Code Signing
Digitally signing software lets recipients verify who produced it and that it has not been altered since, before they run it.
Proving Origin and Integrity
Code signing attaches a digital signature to software using the publisher's private key. Anyone with the corresponding public key can verify two things: that the software genuinely came from that publisher (authenticity) and that not a single byte has changed since it was signed (integrity). If an attacker tampers with the code or substitutes malware, the signature fails to verify and the system can refuse to run it.
How It Works
- The publisher hashes the software to a fixed-length digest
- The digest is encrypted with the publisher's private key to form the signature
- The recipient hashes the received software and verifies the signature with the public key
- A matching result proves origin and integrity; a mismatch means tampering or a wrong signer
The Chain of Trust
Verification depends on trusting the signer's public key, which is usually vouched for by a certificate from a trusted authority. This chain lets a system decide whether an unknown publisher's signature should be honored. Operating systems and package managers ship with sets of trusted roots to anchor these decisions.
Guarding the Signing Key
The security of code signing collapses if the private key is stolen, because an attacker can then sign malware that verifies perfectly. Signing keys therefore belong in hardware security modules, with signing operations logged and tightly restricted. Compromise of a signing key is one of the more damaging supply-chain events possible.
Fusion Context
Firmware and control software for a fusion plant should be accepted only if signed by an authorized key, so that a device rejects any unsigned or tampered update. In the Hyperion breeder and burner designs, code signing pairs with secure boot: the device verifies signatures before executing, and the signing keys are chosen with post-quantum migration in mind given the plant's long life.