Signature verification

[Ralph.Malek]

Would anyone happen to know how to determine if a digital signature
used MD5 or SHA1 as the digest algorithm?

I have a requirement to verify the authenticity of VeriSigned exe
file, and while validating the certificate chain is simple enough, I
am having a hard time figuring out how to determine what algorithm was
used to generate the signature...

Thanks,

 

[Maciej Oszutowski]

Dnia Mon, 17 Mar 2008 13:37:35 -0700 (PDT), (e-mail address removed)
napisa³(a):

I have a requirement to verify the authenticity of VeriSigned exe
file, and while validating the certificate chain is simple enough, I
am having a hard time figuring out how to determine what algorithm was
used to generate the signature...

Why don't you simply use WinVerifyTrust API function?

 

[Shenro]

Dnia Mon, 17 Mar 2008 13:37:35 -0700 (PDT), (e-mail address removed)
napisa³(a):


Why don't you simply use WinVerifyTrust API function?

Thanks for the reply. I looked at WinVerifyTrust, but I don't quite
understand how it would be used in this situation. I was under the
impression that the call would simply validate the certificate chain.
In this scenario, even if the certificate is valid and the file
appears to be authentic, I need to ignore it if MD5 was used instead
of SHA1.