3

When downloading executables from the Internet, I always check to see if they are digitally signed before I feel safe running them.

In Windows, when right-clicking a digitally-signed file and selecting Properties, a digital signature tab will be present in the Properties dialog.

What I'd like to know is: does Windows actually verify the digital signature when it is shown in the Properties dialog, or does it merely indicate that the file contains a digital signature that may or may not be valid?

2 Answers 2

4

On Windows 8.1 the properties display for the file only displays a list of digital signatures. You have to highlight a signature and click Details before Windows will tell you if the signature is valid or not.

I went to the expense and bother of getting a code signing certificate. The first thing I did was sign an executable and then modify the executable to simulate tampering. If you select properties for the tampered file all you see is a digital signature with no warning if it is valid or not.

Windows also allowed me to execute the application even though it has been tampered.

0
0

Windows comes with a certificate store that contains certificates from all the Trusted Root Certification Authorities (CAs). Windows can tell if one of these Authorities issued the certificate used to sign the executable by checking the signature against the certificates in the store.

So basically, the answer is yes, Window does ineed verify the digital signature. Note that it's up to the CA to make that the entity they sold the certificate to is who they claim to be. So when you trust the report that the executable comes from XYZZY software, you're doing so on the say-so of the CA.

1
  • 1
    Also be sure to hit Windows update for any CRL (Certificate Revocation List) updates in case one or more CAs have had their certificates compromised and needed to recall them.
    – Mark Allen
    Oct 28, 2012 at 5:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .