Can someone put my mind at rest and see if this setup will verify that a file has come from me. An idea of how secure this is would be great and any potential attack vectors.
- Create a public and private key with DSACryptoServiceProvider.
- Add public key as application resource
- Create an update
- Get dsa hash of update using private key
- Send hash and update to application(Presume these can be intercepted/changed)
- Verify hash is correct using public key.
- If verified apply update
The update is an exe and will be executed so I want to make sure it's not executed if someone replaces or tampers with it.
EDIT: Updated point 6 as the public key doesn't actually generate a hash, just verifies it. I think it's this part I'm struggling with the security of.
DSACryptoServiceProvider
will take care of all these details in exactly the way you've commented, but I think Adam's point is that the private key itself is not used to generate the hash.