CRV2 FrameworkSpecIssuesASPNetStrongAssembiles - Revision history

Johanna Curiel at 01:50, 2 December 2013

2013-12-02T01:50:37Z

2013-09-22T02:39:38Z

2013-07-01T02:03:05Z

2013-07-01T01:33:04Z

2013-07-01T01:30:07Z

2013-07-01T01:29:20Z

2013-07-01T01:24:53Z

2013-07-01T01:23:19Z

2013-07-01T01:18:40Z

2013-07-01T01:16:33Z

@@ Line 77: / Line 77: @@
 == Use Assembly attributes ==
-You can insert the strong name information in the code directly. For this, dependingon wherethe key file is located you can use AssemblyKeyFileAttribute or AssemblyKeyNameAttribute
+You can insert the strong name information in the code directly. For this, depending on wherethe key file is located you can use AssemblyKeyFileAttribute or AssemblyKeyNameAttribute
 == Use Compiler options :use /keyfile or /delaysign ==
 Safeguarding the key pair from developers is necessary to maintain and guarantee the integrity of the assemblies. The public key is should be accessible, but access to the private key is restricted to only a few individuals. When developing assemblies with strong names, each assembly that references the strong-named target assembly contains the token of the public key used to give the target assembly a strong name. This requires that the public key be available during the development process.
 You can use delayed or partial signing at build time to reserve space in the portable executable (PE) file for the strong name signature, but defer the actual signing until some later stage (typically just before shipping the assembly).
-You can use /keyfile or /delaysign in C# and VB.NET
+You can use /keyfile or /delaysign in C# and VB.NET (MSDN)
 == References ==
@@ Line 92: / Line 92: @@
 http://msdn.microsoft.com/en-us/library/t07a3dye(v=vs.80).aspx

@@ Line 1: / Line 1: @@
-=Strongly Named assemblies=
+=Overview Strongly Named assemblies=
-Creating Strongly Named Assemblies provides a unique identification to an assembly. A unique digital signature is specifically created for it. By default strongly names assemblies can only access other ones.
+Code review needs to be aware if strong naming is being used, benefits and what threat vectors strong naming helps prevent or understand the reasons for not using strong naming.
-== Signing tools==
+* Strong naming guarantees a unique name for that assembly.
 In order to create a Strongly name assembly there are a set of tools and steps that you need to follow

@@ Line 59: / Line 59: @@
 The following command creates an executable file t2a.exe with an assembly from the t2.netmodule module. The entry point is the Main method in MyClass.
   al t2.netmodule /target:exe /out:t2a.exe /main:MyClass.Main
 == References ==
@@ Line 66: / Line 74: @@
 http://msdn.microsoft.com/en-us/library/k5b5tt23(v=vs.80).aspx

← Older revision		Revision as of 01:33, 1 July 2013
Line 2:		Line 2:

	Creating Strongly Named Assemblies provides a unique identification to an assembly. A unique digital signature is specifically created for it. By default strongly names assemblies can only access other ones.		Creating Strongly Named Assemblies provides a unique identification to an assembly. A unique digital signature is specifically created for it. By default strongly names assemblies can only access other ones.
−	The strong name guarantee its uniqueness because it relies on unique key pairs. Furthermore, it provides a very strong integrity check.	+	The strong name guarantee its uniqueness because it relies on unique key pairs. Furthermore, it provides a very strong integrity check.(Solis, 2012)

@@ Line 52: / Line 52: @@
   al sources options
-Remarks
+====Remarks====
 All Visual Studio compilers produce assemblies. However, if you have one or more modules (metadata without a manifest), you can use Al.exe to create an assembly with the manifest in a separate file.
 To install assemblies in the cache, remove assemblies from the cache, or list the contents of the cache, use the Global Assembly Cache Tool (Gacutil.exe).
@@ Line 62: / Line 62: @@
 == References ==
 http://msdn.microsoft.com/en-us/library/wd40t7ad(v=vs.80).aspx
 http://msdn.microsoft.com/en-us/library/c405shex(v=vs.110).aspx
 http://msdn.microsoft.com/en-us/library/k5b5tt23(v=vs.80).aspx

← Older revision		Revision as of 01:29, 1 July 2013
Line 51:		Line 51:
	At the command prompt, type the following:		At the command prompt, type the following:
	al sources options		al sources options
		+
		+	Remarks
		+	All Visual Studio compilers produce assemblies. However, if you have one or more modules (metadata without a manifest), you can use Al.exe to create an assembly with the manifest in a separate file.
		+	To install assemblies in the cache, remove assemblies from the cache, or list the contents of the cache, use the Global Assembly Cache Tool (Gacutil.exe).
		+
		+
		+	The following command creates an executable file t2a.exe with an assembly from the t2.netmodule module. The entry point is the Main method in MyClass.
		+	al t2.netmodule /target:exe /out:t2a.exe /main:MyClass.Main
		+
		+	== References ==
		+	http://msdn.microsoft.com/en-us/library/wd40t7ad(v=vs.80).aspx
		+	http://msdn.microsoft.com/en-us/library/c405shex(v=vs.110).aspx
		+	http://msdn.microsoft.com/en-us/library/k5b5tt23(v=vs.80).aspx

← Older revision		Revision as of 01:24, 1 July 2013
Line 43:		Line 43:

	===Using the Assembly Linker(AI.exe)===		===Using the Assembly Linker(AI.exe)===
		+	This tool is automatically installed with Visual Studio and with the Windows SDK. To run the tool, we recommend that you use the Visual Studio Command Prompt or the Windows SDK Command Prompt (CMD Shell). These utilities enable you to run the tool easily, without navigating to the installation folder. For more information, see Visual Studio and Windows SDK Command Prompts.
		+
		+	If you have Visual Studio installed on your computer: On the taskbar, click Start, click All Programs, click Visual Studio, click Visual Studio Tools, and then click Visual Studio Command Prompt.
		+	-or-
		+	If you have the Windows SDK installed on your computer: On the taskbar, click Start, click All Programs, click the folder for the Windows SDK, and then click Command Prompt (or CMD Shell).
		+
		+	At the command prompt, type the following:
		+	al sources options

@@ Line 21: / Line 21: @@
 The Sign Tool is a command-line tool that digitally signs files, verifies signatures in files, or time stamps files.
 The Sign Tool is not supported on Microsoft Windows NT, Windows Me, Windows 98, or Windows 95.
 The following command creates a new, random key pair and stores it in keyPair.snk.

@@ Line 23: / Line 23: @@
 The following command creates a new, random key pair and stores it in keyPair.snk.
-sn -k keyPair.snk
+ sn -k keyPair.snk
 The following command stores the key in keyPair.snk in the container MyContainer in the strong name CSP.
-sn -i keyPair.snk MyContainer
+ sn -i keyPair.snk MyContainer
 The following command extracts the public key from keyPair.snk and stores it in publicKey.snk.
-sn -p keyPair.snk publicKey.snk
+ sn -p keyPair.snk publicKey.snk
 The following command displays the public key and the token for the public key contained in publicKey.snk.
-sn -tp publicKey.snk
+ sn -tp publicKey.snk
 The following command verifies the assembly MyAsm.dll.
-sn -v MyAsm.dll
+ sn -v MyAsm.dll
 The following command deletes MyContainer from the default CSP.
-sn -d MyContainer
+ sn -d MyContainer
-See Also
 ===Using the Assembly Linker(AI.exe)===