AuthentiCode

Authenticode is a Microsoft technology for digitally signing software to verify its origin and integrity on Windows. It uses standard X.509 public-key cryptography and PKCS #7 (CMS) signatures. A code signing certificate, issued by a trusted certificate authority, signs the executable or installer, producing a PKCS#7 signature that is embedded in the PE file’s signature block. The signature can include the certificate chain up to a trusted root and an optional RFC 3161 timestamp.

Verification of an Authenticode signature is supported by Windows tools such as SignTool and the WinVerifyTrust API. During verification, the certificate chain is checked against trusted roots, the certificate’s validity period is confirmed, and revocation status is checked via OCSP or CRL when available. If a timestamp is present, the signature is considered valid even after the signing certificate expires, provided the signing event occurred when the certificate was valid. If the file is modified after signing, the signature no longer matches and verification fails.

Authenticode signatures are commonly used on Windows executables, dynamic-link libraries, drivers, installers, and other packaged software to help users and systems identify publishers and ensure content has not been tampered with since signing. They also influence trust decisions in Windows components like SmartScreen.

Security and limitations: while a valid Authenticode signature provides assurance about origin and integrity, it does not guarantee safety or malicious-free software. The trust depends on the signer’s certificate, the integrity of the signing process, and timely revocation checks, which may be hindered by certificate revocation challenges.