Validation of strong names only uses public key token?

Question

I did the following experience:

• Created a console application and a dll
• Created a strong name key file
• Extracted the public key from the strong name key file
• Delay signed both console and dll applications with the public key
• (1) Console application called the dll successfully
• Signed console application with strong name key file (private key included)
• (2) Console application called the dll successfully

Now, in (1) I assume thats the correct behaviour because the signatures from both files should be the same, empty, but in the situation (2), the public token should be the same, but the signatures should be diferent, in the console application the signature should be filled and in the dll empty, so the console application shouldn't be able to call the dll.

This leads me to believe that the strong name validations only uses the public key token, is this true?

Answer 1

The strong name of a delayed and fully signed assembly are identical if the same public key is used.

This is why you do not need to modify (by rebuilding) the reference in the exe after fully signing the dll.

The delayed signed assembly will however not contain the signature proving it was signed with the private key (for a good reason: it wasn't signed with the private key).

This signature is not part of the full name so the assembly will still match the full name of the fully signed assembly.

The default behavior is to reject loading an assembly if it is delayed signed. Not because it's full name is not matching but because the assembly fails the signature validation.

If you have used sn.exe to turn off signature verification the dll strong name will be accepted without checking for a matching signature. This will be the case no matter if the exe calling the dll is fully signed or not.

If you have not used sn.exe to turn off validation I would expect the exe will not run at all.

If you have used sn.exe to turn off validation for all assemblies using the public key I would expect the exe to run and call the dll without problems. This is done by using:

sn.exe -Vr *,<publicKeyToken>

If you have used sn.exe to turn off validation for the exe only while leaving validation active for the dll I would expect the exe to run but fail when attempting to call the dll. This is done using:

sn.exe -Vr <dllAssemblyName>,<publicKeyToken>

To ensure not assembly validation is skipped, use:

sn.exe -Vx

or use

sn.exe -Vu <dllAssemblyName>,<publicKeyToken>

to selectively turn on validation using the same syntax as with -Vr.

There is both a 32 bit and 64 bit sn.exe. They affect 32 and 64 bit processes respectively. I would recommend always running the sn.exe commands in both to avoid surprises.