up vote 0 down vote favorite
share [g+] share [fb]

Consider a software publisher that provides EXE installers for their software and that those installers contain an embedded signature which allows you to verify that the file you downloaded is the same as the file they published. Also consider that the software in question is a Java application and they provide a platform-independent ZIP archive that can simply be extracted and run - without the need to run an installer.

Why is it that many publishers provide signed EXE files, but do not provide any authentication mechanism for ZIP archives of the same software?

Take this question for example.

Couldn't they publish a detached signature file made with the same certificate used to sign the EXE installer? Or, is there a way to embed a signature into a ZIP file in the same manner used for EXEs?

link|improve this question
Because they're lazy. Also, verifying detached signatures with openssl is a relatively complex task... heck, I don't even know how to create such signatures. (PGP is much easier by itself, but it introduces additional complexity in this case since the publisher has to have two certificates with entirely unrelated trust systems.) – grawity Sep 20 '11 at 15:46
@grawity Could the publisher create a PGP key pair and have their public key signed by the same CA that signed their certificate used to sign the EXE? – SlaY3R Sep 20 '11 at 16:23
@SlaY3R: That would cost money, I believe. – surfasb Sep 20 '11 at 16:32
@SlaY3R: PGP certificates normally cannot be signed by X.509 certificates, or vice versa. They use entirely separate trust models. – grawity Sep 20 '11 at 16:36
@grawity Fair enough. It just seems quite silly to go to the trouble of signing EXEs but do nothing to ensure the authenticity of software distributed in ZIP archives. – SlaY3R Sep 20 '11 at 16:42
show 1 more comment
feedback

closed as not constructive by Linker3000, slhck, Gareth, Nifle, studiohack♦ Sep 30 '11 at 2:44

This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.

Browse other questions tagged or ask your own question.