------------------------
"Eugene" <Eu****@discuss ions.microsoft. com> wrote in message news:11******** *************** ***********@mic rosoft.com... Consider a system that has exe and dlls, how can i ensure that only the
authorized .net assembly can work with my system. For example, consider your
sys got an exe, that would use dll A, B, and C; how do you ensure, other
people cannot create a dll D, that has the same interface, from being invoke
from your exe. Considering, your exe is created to dynamically load the dll,
for future extensibility, meaning, as new dll comes, you don't need to change
your exe.

thanks
Eugene

[Eugene]

thanks, it's very helpful. i would have a config file to determine which
assembly to look for, then load through reflection. My concern is when
someone tamper with the config file to load his/her own dll. initially i
thought that the strong name is being used in GAC, so thanks for your code
for my question :)

so, the problem of this is, only if someone else gets hold of my key file.
so my question is, is there any way that other people can reproduce my file?
like, deassemble my assembly, and get the [assembly:
AssemblyKeyFile (@"c:\mykey.snk ")] ?

Eugene

"Dave" wrote:

how do you ensure, other
people cannot create a dll D, that has the same interface, from being invoke
from your exe.

Are you loading a dynamic assembly, finding all Types that implement a certain interface defined in your assembly, and then
consuming them?

If so, just ensure that all references to your assembly must be signed with your unique key:

Find the sn.exe utility installed in "%programfiles% \Microsoft Visual Studio .NET 2003\SDK\v1.1\B in\sn.exe"

Use sn.exe to generate a strong-name public/private key pair from the command-line.

sn.exe -k "c:\mykey.s nk"

You can then use an assembly-level attribute to sign your main assembly (.exe) with your key:

[assembly: AssemblyKeyFile (@"c:\mykey.snk ")]

Also, sign all your dynamic assemblies with this key. In your code, you can check to make sure that each assembly you load has your
public key:

public void TestLoadAsm()
{
System.Reflecti on.Assembly thisAsm = System.Reflecti on.Assembly.Get ExecutingAssemb ly();
System.Reflecti on.Assembly asm = System.Reflecti on.Assembly.Loa dFile(@"c:\Test Library1.dll", thisAsm.Evidenc e);

System.Reflecti on.AssemblyName dynamicName = asm.GetName();

System.Security .Permissions.St rongNamePublicK eyBlob key =
new System.Security .Permissions.St rongNamePublicK eyBlob(thisAsm. GetName().GetPu blicKey());
System.Security .Permissions.St rongNamePublicK eyBlob dynaKey =
new System.Security .Permissions.St rongNamePublicK eyBlob(dynamicN ame.GetPublicKe y());

if (!key.Equals(dy naKey))
throw new System.Security .SecurityExcept ion(asm.FullNam e + " has an invalid key signature.");

Type type = asm.GetType("Te stLibrary1.Clas s1");
TestLibrary2.IC lass obj = Activator.Creat eInstance(type) as TestLibrary2.IC lass;

Console.WriteLi ne("{0}: {1}", dynamicName.Nam e, dynamicName.Ver sion);
Console.WriteLi ne(obj.GetType( ).FullName);
}
So, how do you stop them from plugging in a malicious assembly? Don't give them your key file.
--
Dave Sexton
dave@www..jwaon line..com
-----------------------------------------------------------------------
"Eugene" <Eu****@discuss ions.microsoft. com> wrote in message news:11******** *************** ***********@mic rosoft.com...

Consider a system that has exe and dlls, how can i ensure that only the
authorized .net assembly can work with my system. For example, consider your
sys got an exe, that would use dll A, B, and C; how do you ensure, other
people cannot create a dll D, that has the same interface, from being invoke
from your exe. Considering, your exe is created to dynamically load the dll,
for future extensibility, meaning, as new dll comes, you don't need to change
your exe.

thanks
Eugene

[Eugene]

can this strong name be used to prevent other developer from inheriting from
my assembly as well?

"Dave" wrote:

how do you ensure, other
people cannot create a dll D, that has the same interface, from being invoke
from your exe.

Are you loading a dynamic assembly, finding all Types that implement a certain interface defined in your assembly, and then
consuming them?

If so, just ensure that all references to your assembly must be signed with your unique key:

Find the sn.exe utility installed in "%programfiles% \Microsoft Visual Studio .NET 2003\SDK\v1.1\B in\sn.exe"

Use sn.exe to generate a strong-name public/private key pair from the command-line.

sn.exe -k "c:\mykey.s nk"

You can then use an assembly-level attribute to sign your main assembly (.exe) with your key:

[assembly: AssemblyKeyFile (@"c:\mykey.snk ")]

Also, sign all your dynamic assemblies with this key. In your code, you can check to make sure that each assembly you load has your
public key:

public void TestLoadAsm()
{
System.Reflecti on.Assembly thisAsm = System.Reflecti on.Assembly.Get ExecutingAssemb ly();
System.Reflecti on.Assembly asm = System.Reflecti on.Assembly.Loa dFile(@"c:\Test Library1.dll", thisAsm.Evidenc e);

System.Reflecti on.AssemblyName dynamicName = asm.GetName();

System.Security .Permissions.St rongNamePublicK eyBlob key =
new System.Security .Permissions.St rongNamePublicK eyBlob(thisAsm. GetName().GetPu blicKey());
System.Security .Permissions.St rongNamePublicK eyBlob dynaKey =
new System.Security .Permissions.St rongNamePublicK eyBlob(dynamicN ame.GetPublicKe y());

if (!key.Equals(dy naKey))
throw new System.Security .SecurityExcept ion(asm.FullNam e + " has an invalid key signature.");

Type type = asm.GetType("Te stLibrary1.Clas s1");
TestLibrary2.IC lass obj = Activator.Creat eInstance(type) as TestLibrary2.IC lass;

Console.WriteLi ne("{0}: {1}", dynamicName.Nam e, dynamicName.Ver sion);
Console.WriteLi ne(obj.GetType( ).FullName);
}
So, how do you stop them from plugging in a malicious assembly? Don't give them your key file.
--
Dave Sexton
dave@www..jwaon line..com
-----------------------------------------------------------------------
"Eugene" <Eu****@discuss ions.microsoft. com> wrote in message news:11******** *************** ***********@mic rosoft.com...

Consider a system that has exe and dlls, how can i ensure that only the
authorized .net assembly can work with my system. For example, consider your
sys got an exe, that would use dll A, B, and C; how do you ensure, other
people cannot create a dll D, that has the same interface, from being invoke
from your exe. Considering, your exe is created to dynamically load the dll,
for future extensibility, meaning, as new dll comes, you don't need to change
your exe.

thanks
Eugene