Signing EXEs with SHA-256 and SHA-384: Recommended Nowadays?
In the past, build scripts may have saved multiple SHA hashes for EXEs without any issues. However, with the introduction of USB tokens and the latest versions of signtool, there seems to be a limitation in storing multiple SHA hashes for a single EXE. This article will cover the key concepts related to this topic, including the different types of SHA hashes and their importance in digital signatures.
What are SHA Hashes?
SHA stands for Secure Hash Algorithm, which is a set of cryptographic functions designed to keep data secure. These functions take an input (or a message) and return a fixed-size string of bytes, known as a hash value. There are several types of SHA hashes, including SHA-1, SHA-256, SHA-384, and SHA-512.
Why are SHA Hashes Important in Digital Signatures?
Digital signatures rely on SHA hashes to ensure data integrity and authenticity. When a file is signed, a hash value is calculated based on the contents of the file at that specific moment. This hash value is then encrypted with the signer's private key, forming the digital signature. When the file is opened, the recipient can use the signer's public key to decrypt the digital signature, revealing the original hash value. The recipient's system will then calculate a new hash value based on the file's contents at that moment.
If both hash values match, it indicates that the file's contents have not been tampered with since it was signed. If the hash values do not match, it indicates that the file's contents have been altered or corrupted.
Different Types of SHA Hashes
There are several types of SHA hashes, each with a different output size. Here are some of the most commonly used SHA hashes:
SHA-1: Output size of 160 bits (20 bytes)SHA-256: Output size of 256 bits (32 bytes)SHA-384: Output size of 384 bits (48 bytes)SHA-512: Output size of 512 bits (64 bytes)
While SHA-1 was once widely used for digital signatures, it has since been found to have several vulnerabilities and is no longer considered secure. As a result, many organizations have moved towards using SHA-256 or SHA-384 instead.
Signing EXEs with Multiple SHA Hashes
In the past, it was possible to save multiple SHA hashes for a single EXE using build scripts. However, with the introduction of USB tokens and the latest versions of signtool, it seems that only one SHA hash can be stored per EXE.
This may present a challenge for organizations that want to support both legacy systems that require SHA-1 and newer systems that require SHA-256 or SHA-384. One possible solution is to create separate builds for each SHA hash, depending on the target system.
Recommendations
Given the vulnerabilities found in SHA-1, it is recommended to use either SHA-256 or SHA-384 for digital signatures. Newer versions of signtool may only support storing a single SHA hash per EXE, but separate builds can be created for each target system.
- SHA stands for Secure Hash Algorithm, which is a set of cryptographic functions designed to keep data secure.
- Different types of SHA hashes include SHA-1, SHA-256, SHA-384, and SHA-512, each with a different output size.
- SHA-1 has several vulnerabilities and is no longer considered secure.
- Newer versions of signtool may only support storing a single SHA hash per EXE, but separate builds can be created for each target system.
- It is recommended to use either SHA-256 or SHA-384 for digital signatures.