R – Do I need to publish the public key from .snk file

assembliesnetstrongname

From the description of sn.exe utility and this question I see that a copy of the public key is added to every assembly signed with the strong name. This is enough to validate that the assembly binary has not been altered.

But how does one verify that given assembly was really signed with some given keypair and compiled by a given company? Anyone could generate his own keypair, produce some assembly and sign it with his keypair. Do I need to publish the public key so that those who want to verify the assembly origin could compare the public keys? if so, what is the best way to do so?

Best Answer

No, you don't need to publish your public key outside of the assembly since it is hashed and stored as a token alongside the reference inside the client's application:

AssemblyName, Version=1.0.0.0, Culture=neutral, PublicKeyToken=bcd6707151635d07"

This gives a method to ensure that all future versions of the assembly are compiled against the same key pair and therefore from the same publisher.

More details about how having this information stops another source from pretending to be you can be found in my other answer.

Related Topic