- [Instructor] Code signing provides a way
for developers to demonstrate to end users
that applications are from a legitimate source.
In my CISSP Security Engineering course
I covered how individuals may apply digital signatures
to data to provide nonrepudiation.
Anyone wishing to verify a digital signature
may do so by using the signer's digital certificate.
If you need a brief refresher on those concepts,
you might want to quickly review the Digital Signature
and Digital Certificate videos
from the Security Engineering course.
Digital signatures may also be used
for code signing.
Users may obtain software from a wide variety of sources.
It may be pre-installed on their computer
by their IT department,
they might download software from an app store
or find it on a website.
Code signing attempts to help users determine
whether code is legitimate.
Developers who wish to sign their code
obtain a digital certificate
from a trusted certificate authority.
They then use the private key associated
with that digital certificate
to create a digital signature
before releasing their code to the world.
When a user downloads the developer's code,
his or her operating system validates
the digital signature.
The operating system does this
by checking that the public key
in the developer's digital certificate
correctly decrypts the digital signature
and that the hash contained in the digital signature
matches the downloaded code.
That's the same process used
to validate any digital signature.
If the digital signature is legitimate,
the operating system then checks
whether it trusts the developer that signed the code.
Let's take a look at how this works on a Mac.
I have here a piece of code
that I've downloaded from the web,
a piece of software called Disk Inventory X.
I'm going to go and try to run this software
and as you can see,
I got an error message.
It says that Disk Inventory X can't be opened
because it is from an unidentified developer.
This means that the code
has not been signed
by a developer trusted by my operating system.
I'm going to go ahead and click OK.
And then I'm going to open up the System Preferences,
Security and Privacy section.
I'm going to click over to the General tab
and you can see down here it says Disk Inventory X
was blocked from opening
because it is not from an identified developer.
If I want to go ahead and override this,
I can click Open Anyway
and then it gives me one more warning
before I can click Open
and actually make use of the code.
Code signing provides developers
with a way to show the world
that code originated from them
and was not tampered with by malicious individuals.
Code signing also provides end users
with a way to determine what software they can trust.