4 ms·

I'm pretty sure Microsoft does sign updates. Which means either this is a glitch of some kind, or is being refused/failing installation because it's not signed

I'm pretty sure Microsoft does sign updates. Which means either this is a glitch of some kind, or is being refused/failing installation because it's not signed ... Or, worse case, it means the update signing key has been compromised.

zappo2938 11y ago
What does 'sign' mean in this context? I hear it a lot and don't understand the mechanism.
- vutekst 11y ago
  https://en.wikipedia.org/wiki/Digital_signature https://en.wikipedia.org/wiki/Digital_signature
- SeldomSoup 11y ago
  It's a cryptographic mechanism. MS has a private key they apply to each Windows update to mathematically prove A) they're the ones who issued it and B) the content was not modified in transit. (I am not experienced in cryptography. This explanation might be a little simplistic.)
- mavrc 11y ago
  It refers to the idea that most asymmetric cryptosystems (which, generally speaking means that each user has a public key and a private key) allow for a user to create a 'signature' using their private key, which can be verified using their public key. See here: http://stackoverflow.com/questions/454048/what-is-the-difference-between-encrypting-and-signing-in-asymmetric-encryption http://stackoverflow.com/questions/454048/what-is-the-differ...
  - deleted 11y ago
    [deleted]
- pyre 11y ago
  Think of it as a SHA-1 or an MD5 that is generated using a private key, and can be verified using the public key (and the content of the data that was signed). It verifies that the signer had access to the private key, and that the data signed by the private key is the same data that you are verifying with the public key. It's like the other checksums (SHA-1/MD5/etc) with the addition of identity verification (so long as you can trust that the private-public keypair used to sign it is only accessible to parties you trust).
- barkingcat 11y ago
  It means generating a signature of the binaries being installed, and having this signature be authenticated by Microsoft (using their signing key). The signature is distributed alongside the binaries. I'm not certain if the Windows Update system uses the same Autheticode system used for application binaries, but you can start reading here: https://msdn.microsoft.com/en-us/library/ms537361%28v=vs.85%29.aspx https://msdn.microsoft.com/en-us/library/ms537361%28v=vs.85%...
politician 11y ago
> it means the update signing key has been compromised. The odds that parties outside of Microsoft have access to their update signing key is actually seems pretty likely given the Snowden revelations. Consider the Stuxnet distribution strategy -- what a boon it'd be to be able to deploy that sort of machine-specific payload via the built-in update kit.

zappo2938 11y ago

What does 'sign' mean in this context? I hear it a lot and don't understand the mechanism.

vutekst 11y ago
https://en.wikipedia.org/wiki/Digital_signature https://en.wikipedia.org/wiki/Digital_signature
SeldomSoup 11y ago
It's a cryptographic mechanism. MS has a private key they apply to each Windows update to mathematically prove A) they're the ones who issued it and B) the content was not modified in transit. (I am not experienced in cryptography. This explanation might be a little simplistic.)
mavrc 11y ago
It refers to the idea that most asymmetric cryptosystems (which, generally speaking means that each user has a public key and a private key) allow for a user to create a 'signature' using their private key, which can be verified using their public key. See here: http://stackoverflow.com/questions/454048/what-is-the-difference-between-encrypting-and-signing-in-asymmetric-encryption http://stackoverflow.com/questions/454048/what-is-the-differ...
- deleted 11y ago
  [deleted]
pyre 11y ago
Think of it as a SHA-1 or an MD5 that is generated using a private key, and can be verified using the public key (and the content of the data that was signed). It verifies that the signer had access to the private key, and that the data signed by the private key is the same data that you are verifying with the public key. It's like the other checksums (SHA-1/MD5/etc) with the addition of identity verification (so long as you can trust that the private-public keypair used to sign it is only accessible to parties you trust).
barkingcat 11y ago
It means generating a signature of the binaries being installed, and having this signature be authenticated by Microsoft (using their signing key). The signature is distributed alongside the binaries. I'm not certain if the Windows Update system uses the same Autheticode system used for application binaries, but you can start reading here: https://msdn.microsoft.com/en-us/library/ms537361%28v=vs.85%29.aspx https://msdn.microsoft.com/en-us/library/ms537361%28v=vs.85%...

politician 11y ago

> it means the update signing key has been compromised. The odds that parties outside of Microsoft have access to their update signing key is actually seems pretty likely given the Snowden revelations. Consider the Stuxnet distribution strategy -- what a boon it'd be to be able to deploy that sort of machine-specific payload via the built-in update kit.