Talk about understanding elements of code signing on iOS and OSX.
It shows different file formats and open standards used for signatures, and some common usage.
September 27, 2017 | MARIN USALJ Like a signature written with ink on paper, a digital signature can be used to identify and authenticate the signer. However, a digital signature is more difficult to forge, and goes one step further: it can ensure that the signed data has not been altered. APPLE.COM
September 27, 2017 | MARIN USALJ Apple Benefits All the mentioned customer benefits Makes it impossible for programs to download and run more software No competition for the App Store™ (iOS only)
September 27, 2017 | MARIN USALJ Code Signing on Apple platforms Open source tools in combination with Apple's proprietary ones Relies on public-key cryptography based on the X.509 standard (like TLS/SSL) Keychain Access utility manages the X.509 infrastructure on OSX
September 27, 2017 | MARIN USALJ CSR In Public Key Infrastructure systems, message sent from an applicant to a Certificate Authority in order to apply for a digital identity certificate.
September 27, 2017 | MARIN USALJ Key Pair RSA (2048 bit) Public key: Embedded in CSRs, certificates, shared Private key: Used for actual signing. Should not be shared
September 27, 2017 | MARIN USALJ Key Pair Creating CSRs / certs on several Macs can be a problem Certificate you generate on one machine WILL NOT be usable for code signing on a machine that does not have that private key Forgetting this is a great way to waste hours and get angry
September 27, 2017 | MARIN USALJ Certificate Broadly - A public key combined with additional information, Signed by Certificate Authority (CA) stating that the information in the certificate is correct.
September 27, 2017 | MARIN USALJ Certificate It's a guarantee that: - you, the named developer, built this code - you are a member of the developer program - Apple has issued you a certificate to do so
September 27, 2017 | MARIN USALJ PKCS #12 Archive file format for storing many cryptography objects as a single file Commonly used to bundle a private key with its X.509 certificate, or to bundle all the members of a chain of trust
September 27, 2017 | MARIN USALJ PKCS #12 PKCS #12 file may be encrypted and signed Internal storage containers are called SafeBags, may also be encrypted and signed
September 27, 2017 | MARIN USALJ Team ID Each dev account has a unique identifier You might have an enterprise and a production account with Apple: - Team Rocket = BHKW85A12H - Team Rocket (Ent) = A8WFE5231P
September 27, 2017 | MARIN USALJ Bundle ID Each app should have it's own bundle ID in a reverse DNS format Beta: com.yolo.ios.beta AppStore: com.yolo.ios
September 27, 2017 | MARIN USALJ Device IDs Each iOS device has a unique identifier Used in provisioning profiles for whitelisting (much wow. very device)
September 27, 2017 | MARIN USALJ Entitlements Which system resources an app is allowed to use, and under what conditions. Each entitlement has a default value, which in most cases disables the capability associated with the entitlement.
September 27, 2017 | MARIN USALJ Provisioning Profiles When put together all these objects combine so that: - This unique app (App ID) - Can run on this restricted set of devices (UDIDs) - With a set of permssions (Entitlements) - With trust based on the signed Certificate.
September 27, 2017 | MARIN USALJ Signing Code After building is done, signing is performed All the individual components of the app are signed Signing all sorts of code, including tools, applications, scripts, libraries, plug-ins, ...
September 27, 2017 | MARIN USALJ Seal Code signature consists of three parts: - A seal - A digital signature - Code requirements abc1234 badf00d asd23f
September 27, 2017 | MARIN USALJ Signing Code Code signature consists of three parts: - A seal - A digital signature - Code requirements abc1234 badf00d asd23f + --------->
September 27, 2017 | MARIN USALJ Signature Signed code may contain several different digital signatures If the code is universal, the object code for each slice (arch) is signed separately. This signature is stored within the binary file itself
September 27, 2017 | MARIN USALJ Signature Various data components signed in _CodeSignature/CodeResources - Bundle contents (e.g. Info.plist, sounds, images) - Nested code, libraries, tools
September 27, 2017 | MARIN USALJ Verifying Verifying software computes the same set of hashes across the various blocks of code and data Public key from cert used to decrypt hashes -> original hashes If the two hashes match, the signature is valid
September 27, 2017 | MARIN USALJ $ codesign -vvvv Lyft.app Lyft.app: valid on disk Lyft.app: satisfies its Designated Requirement $ echo "wat" >> Lyft.app/yolo # adding a random file $ codesign -vvvv Lyft.app Lyft.app: a sealed resource is missing or invalid file added: /Users/marinusalj/Downloads/Payload/ Lyft.app/yolo
September 27, 2017 | MARIN USALJ $ codesign -vvvv Lyft.app Lyft.app: valid on disk Lyft.app: satisfies its Designated Requirement $ echo "wat" >> Lyft.app/yolo # adding a random file $ codesign -vvvv Lyft.app Lyft.app: a sealed resource is missing or invalid file added: /Users/marinusalj/Downloads/Payload/ Lyft.app/yolo
September 27, 2017 | MARIN USALJ tl;dr; Always know which machine generated the PKs Store certs with keys encrypted in .p12 files Private key is needed for signing!
September 27, 2017 | MARIN USALJ tl;dr; Codesign is deterministic, xcodebuild phones home Unpack .p12 yourself on CI instead of relying on developer.apple.com Try debugging systematically step by step instead of brute forcing
supermarin
matleenalaakso
kaityo256
gnutar
hirokiyamazaki
signer
komagata
cbtlibrary
wagnerst
shpigford
phodgson
cromwellryan
jnunemaker
rocio
marktimemedia
bermonpainter
jakevdp
shlominoach
samanthasiow
eileencodes
cassininazir