Home All Groups Group Topic Archive Search About

Verification of Assembly Strong Names

Author
13 Nov 2006 2:25 PM
Dan
currently i have program that loads .net assemblies using the Assembly.Load
method from the Assembly class. the assemblies have several plug ins classes
that i load. I want to make sure that the assembly that i am loading is one
made by me. (have been signed by me using my StrongName Key). how do i do
that? Code examples will be great.

Author
13 Nov 2006 4:46 PM
David Levine
Here's a routine that extracts the public key token from an assembly. You
can use this to extract the token from the assembly you loaded and then
compare that against the assembly that is executing, which is signed with
your company's strong name.

using System.Collections;
using System.Security;
using System.Security.Policy;
using System.Security.Permissions;
using System.Reflection;


  /// <summary>
  /// This gets the public key portion of the strong name for the assembly.
  /// Use the reflection APIs to extract the strong name
  /// from the executing assembly.
  /// </summary>
  /// <returns></returns>
  private StrongNamePublicKeyBlob GetStrongNamePublicKey (Assembly asm)
  {
   // this gets the dynamic value
   IEnumerator e = asm.Evidence.GetEnumerator();
   while ( e.MoveNext() )
   {
    if ( e.Current.GetType() == typeof(
System.Security.Policy.StrongName ) )
    {
     StrongName u = (StrongName)e.Current;
     Trace.WriteLine( string.Format("Name= {0}, {1}; PublicKey= {2}",
u.Name, u.Version, u.PublicKey) );
     return u.PublicKey;
    }
   } //while ( e.MoveNext() )
   throw new SecurityException( "Unable to extract public key strong name
from assembly." );
  }//  GetStrongName

use it like this...

  public Assembly LoadMyPlugin (string pluginName )
  {
   Assembly a = Assembly.Load(pluginName); // or some variant of Loadxxx
   StrongNamePublicKeyBlob me = GetStrongNamePublicKey(
Assembly.GetExecutingAssembly() ); //
   StrongNamePublicKeyBlob caller = GetStrongNamePublicKey( a );
   if ( !me.Equals( caller ) )
    throw new InvalidOperationException( "You are not allowed to call
me." ); // or throw a SecurityException
  return a;  // I wrote it...
  }



Show quote
"Dan" <D**@discussions.microsoft.com> wrote in message
news:7532B2CF-6748-4EE3-BB61-78028977A682@microsoft.com...
> currently i have program that loads .net assemblies using the
> Assembly.Load
> method from the Assembly class. the assemblies have several plug ins
> classes
> that i load. I want to make sure that the assembly that i am loading is
> one
> made by me. (have been signed by me using my StrongName Key). how do i do
> that? Code examples will be great.
Author
13 Nov 2006 8:52 PM
Dan
Wow that is what i am looking for. thank you very much.

Show quote
"David Levine" wrote:

> Here's a routine that extracts the public key token from an assembly. You
> can use this to extract the token from the assembly you loaded and then
> compare that against the assembly that is executing, which is signed with
> your company's strong name.
>
> using System.Collections;
> using System.Security;
> using System.Security.Policy;
> using System.Security.Permissions;
> using System.Reflection;
>
>
>   /// <summary>
>   /// This gets the public key portion of the strong name for the assembly.
>   /// Use the reflection APIs to extract the strong name
>   /// from the executing assembly.
>   /// </summary>
>   /// <returns></returns>
>   private StrongNamePublicKeyBlob GetStrongNamePublicKey (Assembly asm)
>   {
>    // this gets the dynamic value
>    IEnumerator e = asm.Evidence.GetEnumerator();
>    while ( e.MoveNext() )
>    {
>     if ( e.Current.GetType() == typeof(
> System.Security.Policy.StrongName ) )
>     {
>      StrongName u = (StrongName)e.Current;
>      Trace.WriteLine( string.Format("Name= {0}, {1}; PublicKey= {2}",
> u.Name, u.Version, u.PublicKey) );
>      return u.PublicKey;
>     }
>    } //while ( e.MoveNext() )
>    throw new SecurityException( "Unable to extract public key strong name
> from assembly." );
>   }//  GetStrongName
>
> use it like this...
>
>   public Assembly LoadMyPlugin (string pluginName )
>   {
>    Assembly a = Assembly.Load(pluginName); // or some variant of Loadxxx
>    StrongNamePublicKeyBlob me = GetStrongNamePublicKey(
> Assembly.GetExecutingAssembly() ); //
>    StrongNamePublicKeyBlob caller = GetStrongNamePublicKey( a );
>    if ( !me.Equals( caller ) )
>     throw new InvalidOperationException( "You are not allowed to call
> me." ); // or throw a SecurityException
>   return a;  // I wrote it...
>   }
>
>
>
> "Dan" <D**@discussions.microsoft.com> wrote in message
> news:7532B2CF-6748-4EE3-BB61-78028977A682@microsoft.com...
> > currently i have program that loads .net assemblies using the
> > Assembly.Load
> > method from the Assembly class. the assemblies have several plug ins
> > classes
> > that i load. I want to make sure that the assembly that i am loading is
> > one
> > made by me. (have been signed by me using my StrongName Key). how do i do
> > that? Code examples will be great.
>
>
>
>

AddThis Social Bookmark Button