Code Signing

---

Code signing is the method of using a digital signature to to verify the integrity and authenticity of software code.

• serves a dual purpose:
  • ensuring that software has not been tampered with since signing
  • confirming the software publisher’s identity
• How it works:
  • signer uses a private key to encrypt a hash or digest of the code
    • this encrypted hash and the signer’s identity form the digital signature
  • requires using a certificate issued by a trusted certificate authority (CA)
    • certificate contains information about the signer’s identity
    • is critical for verifying the digital signature
  • if the certificate is valid and issued by a trusted CA,
    • the software publisher’s identity can be confidently verified
• does not inherently assure the safety or security of the code itself
  • certifies the source and integrity of the code
  • but it doesn’t evaluate the quality or security of the code