Lesson 2.8: Signing software releases
Cryptography 101 verified downloads with checksums. A checksum only proves a file matches the checksum next to it: an attacker who can replace the file on a mirror can usually replace the checksum file too. A digital signature closes that gap, because only the holder of the private key can make one. In the lab you see a tampered mirror pass its own checksum, sign Northwind's agent release, publish the public key and its fingerprint, and watch verification reject the tampered copy.
16 min
You will learn to
- Explain why checksums alone don't prove authenticity
- Sign a file with openssl dgst -sign
- Publish a public key and its fingerprint
- Verify a signature
- Explain key protection for signing keys
Key terms
- Digital signature
- A value made with a private key over a digest; anyone with the public key can verify it.
- Checksum vs signature
- A checksum proves integrity against a reference; a signature also proves who made it.
- Fingerprint
- A short hash of a public key, published so people can check they have the right key.
- HSM
- Hardware security module: signs inside tamper-resistant hardware; the key can't be copied out.
- Sigstore / cosign
- Open tooling for signing artefacts with short-lived keys and a public transparency log.
← Hash functions · All lessons · Mass exploitation: the MOVEit Transfer campaign →