Re: Secure DLL

From: Barry Margolin (barry.margolin@level3.com)
Date: 02/18/03 

From: Barry Margolin <barry.margolin@level3.com>
Date: Tue, 18 Feb 2003 16:24:47 GMT

In article <b2tjus$dfj$1@newshost.mot.com>,
jacques wisson <rc089c@motorola.com> wrote:
>I am developping applications for Windows.
>Does somebody know a secure solution to ensure that the DLL an application
>is talking to hasn't been replaced with a fake one?
>
>I am thinking about implementing a "handshaking" procedure. With this
>method, the application sends a "challenge" message to the DLL. The DLL
>responds with a value calculated using a one-way hash function. The
>application checks the response against its own calculation of the expected
>hash value. If the values match, the authentication is acknowledged;
>otherwise the application is terminated.

If other people are going to be able to use this DLL, then you'll need to
publish the hash function so that they can perform the same check. In that
case, someone implementing a fake DLL would be able to implement the hash.

>Do you know other/better solutions?

I think there was a thread on this same topic sometime last year, so check
the Google archives. IIRC, the concensus was that this is an extremely
difficult problem. E.g. someone who can replace the DLL could also patch
the application so that it skips over the check. 

-- 
Barry Margolin, barry.margolin@level3.com
Genuity Managed Services, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.

Relevant Pages

  • Re: Secure DLL
    ... > Does somebody know a secure solution to ensure that the DLL an application ... the application sends a "challenge" message to the DLL. ... > responds with a value calculated using a one-way hash function. ... > application checks the response against its own calculation of the expected ...
    (comp.security.misc)
  • Secure DLL
    ... Does somebody know a secure solution to ensure that the DLL an application ... responds with a value calculated using a one-way hash function. ... application checks the response against its own calculation of the expected ...
    (comp.security.misc)
  • Re: GetProcAddress in Delphi .net 2005
    ... The basic problem is the requirement to allow for Multiple tax calculation ... So you pre-define a number of procedures you expect in the taxdll. ... > Are you ever going to load more than one DLL in a session? ...
    (alt.comp.lang.borland-delphi)
  • Re: C# vs C
    ... I have a calculation library written in C compiled into a DLL. ... This would require marshalling of some structs etc ... but I am worried that the .NET implementation ...
    (microsoft.public.dotnet.framework.performance)
  • Re: How to stop a BackgroundWorker thread that calls a C++ dll
    ... calculation. ... But based on Mehdi's feedback I think that I will try to find a way to ... My interface calls a C++ dll that runs a slow calculations. ... dll to stop so CancelAsync() will not work? ...
    (microsoft.public.dotnet.languages.csharp)
Quantcast