Security Considerations for Code Signing

Published: January 26, 2018


David A. Cooper, Andrew R. Regenscheid, Murugiah P. Souppaya


A wide range of software products (also known as code)--including firmware, operating systems, mobile applications, and application container images--must be distributed and updated in a secure and automatic way to prevent forgery and tampering. Digitally signing code provides both data integrity to prove that the code was not modified, and source authentication to identify who signed the code. This paper describes features and architectural relationships of typical code signing solutions that are widely deployed today. It defines code signing use cases and identifies some security problems that can arise when applying code signing solutions to those use cases. Finally, it provides recommendations for avoiding those problems and resources for more information.
Citation: OTHER -
NIST Pub Series: Other
Pub Type: NIST Pubs


application container, code signing, digital signature, firmware, mobile application, operating system, software update
Created January 26, 2018, Updated November 10, 2018