What is Code Signing?

Code signing involves digitally signing a file by a software developer or distributor before it is distributed. Code signing certificates are used by software developers and distributors to digitally sign executables and software programs so that end-users are able to verify that the code they receive has not been tampered with.

This process ensures that users can trust that the software they receive performs as claimed by its creator.

The signature serves as evidence that the code has not undergone any unauthorized tampering or modifications from its initial state. The ultimate aim is to alleviate the end user’s concern that the software can be downloaded from a trusted source.

How does Code Signing work?

A code signing certificate is a digital certificate that prominently displays the name of the publisher and, if required, a timestamp, and is issued by a Certificate Authority. The digital certificate binds the identity of an organization to a public key that is mathematically related to a public-private key pair and is traceable back to a trusted Certificate Authority. The use of private and public key systems is called Public Key Infrastructure (PKI). The developer signs code with its private key and the end user uses the developer’s public key to verify the developer's identity.

• If the system trusts the certificate, the download or execution will proceed.
• If there is no certificate, or If the system does not trust the root or the hashes do not match (i.e., if the signature has been tampered with), the download is interrupted with a warning informing the user that the software may not be trusted.

How does Code Signing ensure file integrity verification?

Each code signature is generated based on the file's content. A signing tool computes a condensed version of the file, referred to as a hash, and subsequently signs this hash using the provided digital certificate. This signed hash becomes embedded in the file in a dedicated space for digital signatures.

Upon distributing the signed file, operating systems and relevant applications automatically detect the signature. They proceed to calculate the hash of the file (excluding the signed hash from the calculation) and compare it to the signed hash embedded in the file. If the two hashes match, the verification is successful; if they differ, the verification fails. A failed verification means that there has been malicious intent or an error that has changed the file's content after the signature.

The advantages of Code Signing

Code signing offers various advantages, including those highlighted below.

User Trust:

• Users can trust downloaded software
• Eliminates concerns about malware

Mutual Trust:

• Establishes a two-way trust between users and developers
• Avoids warnings and blocks from operating systems
• Developers can trust their software is correctly located and not misused

Wider Distribution:

• Enables distribution through major app stores - IOS AppStore, Google's Play Store, and similar platforms require code signing

These advantages collectively enhance the security, reliability, and distribution capabilities of software utilizing code signing.

The integrity of the system relies on securing keys from unauthorized access. Best practice would be to store keys in secure, tamper-proof, cryptographic hardware devices such as Hardware Security Modules (HSMs).