.net .snk 有什么用？

What is a .snk for?

提问by Blair Conrad

What is a .snk file for? I know it stands for Strongly Named Key, but all explanations of what it is and how it works goes over my head.

.snk 文件有什么用？我知道它代表Strongly Named Key，但是关于它是什么以及它如何工作的所有解释都让我无法理解。

Is there any simple explanation on how a strongly named key is used and how it works?

关于如何使用强命名密钥以及它是如何工作的，是否有任何简单的解释？

回答by Blair Conrad

The .snk file is used to apply a strong name to a .NET assembly. such a strong name consists of

.snk 文件用于将强名称应用于 .NET 程序集。这么强的名字包括

a simple text name, version number, and culture information (if provided)—plus a public key and a digital signature.

一个简单的文本名称、版本号和文化信息（如果提供）——加上一个公钥和一个数字签名。

The SNK contains a unique key pair - a private and public key that can be used to ensure that you have a unique strong name for the assembly. When the assembly is strongly-named, a "hash" is constructed from the contents of the assembly, and the hash is encrypted with the private key. Then this signed hash is placed in the assembly along with the public key from the .snk.

SNK 包含一个唯一的密钥对 - 一个私钥和公钥，可用于确保程序集具有唯一的强名称。当程序集是强命名的时，根据程序集的内容构造一个“散列”，并使用私钥对散列进行加密。然后将此签名散列与来自 .snk 的公钥一起放置在程序集中。

Later on, when someone needs to verify the integrity of the strongly-named assembly, theybuild a hash of the assembly's contents, and use the public key from the assembly to decrypt the hash that came with the assembly - if the two hashes match, the assembly verification passes.

稍后，当有人需要验证强命名程序集的完整性时，他们构建程序集内容的哈希，并使用程序集的公钥解密程序集附带的哈希 - 如果两个哈希匹配，装配验证通过。

It's important to be able to verify assemblies in this way to ensure that nobody swaps out an assembly for a malicious one that will subvert the whole application. This is why non-strong-named assemblies aren't trusted in the same way that strongly-named assemblies are, so they can't be placed in the GAC. Also, there's a chain of trust - you can't generate a strongly-named assembly that references non-strongly-named assemblies.

能够以这种方式验证程序集很重要，以确保没有人将程序集换成会破坏整个应用程序的恶意程序集。这就是为什么非强命名程序集不像强命名程序集那样受信任，因此它们不能放置在 GAC 中。此外，还有一个信任链——你不能生成一个引用非强命名程序集的强命名程序集。

The article "The Secrets of Strong Naming". Does an excellent job of explaining these concepts in more detail. With pictures.

文章“强命名的秘密”。在更详细地解释这些概念方面做得非常出色。带图片。

回答by ckramer

In a the.Net world the SNKfile is used to sign your compiled binaries. This allows a couple things to happen:

在.Net 世界中，SNK文件用于对编译后的二进制文件进行签名。这允许发生一些事情：

1. You can register the Assembly in the GAC (Global Assembly Cache). Basically so you can reference it from many places on the same machine without having to maintain multiple copies).
2. You can use your Binaries from within other binaries that are also signed (this is a strange viral sort of behavior with regard to signed assemblies).
3. Your assembly cannot (easily) be modified by 3rd partieswho do not have access to the SNK file, providing at least a small amount of security.

1. 您可以在 GAC （全局程序集缓存）中注册程序集。基本上，您可以从同一台机器上的许多地方引用它，而无需维护多个副本）。
2. 您可以在其他已签名的二进制文件中使用您的二进制文件（这是一种关于已签名程序集的奇怪病毒式行为）。
3. 您的程序集无法（轻松）被无权访问 SNK 文件的第 3 方修改，至少提供了少量的安全性。

I'm not familiar with how BizTalk serverworks, so I don't think I can shed much light on what specific purpose they serve within that environment.

我不熟悉BizTalk 服务器的工作方式，因此我认为我无法说明它们在该环境中的具体用途。

Hope this was somewhat helpful.

希望这有点帮助。

回答by Franci Penov

The .snk file is used for signing the assemblies in order to be able to add them to the Global Assembly Cache (GAC).

.snk 文件用于对程序集进行签名，以便能够将它们添加到全局程序集缓存 (GAC)。

The .snk file contains the public and private tokens for your key. When you want to sign some data (or binary) with that key, a checksum is calculated on the data, which is then encrypted with the private token. The encrypted checksum is then added to the data. Anyone can use the public token from your key to decrypt the checksum and compare it to the checksum they calculated to verify that the signed data hasn't been tampered.

.snk 文件包含您的密钥的公共和私有令牌。当您想使用该密钥对某些数据（或二进制文件）进行签名时，会对数据计算校验和，然后使用私有令牌对其进行加密。然后将加密的校验和添加到数据中。任何人都可以使用您密钥中的公共令牌来解密校验和，并将其与他们计算的校验和进行比较，以验证签名数据未被篡改。

You can read more about the public key cryptography at http://en.wikipedia.org/wiki/Public-key_cryptography.

您可以在http://en.wikipedia.org/wiki/Public-key_cryptography 上阅读有关公钥加密的更多信息。

回答by Gishu

A .snk file is a persisted version of your "Key" produced by the sn utility in the framework utility set. You then use this file to 'digitally sign' your assemblies. It is a 2-part key.. private-public key combination. The public part of the key is published i.e. known to everyone. The private part is known to only you, the component/app developer and intended to be kept that way.

.snk 文件是框架实用程序集中的 sn 实用程序生成的“密钥”的持久版本。然后，您可以使用此文件对您的程序集进行“数字签名”。它是一个由两部分组成的密钥......私钥 - 公钥组合。密钥的公共部分是公开的，即每个人都知道。私有部分只有您（组件/应用程序开发人员）知道，并打算以这种方式保留。

When you sign your assembly, it uses the private key and a hash value for your assembly to create a digital signature which is embedded in your assembly. Thereafter, anyone who loads your assembly goes through a verification step. The public key is used to validate if the assembly really comes from you.. you just need the public key for this (which is also embedded in a tokenized form in the assembly manifest). If the assembly has been tampered with, the hash value would be different and the assembly load would be aborted. This is a security mechanism.

当您对程序集进行签名时，它会使用您的程序集的私钥和哈希值来创建嵌入在您的程序集中的数字签名。此后，任何加载您的程序集的人都会经过验证步骤。公钥用于验证程序集是否真的来自您……您只需要为此提供公钥（它也嵌入在程序集清单中的标记化形式中）。如果程序集被篡改，哈希值将不同，程序集加载将中止。这是一种安全机制。

回答by Michael Lang

An .snk file is used to ensure that someone else can't slip an assembly of their own in the place of yours. It provides a pair of encryption/decryption keys.

.snk 文件用于确保其他人无法将自己的程序集替换为您的程序集。它提供一对加密/解密密钥。

When an .snk file is used to sign an assembly, a hashcode value is calculated from the assembly file and encrypted using the private key. That encrypted "digest" is then tacked on to the assembly together with the public key from the .snk file.

当使用 .snk 文件对程序集进行签名时，将从程序集文件计算哈希码值并使用私钥进行加密。然后将该加密的“摘要”与来自 .snk 文件的公钥一起添加到程序集。

Then when someone receives your assembly, they can also calculate that hashcode value. They use the public key to decrypt the one that you calculated and compare the calculated values. If the assembly had been changed at all, those values will be different and the user of the assembly will know that the assembly you have is not the one you provided.

然后当有人收到您的程序集时，他们也可以计算该哈希码值。他们使用公钥解密您计算的密钥并比较计算出的值。如果程序集完全更改，这些值将不同，并且程序集的用户将知道您拥有的程序集不是您提供的程序集。

In the context of BizTalk Server, whoever builds any custom assemblies that are used by your BizTalk solution will need to use a .snk file to sign the assembly so that BizTalk server can load it into the GAC and use it.

在 BizTalk Server 的上下文中，任何构建 BizTalk 解决方案使用的任何自定义程序集的人都需要使用 .snk 文件对程序集进行签名，以便 BizTalk 服务器可以将其加载到 GAC 中并使用它。