如何为我的插件实现自定义数字签名？

Question

In a C++ application (actually a browser plugin but this isn't too relevant) I have a need for it to be able to run external processes which expose a specific interface through IPC. Sort of like a plugin architecture but the plugins are discrete applications rather than DLLs, etc.

Someone can easily find out the required interface and write a malicious 'plugin', hosting it on their web-site, comparable to a malicious SWF except SWFs are sand-boxed. Then if someone with the browser-plugin installed comes to that page, it would load and run the malicious process in a kind of drive-by attack.

One recommendation I see is to use a signing mechanism, but I don't know how that might be achieved. Note, I'm not creating something for mass-market but specialist use, so the number of companies producing legitimate plugins would be small.

Answer 1

One way is to use a cryptographic library like GPG or OpenSSL . With both of them you create a public/private key pair. You sign your application with the private key. The browser plugin contains the public key, which is used to verify the signature. These libraries are not particularly easy to use. Read eg dgst.c from the OpenSSL package. You will need to adapt it (at least the verification part) to your plugin. There's a lot of APIs to learn! You may use dgst.c as is to sign the files.

If you are on Windows you can also use windows Crypto API (CAPI) in much the same way, but I know next to nothing about Windows APIs.

Another way is to implement a signature algorithm from scratch. This is not for the faint of heart either. Read http://en.wikipedia.org/wiki/Digital_signature , pick a method that looks like easy to implement (RSA, DSA, ElGamal...), and implement it (both the signing and the verifying part, or just the verifying part -- but then make sure it is compatible with OpenSSL or GPG so you can use them for signing.

Answer 2

Both DLLs and EXE are signed using Authenticode technology and X.509 certificates.

To validate the Authenticode signature on Windows using mechanisms built into Windows you use WinVerifyTrust function of CryptoAPI. This will require that each "plugin" is signed using the certificate issued by some well-known CA (known to Windows, at least).

If you want to give plugin developers your own certificates (to let them save money on purchasing certificates from CAs), then you can take PKIBlackbox package of our SecureBlackbox product and become your own certificate authority. PKIBlackbox allows you to create and verify Authenticode signatures as well.