Code Signing

Code signing certificates are a crucial aspect of software development, providing assurance to users that the software they download is authentic and trustworthy. At QuanTrust PKI, we offer comprehensive code signing solutions to safeguard your applications and maintain user trust.

Importance of Code Signing

Code signing is paramount in today’s digital landscape where malicious software poses significant threats. By digitally signing applications, developers verify their identity and protect users from potential security risks, ensuring the integrity and authenticity of software downloads.

Types of Code Signing Certificates

Standard Validation Certificates

This is the default type of code signing certificate and involves basic validations of the publisher or developer by the CA. To get a standard code signing certificate, software publishers need to meet some basic requirements such as minimum key length, maximum validity period, and time stamping for digital signatures.

Extended Validation Certificates

EV code signing certificates involve a high level of validations and vetting of the software publisher by the CA and are usually issued on a hardware token for additional levels of security. To get an EV certificate, apart from the basic requirements of standard certificates, software publishers also need to conform to much more stringent requirements – for example, maintaining private keys in a Hardware Security Module (HSM) that is compliant with FIPS (Federal Information Processing Standards) 140 Level-2 or equivalent.

How Code Signing Works?

Code signing follows several steps. It starts with the creation of a unique key pair. The key pair created is a public-private key pair since code signing uses public key cryptography. Once the key pair is made, the public key is shared with a trusted certificate authority, confirming that the key belongs to the owner by returning digitally signed code signing certificate. A Certificate Authority is a highly trusted entity accountable for signing and generating digital certificates.

Once the public key and a digital code signing certificate are verified and returned, the code of the software is run via a hash function. A hash function is a one-way process that pivots the text added into the function and then into an arbitrary mixture of values that cannot be changed. This provides a value for comparing the data sent to the consumer. The output, or digest, is then encrypted using the private key. The private key is used for encryption instead of the public key because the developer would need anyone to read the message but no one to tamper with it. The digest, hash function, and code signing certificate are now integrated into a signature block and positioned into the software, which is sent to the user.

Finally, when the software is downloaded to the user’s computer, the system inspects the authenticity of the code signing certificate. Once the authenticity is ensured, the digest is decrypted using the initially created public key. The hash function is now used on the software’s code, and the resulting digest is compared to the digest sent by the developer. If the digests match after comparison, the software is safe to install; otherwise, it shows a pop-up that the software is not secure.

Code signing ensures trusted software

Digitally signed executable files such as applications, libraries and drivers help ensure that your software stays trusted and unmodified, even when it is distributed over insecure networks or stored on untrusted media.

Advantages of Code Signing

Code signing provides many benefits, the main ones listed below:

  • Authenticity: Code signing assures users that the software they are downloading is from a legitimate and trusted source. It prevents unauthorized modification of the code, ensuring its integrity.
  • Integration: Code signing seamlessly integrates into software development and distribution processes. It adds a layer of security that builds trust among users and stakeholders.
  • Timestamping: Code signing certificates include a timestamp that indicates when the software was signed. This timestamp provides a reference point for verifying the software’s validity and helps in compliance with regulatory requirements.

What are the challenges when deploying a code signing service?

Secure software

Software distributions must be secured to prevent theft or damaged reputation, and without the need for in-house cryptographic expertise. 

Streamline code signing

Code signing services must be available independently of the number of products, developers and geographical sites, and not require extensive maintenance.

Smooth workflows

Code signing must easily integrate into development processes, be compliant and support automation – to minimize human errors.