Improving Web Application Security: Threats and - CGISecurity

156 Part III: Building Secure Web ApplicationsSecurity Benefits of Strong NamesStrong names provide a number of security advantages in addition to versioningbenefits:● Strong named assemblies are signed with a digital signature. This protects theassembly from modification. Any tampering causes the verification process thatoccurs at assembly load time to fail. An exception is generated and the assembly isnot loaded.● Strong named assemblies cannot be called by partially trusted code, unless youspecifically add AllowPartiallyTrustedCallersAttribute (APTCA.)Note If you do use APTCA, make sure you read Chapter 8, “Code Access Security in Practice,”for additional guidelines to further improve the security of your assemblies.●Strong names provide cryptographically strong evidence for code access securitypolicy evaluation. This allows administrators to grant permissions to specificassemblies. It also allows developers to use a StrongNameIdentityPermission torestrict which code can call a public member or derive from a non-sealed class.Using Strong NamesThe .NET Framework includes the Sn.exe utility to help you strong name assemblies.You do not need an X.509 certificate to add a strong name to an assembly. To strong name an assembly1. Generate the key file in the assembly’s project directory by using the followingcommand.sn.exe -k keypair.snk2. Add an AssemblyKeyFile attribute to Assemblyinfo.cs to reference the generatedkey file, as shown in the following code sample.// The keypair file is usually placed in the project directory[assembly: AssemblyKeyFile(@"..\..\keypair.snk")]