Delay Sign an Assembly in C#

Assemblies that reference strong-named assemblies contain the public key token of the referenced assemblies. This means that the referenced assembly must be strong named before it can be referenced. In a development environment in which assemblies are regularly rebuilt, this would require every developer and tester to have access to your strong name key pair—a major security risk.

Instead of distributing the private key component of your strong name key pair to all members of the development team, the .NET Framework provides a mechanism named delay signing with which you can partially strong name an assembly. The partially strong-named assembly contains the public key and the public key token (required by referencing assemblies), but contains only a placeholder for the signature that would normally be generated using the private key. 

After development is complete, the signing authority (who has responsibility for the security and use of your strong name key pair) re-signs the delay- signed assembly to complete its strong name. The signature is calculated using the private key and embedded in the assembly, making the assembly ready for distribution.

To delay sign an assembly, you need access only to the public key component of your strong name key pair. There's no security risk associated with distributing the public key, and the signing authority should make the public key freely available to all developers. 

To extract the public key component from a strong name key file named MyKeys.snk and write it to a file named MyPublicKey.snk, use the command sn -p MyKeys.snk MyPublicKey.snk. If you store your strong name key pair in a CSP key container named MyKeys, extract the public key to a file named MyPublicKey.snk using the command sn -pc MyKeys MyPublicKey.snk.

The attributes discussed are used to declare the version and culture of the assembly, as well as the location of the public key. You must also apply the attribute AssemblyDelaySign(true) to your assembly, which tells the compiler that you want to delay sign the assembly. The following code highlights the attributes you would use to delay sign the assembly, in a situation where the public key is in a file named MyPublicKey.snk.

using System;
using System.Reflection;

[assembly:AssemblyKeyFile("MyPublicKey.snk")]
[assembly:AssemblyCulture("")]
[assembly:AssemblyVersion("1.0.0.0")]
[assembly:AssemblyDelaySign(true)]

public class HelloWorld {

    public static void Main() {
    
        Console.WriteLine("Hello, world");
    }
}

When the runtime tries to load a delay-signed assembly, the runtime will identify the assembly as strong-named and will attempt to verify the assembly, as discussed. Because there's no digital signature, you must disable the runtime from verifying the assembly's strong name using the command sn -Vr HelloWorld.exe.

Once development is complete, you need to re-sign the assembly to complete the assembly's strong name. The Strong Name tool allows you to do this without the need to change your source code or to recompile the assembly; however, you must have access to the private key component of the strong name key pair. To re-sign an assembly named HelloWorld.exe with a key pair contained in the file MyKeys.snk, use the command sn -R HelloWorld.exe MyKeys.snk. If the keys are stored in a CSP key container named MyKeys, use the command sn -Rc HelloWorld.exe MyKeys.

Once you have re-signed the assembly, you should turn strong name verification for that assembly back on using the –Vu switch of the Strong Name tool, as in sn -Vu HelloWorld.exe. To enable verification for all assemblies for which you have disabled strong name verification, use the command sn -Vx. You can list the assemblies for which verification is disabled using the command sn -Vl.