What parts of an assembly does the strong name signing verify

Question

It is my understanding that strong name signing an assembly uses some kind of hash of the assembly contents, and signs it so that if the assembly is changed after the signing then it shouldn't work anymore. However I just created a small utility to add extra win32 resources to an app after its built, and as far as I can tell it doesn't cause the strong name signed assembly to stop functioning at all.

I created a small test app, which just outputs its assembly name, strong name signed it and then added extra icons to it. Below is the program:

class Program
{
    static void Main(string[] args)
    {
        Console.WriteLine("My name is " + Assembly.GetExecutingAssembly().GetName());
    }
}

After I modify the assembly I can still run it, and it prints out its assembly name with my public key token with no problems:

My name is TestApp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=cd4a03be895200fa

Now, my question is, does the strong name signing only check some parts of the assembly, i.e. does it not hash the win32 resources, or am I completely misunderstanding how strong name signing works? If my assembly has been changed after signing, shouldn't it stop working?

Alexey Raga Alexey Raga · Accepted Answer · 2012-02-10T07:46:54

A strong name consists of the assembly's identity—its simple text name, version number, and culture information (if provided)—plus a public key and a digital signature. It is generated from an assembly file (the file that contains the assembly manifest, which in turn contains the names and hashes of all the files that make up the assembly), using the corresponding private key.

From Strong Named Assemblies documentation

So if you sign your assembly with the same key and if you don't change its name, version number and culture it will be loaded without any problems.

Hashes are used to prevent the assembly file from being modified, so if you modify a compiled dll (using, let's say, HEX editor) it won't be loaded (as hash will not match). But as soon as hashes match and the assembly has a correct signature - it has a green light.

What parts of an assembly does the strong name signing verify

1 Answers