C#: why sign an assembly?

user_325801 0
Viewed 62589

In some C# code I have taken over (in Visual Studio 2005), I have noticed that the assemblies are all signed with the same .snk file.

  • Why would the previous author have signed the assemblies in this way?
  • Is signing assemblies necessary and what would be wrong with not signing?
  • What disadvantages are there in signing assemblies - does it cause delays?
assemblies c#
7 Answers

If you would excuse me for answering an old question. But most of the responses here imply that strong-naming provides security. But Microsoft advises against using it for security.

The docs on strong name signing currently says:

⚠ Warning

Do not rely on strong names for security. They provide a unique identity only.

It is mostly useful for ensuring that you have the binary you expected, and not a different binary that incidentally has the same name and version (or version set by binding redirect)

Microsoft lists reasons for using strong-naming:

  • You want to enable your assemblies to be referenced by strong-named assemblies, or you want to give friend access to your assemblies from other strong-named assemblies.
  • An app needs access to different versions of the same assembly. This means you need different versions of an assembly to load side by side in the same app domain without conflict. For example, if different extensions of an API exist in assemblies that have the same simple name, strong-naming provides a unique identity for each version of the assembly.
  • You do not want to negatively affect performance of apps using your assembly, so you want the assembly to be domain neutral. This requires strong-naming because a domain-neutral assembly must be installed in the global assembly cache.
  • You want to centralize servicing for your app by applying publisher policy, which means the assembly must be installed in the global assembly cache.

It also notes:

For .NET Core, strong-named assemblies do not provide material benefits.

and

If you are an open-source developer and you want the identity benefits of a strong-named assembly for better compatibility with .NET Framework, consider checking in the private key associated with an assembly to your source control system.

So, Microsoft says it's okay to just publish your strong-naming private key along with code. Meaning anyone could create strong-named assemblies with the correct public key. I would it say it is safe to assume that strong-naming is not a secure source of Authenticity.

Read more about it here: https://docs.microsoft.com/en-us/dotnet/standard/assembly/strong-named

user_20204750

In addition to existing answers, I would add that you must use the signing when your DLL is going to be dynamically loaded and consumed by 3rd party software. It is not technical requirement per se but it is rational, therefore very common, that the 3rd party software producer enforces such policy due security concerns.

Examples where you must sign an assembly:

  • development of Windows Shell / Windows Explorer extension, like: context menu extension for Windows Explorer
  • development of Visual Studio extensions, like: Project/Item Template Wizard GUI
user_40341920

Signing and assembly is important. In order to ensure that exe or assembly that is installed on that PC only.

Ie: if you copy that folder and put into another PC it does not work. since it is signing that assembly in to that machine only.

user_112107080
Related