Authenticode and Vista

This week at work our Authenticode signing certificate expired. The renewal process involves the Certificate Authority issuing us brand new keys. We had done this before, so I figured that it would not be a big deal. However, over the past year we have upgraded our entire development environment to Windows Vista.

Before I discuss the Vista situation, let me elaborate a little on what exactly Authenticode signing is. Basically, it is digitally signing software so that when an end user downloads and does an install, the software will appear to come from a reliable source. The Authenticode certificate is purchased from a 3rd party Certifcate Authority that has been blessed by Microsoft. Verisign is one such authority.

The digital signing technology uses public/private key pairs. Basically the software company signs the code with a special private key, and in doing so will embed the public key into the software. Only the public key is needed to perform verification. When the user installs the software the verification takes place and if everything checks out, a dialog will show that windows trusts the software.

The Certificate Authority delivers the keys to the software company as two separate files, a .pvk (Private Key) file, and an .spc (Public Key) file. To actually sign the software Microsoft provides a tool aptly named signtool.exe. However, this tool works best with .pfx files (Which contain both the public and private keys). Microsoft provides a difficult to find tool called pvk2pfx.exe that will merge the .pvk and .spc files into the required .pfx file.

Anyway, back to the Vista issue. These Certificate Authorities don't allow private keys to be downloaded normally. They instead rely on certificate enrollment functionality that is built into Windows and Internet Explorer. The process can't be done in Firefox. And Vista has changed the way that the Certificate Enrollment works. In Windows XP, it was very simple, the user could just select a file location where the .pvk file would be generated. In Vista, they instead install it into a special Certificate Store for pending Certificates. The .pvk data therefore is buried in the windows registry instead of sitting on the file system. Furthermore, the key is placed in the Certificate Store in such a way that exporting the private key is disabled, which essentially traps the key in the Certificate Store on that particular computer.

After some research, I contacted technical support at the Certificate Authority, and they immediately understood our issue (It must come up all the time). The only recommendation that they could provide was to redo the whole over again process in Windows XP. Thankfully we still have XP environments to be able to do this. It seems like Microsoft implemented this new behavior as a security "feature" without considering the implications for developers. I wonder if this will behave the same way in Windows 7?

Readyboost

I received a new laptop at work not too long ago. It came with Windows Vista. I may be slightly biased because I am a .NET developer, but I think Vista is actually pretty good. Since the release of Vista I have been hearing about Readyboost and the laptop came with a built in SDHC slot so I figured, what the heck! From what I understand Readyboost is basically using flash memory as a cache for your hard drive. The benefit is that flash memory has a really low seek time, so it should be able to retrieve frequently used files very quickly. Some USB drives are rated as Readyboost capable, however any memory that is fast enough will work. I decided to go with the SanDisk Ultra II which supposedly transfers at 15 MB/s. Somewhere I remember reading that Readyboost requires 5 MB/s. At first I was looking at the Ultra III (which is 20 MB/s) online, but it felt just a little too pricey compared to other cards with similar capacity. I finally pulled the trigger when I saw the 4GB Ultra II on sale at Circuit City for 20$ (Although it is slightly cheaper on Newegg). 4GB is the maximum size supported by Readyboost.

All in all I am impressed with Readyboost. My computer feels more responsive. After booting into Windows, it feels like I can start running programs and doing work right away, whereas before there was more of a pause as the computer got going. I also like that I can basically forget about it because of the internal SD slot. It wouldn't be as convenient if I had to remember to keep track of a USB Thumbdrive.