Re: [Widgets] Signing

[Ed Voas]

We sign our files by simply tacking signing information on the end of the file. We can technically sign both zip files and our proprietary flat-file format with this system (though we don't generally advertise that you can sign zip files). Our signature format looks like this: 'sign' <sig length> <signature> <cert length> <certificate> <back pointer> 'sign' The <signature> is generated by using an SHA1 digest of the file (minus the signature) and the certificate. The digest is then signed with the given cert and the appropriate private key and converted to base64. The <certificate> is simply the cert in PEM format. The <back pointer> allows us to find the beginning of the block. So when we get a file in hand, we check the last four bytes to see if it's 'sign'. If so, we get the previous 4 bytes and walk back that amount. The data at that location should also be 'sign'. If so, we proceed to parse out the pieces based on the lengths specified. Once we have the cert and the signature, we can easily verify the signature. We also do a limited root cert check to verify authenticity. We do all of this using openssl. Michael(tm) Smith wrote: Ed Voas <[EMAIL PROTECTED]>, 2006-11-10 08:44 -0800: Just a note that I just read the part about a future draft of the spec including things on signing. We are already signing our Widgets, so if people want me to lay out our signature method here, please let me know. I'd defnitely like to hear the details. --Mike