CHAPTER 10 NAMESPACES AND ASSEMBLIES

Strongly Named Assemblies

A strongly named assembly is one that has a unique digital signature attached to it. Strongly named assemblies are much more secure than assemblies that do not have strong names, for the following reasons:

•A strong name uniquely identifies an assembly. No one else can create an assembly with the same strong name, so the user can be sure that the assembly came from the claimed source.

•The contents of an assembly with a strong name cannot be altered without the security components of the CLR catching the modification.

A weakly named assembly is one that is not strongly named. Since a weakly named assembly does not have a digital signature, it is inherently insecure. Because a chain is only as strong as its weakest link, by default, strongly named assemblies can only access other strongly named assemblies. (There’s also a way to allow “partially trusted callers,” but I won’t be covering that topic.)

The programmer does not produce the strong name. The compiler produces it by taking information about the assembly and hashing it to create a unique digital signature that it attaches to the assembly. The pieces of information it uses in the hash process are the following:

•The sequence of bytes composing the assembly

•The simple name

•The version number

•The culture information

•The public/private key pair

Note There is some diversity in the nomenclature surrounding strong names. What I’m calling “strongly named” is often referred to as “strong-named.” What I’m calling “weakly named” is sometimes referred to as “not strong-named” or “assembly with a simple name.”

289

CHAPTER 10 NAMESPACES AND ASSEMBLIES

Creating a Strongly Named Assembly

To strongly name an assembly using Visual Studio 2010, you must have a copy of the public/private key pair file. If you don’t have a key file, you can have Visual Studio generate one for you. You can then do the following:

1.Open the properties of the project.

2.Select the Signing tab.

3.Select the Sign the Assembly check box, and enter the location of the key file or create a new one.

When you compile the code, the compiler will produce a strongly named assembly. Figure 10-17 illustrates the inputs and output of the compiler.

Figure 10-17. Creating a strongly named assembly

290