Networks

<p align="justify">Code signing is a method that utilizes Public Key Infrastructure (PKI) technology to create a digital signature founded on a private key, the contents of a program file, and signed packages. It is necessary that a user keeps his private key secretly otherwise any person with a private key can create software acting to be a legitimate software. <a rel="nofollow" href="en.wikipedia.org/wiki/Code_signing">Code Signing Certificate</a> is specially designed for folks who are programmers and software developers with a view to provide identity authentication and a check sum to verify that the object is not altered during the download. When people purchase a software package, direct from the marketplace they obviously get safety about installation and its usage. They get the real published software and can check the software is well boxed up or not. In contrast this when user download software from the internet there might be chances of malicious software download which is not encrypted and can harm your PC system. Downloading from the internet lacks the software integrity and publishers’ credentials so people will face difficulty in taking the decision whether to trust such download.</p>

<p align="justify"><b>Why Developers need it:</b> Easy online distribution of software made possible for developers to create functional code. Even the malicious code and online fraud also have been increased as well. Users being unconscious of malicious code can download a malicious software from unreliable source over the internet that can hamper the performance of their system. Now software applications and platforms also require digital signature to prove software’s integrity. When a user faces unsigned code, a security warning appears depending on browser type and settings. Warning creates confusion in the mind of the user and force him to call the publisher or developer. In contrast when a signed code is encountered it shows a verified identity of the publisher. </p>

<p align="justify"><b>Revocation:</b> When a certificate is compromised by any reasons, Certificate authority revokes it. The certificate itself has the list of CRL(certification revocation list). CRL has either the list of certificates or serial nos. If your certificate or its serial no. is in the list, it means that your certificate is revoked. When a client wants to check the list, a link is given in the certificate. There is also another technique something called online certificate status protocol (OCSP). OCSP is an internet protocol use for finding the revocation status of an x.509 certificate. OCSP can offer you more information about the revocation status of a certificate without burdening the network. OCSP does not consent encryption so other parties can intercept this information.</p>

<p align="justify"><b>Time Stamping:</b> From the trouble of resigning certificate authorities provide the time stamping facility with your certificate. When you sign a code, a hash of your code will be sent to a certificate authority for time stamping. Time stamping is necessary when you distribute signed documents and ensures that the code will not lapse when the certificate expires. It affirms the digital signature. If you neglect time stamping, then you have to resign your code and re-send out to customers. A caution "Unknown date and time" will emerge when the file has not been time stamped. </p>

<p>Time stamping the signature is accomplished as follows:</p>
 
<p>• The signature is to be sent to the time-stamping authority (TSA).</p>
<p>• TSA adds a timestamp to the packaged information and computes a new hash. </p>
<p>• TSA signs the new hash with its private key building a new package of information.</p>
<p>• The package is re-packed with the original code.</p>
<p>• The timestamp and combined signature are bewildered.</p>
<p>• TSA utilized the public key to the signature block with its expiry date's confirmation. </p>

<p align="justify"><b>Conclusion:</b> Code signing certificate is an essential certificate that ensures about code authenticity and provides a relief to users and developers. Many certificate authorities like RapidSSL, GeoTrust, Thawte, and Symantec offer Code signing certificates which are trusted and offer the highest authenticity. </p>