Signing contents of a file archive

Question

Let's say I have a custom file archive format similar to Zip or Rar, for example. A small game I'm working on would then during runtime read the archived files, which may be textures, sounds, XML files or whatever else.

Now I'd like a way to verify the authenticity of the archive (or even of individual files inside the archive), so that the game can distinguish between "official" files released by me and modified files or archives released by some modder. The game should still be able to read the modded files just fine, but it will display some kind of warning or notice about the presence of modified data.

How could I go about this? What encryption or signing facilities in C# could be useful? Is that even feasible or should I just don't care?

Answer 1

Look into RSACryptoServiceProvider: http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsacryptoserviceprovider.aspx

You can use it to generate an RSA keypair and sign a hash of the file with your private key. Then you can use your public key (stored in your executable) to verify the signature.

Answer 2

Fortunately, the System.IO.Packaging namespace includes support for digital signatures, which are part of the Open Packaging Conventions (OPC). See:

http://msdn.microsoft.com/en-us/library/system.io.packaging.package.aspx ? http://msdn.microsoft.com/en-us/library/aa905326.aspx

An OPC file is a ZIP file whose format conforms to the OPC specification. An OPC file can contain a digital signature.