473,320 Members | 1,695 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,320 software developers and data experts.

Where is the private key stored?

Where is the private key to an assembly stored?

The public key is stored in the manifest. All clients that reference
the shared assembly, when compiled, store the public key _token_ into
their manifests along with a hash value for the referenced assemblies.

However, the private key is not distributed. From what I've read, it
still remains with the author on his machine in the .snk file generated
by the sn utility.

If the private key never leaves the development PC, how does the
production server where the shared assembly is deployed sign itself so
that its clients may be assured of its authenticity?

Nov 21 '05 #1
6 2568
Sathyaish,

It doesn't. The assembly is signed before the assembly is distributed
to the production server.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard.caspershouse.com

"Sathyaish" <Sa*******@Yahoo.com> wrote in message
news:11**********************@g44g2000cwa.googlegr oups.com...
Where is the private key to an assembly stored?

The public key is stored in the manifest. All clients that reference
the shared assembly, when compiled, store the public key _token_ into
their manifests along with a hash value for the referenced assemblies.

However, the private key is not distributed. From what I've read, it
still remains with the author on his machine in the .snk file generated
by the sn utility.

If the private key never leaves the development PC, how does the
production server where the shared assembly is deployed sign itself so
that its clients may be assured of its authenticity?

Nov 21 '05 #2
> The assembly is signed before the assembly is distributed
to the production server.

Nicholas,

Here's my understanding and let's see if we can reconcile it with the
facts.

The assembly is signed by running the sn utility on it. This generates
a file that carries the public and private key pair. The pair is not
yet linked to the assembly until you specify the
Assembly:AssemblyKeyFile attribute in the assemblyinfo.cs file, and
then build the project (to install the key pair into the CSP).

After this, I am lost. The assembly is installed in the GAC on the
production server using gacutil -i or an msi installer.

How does the private key move from the .snk file on the development PC
to the production server? Do you mean that when the project is built
after giving the assembly a strong name, the private key is also munged
into some part of the assembly? Just like the public key is written to
the manifest, is the private key also written to some other portion
(may be the IL itself or the metadata section)?

Nov 21 '05 #3
Sathyaish,

No, the private key is not located anywhere in the assembly. The idea
here is that an assembly with a public key can only be created by the person
who has the private key.

If the private key was in the assembly, then someone could extract it,
and compile their own assemblies with your identity.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard.caspershouse.com

"Sathyaish" <sa*******@gmail.com> wrote in message
news:11**********************@o13g2000cwo.googlegr oups.com...
The assembly is signed before the assembly is distributed

to the production server.

Nicholas,

Here's my understanding and let's see if we can reconcile it with the
facts.

The assembly is signed by running the sn utility on it. This generates
a file that carries the public and private key pair. The pair is not
yet linked to the assembly until you specify the
Assembly:AssemblyKeyFile attribute in the assemblyinfo.cs file, and
then build the project (to install the key pair into the CSP).

After this, I am lost. The assembly is installed in the GAC on the
production server using gacutil -i or an msi installer.

How does the private key move from the .snk file on the development PC
to the production server? Do you mean that when the project is built
after giving the assembly a strong name, the private key is also munged
into some part of the assembly? Just like the public key is written to
the manifest, is the private key also written to some other portion
(may be the IL itself or the metadata section)?

Nov 21 '05 #4
Nicholas,
I know what you're saying and it makes a lot of sense. However, I am
still confused. I am not able to reconcile a few ideas.

If the assembly on the target/production server does not carry with it
any signatures in the form of a private key, then how does it know when
a new version wants to overwrite it, that the new version comes from an
authentic source?

Nov 21 '05 #5
Your problem is about understanding the more general problem private/public
key concept in cryptography.

I will let it up to you to find relevant reading, just explain this
particulare case.

Basically there is a 'secure signature' in the assembly however it's called.
It's a hash of the assembly encrypted with the private key.
Because the public key is public, every one could use the public key to
decrypt the signature and verify it corresponds to the assembly's hash.

But only the private key could produce this signature. And private & public
key for a pair.
So you know it's valid.

"Sathyaish" <sa*******@gmail.com> wrote in message
news:11*********************@g47g2000cwa.googlegro ups.com...
Nicholas,
I know what you're saying and it makes a lot of sense. However, I am
still confused. I am not able to reconcile a few ideas.

If the assembly on the target/production server does not carry with it
any signatures in the form of a private key, then how does it know when
a new version wants to overwrite it, that the new version comes from an
authentic source?

Nov 21 '05 #6
At compile a hash is made of the assembly bytes, then signed by the private
key. The signature is stored as well as the public key inside the assembly.
After this the private key is never again (unless you keep recompiling.)
When the code loads the hash is computed again and verified against the
signature. The public key is used to decrypt the signature and the two
clear hashes are compared for equality. If someone changes the code, the
hashes will not compare. If someone changes the public key in the assembly,
the hashes will not equal. However, it is still possible for a third party
to fully resign the assembly with their own key pair which would allow them
to change the assembly and have it still load as normal. This signing was
not developed to protect your assembly (as some still think), the primary
goal was to uniquely (and unambiguously) identify assemblies.

--
William Stacey [MVP]

"Sathyaish" <sa*******@gmail.com> wrote in message
news:11*********************@g47g2000cwa.googlegro ups.com...
Nicholas,
I know what you're saying and it makes a lot of sense. However, I am
still confused. I am not able to reconcile a few ideas.

If the assembly on the target/production server does not carry with it
any signatures in the form of a private key, then how does it know when
a new version wants to overwrite it, that the new version comes from an
authentic source?

Nov 21 '05 #7

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

8
by: VJ | last post by:
Hi, I apologize if this question has been asked many times on the group! I am new to programming, I know that there are three section in address space- one for code, one for stack, and the...
9
by: thomson | last post by:
Hi all, Would you please explain me where will be the heap stored if it is declared inside the Class, As class is a reference type, so it gets stored on the heap, but struct is a value...
6
by: Sathyaish | last post by:
Where is the private key to an assembly stored? The public key is stored in the manifest. All clients that reference the shared assembly, when compiled, store the public key _token_ into their...
7
by: Jan | last post by:
Hi There, I want to insert an object with private copy constructor at the and of a STL list. Is there an easy way to do it like that: list <x> myList; // x has private copy constructor .... ...
86
by: jopperdepopper | last post by:
Hi, finally giving php 5 a go, and going over the new approach to classes. Can someone clarify the public, private and protected to me? I quote the php manual: "The visibility of a property or...
1
by: a.mustaq | last post by:
Hi All, I have some doubts regarding to caching. 1.Where cached objects are stored. 2.What is public caching and private caching. 3.Is caching user specific or application specific Please...
2
by: roger.dunham | last post by:
I am trying to identify whether a .NET 1.1 application that I have written has a memory leak. I thought I understood how .NET memory management worked, but it appears that there is more to it...
37
by: Phlip | last post by:
1230987za wrote: Kanze is a classically-trained "unit tester". In some circles "unit" is a QA concept - specifically, if a test fails, you only need to inspect one unit. So "units" are...
8
by: DevInCode | last post by:
I'm working on a site that has been left to die for a few years. There is a login to access a certain part of the site. I can't figure out where this password is stored. When the private html...
0
by: Vimpel783 | last post by:
Hello! Guys, I found this code on the Internet, but I need to modify it a little. It works well, the problem is this: Data is sent from only one cell, in this case B5, but it is necessary that data...
0
by: jfyes | last post by:
As a hardware engineer, after seeing that CEIWEI recently released a new tool for Modbus RTU Over TCP/UDP filtering and monitoring, I actively went to its official website to take a look. It turned...
1
by: PapaRatzi | last post by:
Hello, I am teaching myself MS Access forms design and Visual Basic. I've created a table to capture a list of Top 30 singles and forms to capture new entries. The final step is a form (unbound)...
1
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
1
by: Defcon1945 | last post by:
I'm trying to learn Python using Pycharm but import shutil doesn't work
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.