Browse Prior Art Database

A method for securing shared libraries. Disclosure Number: IPCOM000219381D
Publication Date: 2012-Jun-27
Document File: 1 page(s) / 34K

Publishing Venue

The Prior Art Database


Signing shared libraries to prevent modification also causes significant serviceability problems. This article discusses a compromise which prevents inadvertant modification, but still allows vendor supplied upgrades.

This text was extracted from a PDF file.
This is the abbreviated version, containing approximately 51% of the total text.

Page 01 of 1

A method for securing shared libraries.

Security standards such as FIPS 140-2 require that code shipped as shared libraries be locked together so that it's the functional equivalent of statically linked libraries.

Currently this is done by linking a static stub containing a public key and signatures of the libraries into applications using the shared libraries, the stub verifies the shared libraries using the public key and signatures embedded in the static stub before enabling the cryptographic API.

This causes significant problems with distributing bug fixes and updates as the entire application has to be re-built and re-released to pick up a modified static stub as it's not possible to update just the shared libraries. For companies like IBM, which ship complex and sometimes deeply nested applications this can

present significant problems. i.e. if debug libraries are needed, it's not possible to just provide a set of debug libraries of the cryptographic component for problem determination, at the minimum the application must be relinked.

This also makes it extremely difficult to deal with different cryptographic requirements in different regions as it's not possible to change the cryptographic component without shipping a completely rebuilt set of upper level application code.

Moving the signatures of the shared libraries into a separate file which is sealed with a private key improves serviceability. As before the static stub contains the public key. Instead of having the library signatures embedded in the stub...