Section 9: Code Signing

The Big Picture: Who Made This Program, and Has It Been Changed?

You download setup.exe. Two questions matter: Who made it? and Is it exactly what they published, or did someone change it on the way? Looking at the file name tells you nothing.

Code signing answers both. The publisher puts a digital signature on the program. Windows checks the signature, and can say "this is from a known publisher and has not been changed", or "unknown publisher", or "tampered".

It is the same idea as a wax seal on a letter. The seal shows who sent it, and a broken seal shows it was opened.

Cryptography words, explained:

9.1 Digital Signatures on Executables/Drivers

What it is: Microsoft's format for signing programs is called Authenticode. It is used on .exe, .dll, .sys (drivers), installers (.msi), scripts (.ps1) and more.

How a file gets signed:

 Publisher                                    Result
 ┌────────────────────────────────┐
 │ 1. Hash the program            │
 │ 2. Lock the hash with the      │   ┌──────────────────────────┐
 │    PRIVATE key  = signature    │──►│ program + signature +    │
 │ 3. Attach signature and the    │   │ certificate (public key) │
 │    certificate to the file     │   └──────────────────────────┘
 └────────────────────────────────┘

How Windows checks it:

 Windows receives the signed file
        │
 1. Hash the file again           ──► hash A
 2. Unlock the signature with the
    certificate's PUBLIC key      ──► hash B
        │
 3. Compare:  A equals B ?
        ├── yes ► file is unchanged since signing
        └── no  ► file was altered: signature INVALID

A matching hash proves integrity (unchanged). A trusted certificate proves origin (who signed). Both are needed. Also, a signature does not mean the program is safe. It means this publisher stands behind it. Malware authors do sometimes get certificates (or steal them).

Timestamps. A signature can include a timestamp from a trusted server. If the certificate expires later, the signature is still considered valid, because it was made while the certificate was valid.

Where signing is required or used:

SmartScreen reputation. When you download and run a file, SmartScreen checks it against Microsoft's reputation data. A file with a valid signature from a publisher who is widely used passes quietly. A brand-new, unsigned, rarely-downloaded file may show "Windows protected your PC". You can still click More info → Run anyway, but you should stop and think first. Signed files earn reputation with the publisher over time, instead of per file.

See a signature yourself:

The PowerShell output has a Status column. Typical values:

Note on Windows' own files. Many Windows files are not signed inside the file. They are covered by catalog files (.cat), which list the correct hashes of many files and are signed once. Get-AuthenticodeSignature may show NotSigned for such a file unless it checks the catalog. Use the Properties tab or the sigcheck tool from Sysinternals when in doubt.

9.2 Certificate Chain Validation

A certificate is only useful if you trust the one who issued it. But who vouches for them? The answer is a chain.

 ┌───────────────────────────────────────────────┐
 │ ROOT CA                                       │
 │ (self-signed; already in Windows' trusted     │
 │  store, so Windows trusts it directly)        │
 └───────────────────────┬───────────────────────┘
                         │ signs
 ┌───────────────────────▼───────────────────────┐
 │ INTERMEDIATE CA                               │
 │ (issues certificates day to day)              │
 └───────────────────────┬───────────────────────┘
                         │ signs
 ┌───────────────────────▼───────────────────────┐
 │ LEAF (end-entity) certificate                 │
 │ "Example Software Ltd" signing certificate    │
 └───────────────────────────────────────────────┘

What Windows checks, step by step:

If any step fails, the signature is not trusted.

Trusted publishers. Windows also has a Trusted Publishers store. A certificate placed there is trusted for things like policies that say "run only from trusted publishers". Do not add anything to it unless you are sure.

See the stores: Press Win + R, run certmgr.msc for your user certificates, or certlm.msc for the whole computer.

Why this is a big deal, and why it can fail:

Security tip: Do not install a root certificate that a random website or program tells you to install. A root you trust can vouch for anything, including fake sites and fake software.

Summary