![]() |
![]() |
Microsoft Game Technology Group
December 2005
Data authentication is increasingly important for game developers. Windows Vista has a number of features, such as parental controls, that require games to be properly signed to ensure that no has tampered with the data. Microsoft Authenticode enables end users and the operating system to verify that program code comes from the rightful owner and that it hasn't been maliciously altered or accidentally corrupted. This article discusses how to get started with authenticating your game and how to integrate authentication into a daily build process.
Digital certificates are used to establish the identity of the author. Digital certificates are issued by a trusted third party known as a Certificate Authority (CA) such as VeriSign or Thawte. The CA is responsible for verifying that owner is not claiming a false identify. After applying to a CA for a certificate, commercial developers can expect a response to their application in less than two weeks.
After the CA decides that you meet its policy criteria, it generates a Code-Signing Certificate (CER) that conforms to X.509, the industry-standard certificate format created by the International Telecommunications Union, with Version 3 extensions. This certificate identifies you and contains your public key. It is stored by the CA for reference, and a copy is given to you electronically. At the same time, you also create a private, key which you must keep safe and which you must not share with anyone, even the CA.
After you have a public and private key, you can then begin distributing signed software. Microsoft provides tools to do this in the Platform SDK. The tools utilize a one-way hash, produce a fixed-length digest, and generate an encrypted signature with a private key. They then combine that encrypted signature with your certificate and credentials into a structure known as a signature block and embed it into the file format of the executable. Any type of executable binary file can be signed, including DLLs, executable files, and cabinet files.
The signature can be verified in multiple ways. Programs can call the CertVerifyCertificateChainPolicy function, and SignTool (signtool.exe) can be used to verify a signature from the command-line prompt. Windows Explorer also has a Digital Signatures tab in File Properties that displays each certificate of a signed binary file. (The Digital Signatures tab will only appear in the File Properties of signed files.) Also, an application can be self-verifying by use of the CertVerifyCertificateChainPolicy API.
Authenticode signing is not only useful for data authentication by end users, but is also needed for Limited User Account Patching and by Windows Vista's parental controls. Future technologies in Windows may also require signed code, so it is strongly advised that all professional and amateur developers acquire a CER from a CA. More information on how this is done can be found later in this article in Using a Trusted Certificate Authority.
To get started, Microsoft provides tools with Visual Studio 2005 and in the Platform SDK to help perform and verify the code-signing process. After installing Visual Studio 2005 or the Platform SDK, these tools are in one of the following subdirectories, respectively:
The following tools are the most useful for signing code:
Note While reading other documentation, you might find references to SignCode (SignCode.exe), but this tool is deprecated and is no longer supported — you should use SignTool instead.
To obtain a trusted certificate, you must apply to a Certificate Authority (CA), such as VeriSign or Thawte. Microsoft doesn't recommend any CA over another, but if you want to integrate into the Windows Error Reporting (WER) service, you should consider using VeriSign to issue the certificate because accessing the WER database requires a WinQual account which requires a VeriSign ID. For a complete list of trusted third-party certificate authorities, see Microsoft Root Certificate Program Members on MSDN. For more information about registering with WER, see "Introducing Windows Error Reporting" in ISV Zone, also on MSDN.
After you receive your certificate from the CA, you can sign your program by using SignTool and release your program to the public. However, you must be careful to protect your private key, which is contained in your PFX and PVK files. Be sure to keep these files in a secure location.
The following steps demonstrate creation of a test Code-Signing certificate, followed by the signing of a Direct3D sample program (called BasicHLSL.exe) using this test certificate. This procedure creates a CER and PVK — your public and private keys, respectively — which cannot be used for public certification.
In this example, a time stamp is also added to the signature. A time stamp prevents the signature from becoming invalid when the certificate expires. Code that is signed but lacking a time stamp will not validate after the certificate expires. Therefore, all publicly released code should have a time stamp.
To create a certificate and sign a program
The following command-line example specifies MyPrivateKey as the file name for the PVK, MyPublicKey as the file name for the CER, and MySoftwareCompany as the name of the certificate:
makecert.exe -sv MyPrivateKey.pvk -n "CN=MySoftwareCompany" MyPublicKey.cer
The PFX file combines your public and private keys into a single file. The following command-line example uses the PVK and CER from the previous step to create the PFX in a file named MyPFX with the password your_password:
pvk2pfx.exe -pvk MyPrivateKey.pvk -spc MyPublicKey.cer -pfx MyPFX.pfx -po your_password
You can specify several options on the command line. The following command-line example uses the PFX file from the previous step, gives your_password as the password, specifies BasicHLSL as the file to be signed, and retrieves a time stamp from a specified server:
signtool.exe sign /f MyPFX.pfx /p your_password /v BasicHLSL.exe /t URL_to_time_stamp_service
Note The URL to the time stamp service is provided by the CA.
The following command-line example specifies that SignTool should attempt to verify the signature on BasickHLSL.exe by using all available methods while providing verbose output:
signtool.exe verify /a /v BasicHLSL.exe
In this example, SignTool should indicate that the certificate is attached, while also stating that it is not trusted, since it is not issued by a CA.
To integrate code signing into a project, you can create a batch file or script to run the command line tools. After the project is built, run SignTool with the proper settings (as shown in step 3 of our example).
Be especially cautious in your build process to insure that access to the PFX and PVK files is restricted to as few computers and users as possible. As a best practice, developers should only sign code with the test certificate until they are ready to ship. Again, the private key should be kept in a secured location, like a safe or locked room, and ideally on a cryptographic device, like a smart card.
Another layer of protection is provided by using Microsoft Authenticode to sign the Windows Installer (MSI) package itself. This helps protect the MSI package against tampering and accidental corruption. Refer to the documentation for your MSI creation tool for more information about how to sign packages with Authenticode.
In the event that the security of the private key is compromised or some security-related event renders a Code-Signing certificate invalid, the developer must revoke the certificate. Not doing so would weaken the integrity of the developer and the effectiveness of signing code. A CA can also issue a revocation with specific time; code signed with a time stamp prior to the revocation time will still be considered valid, but code with a subsequent time stamp will be invalid. Certificate revocation affects code in any applications that is signed with the revocated certificate.
Using Microsoft Authenticode is a straightforward process. Once you have obtained a CER and created a private key, it is a simple matter of using the tools provided by Microsoft. You can then enable important Windows Vista features, such as parental controls, and let customers know that your product comes directly from its rightful owner.
More information about tools and processes related to signing code, see the following links:
Authenticode Overview and Turtorials