Overview Notes

The Strong Named Assemblies and Global Assembly Cache

Public/Private Key Pairs

• The concept of public/private key pairs is very important to modern crytography to implement digital signatures.
  A strong named assembly is signed with the software creator's private key.

  This can be verified by the software user that has access to the software creator's public key.

  This proves that the creator signed it and that no one has tampered with the software.

Strong Named Assemblies

• A strong name consists of the following information about the assembly's identity:
  its simple text name (without path)

  the version number

  culture information (if provided)

  a public key

  a digital signature

  The strong name is generated from an assembly file using the corresponding private key. (The public/private key pair is generated by the sn.exe program.) This can be done because the assembly file contains the assembly manifest, which contains the names and hashes of all the files making up the assembly.

  Caution: if a strong named assembly uses one or more classes defined in another DLL file, that file must also be strong named to maintain security.

Global Assembly Cache

• The Global Assembly Cache (GAC) is an area on the computes disk drive that stores DLL files that can be shared by multiple users and applications. Each file that is installed in the GAC must have a strong name. Users must have administrator privileges to install files into the GAC.

• Here are some reasons to use the GAC to store DLL files.
  1. Shared Location: Assemblies that should be used by applications can be put in the global assembly cache. For example, if all applications should use an assembly located in the global assembly cache, a version policy statement can be added to the Machine.config file that redirects references to the assembly.

  2. File Security: Administrators can protect the system root directory using an Access Control List (ACL) to control write and execute access. Because the global assembly cache is installed in the systemroot directory, it inherits that directory's ACL. Only users with Administrator privileges should be allowed to delete files from the global assembly cache.

  3. Side-by-side Versioning: Multiple copies of assemblies with the same name but different version information can be maintained in the global assembly cache.

  4. Additional Search Location: The CLR checks the GAC for an assembly that matches the assembly request before probing the codebase information in a configuration file.

• Here is a case where you should not install an assembly into the GAC:
  If you place one of the assemblies that make up an application into the GAC, you can no longer replicate or install the application by using XCOPY to copy the application directory. In this case, you must place the entire assembly into the GAC.