EV Code Signing without Hardware Token: Is It Possible by CAs?

Anyone talking about companies or organizations whose private keys were compromised hardly knows what actually happened. However, it appears that the cybercriminal had access to their private keys, which they gained from a break-in (which is most probably an electronic one).

The damage that organizations witness is immense and is not limited to mud through which their names are criticized. While we are not trying to cover the culpability of cyber criminals, it is fair to say that the companies failed to take appropriate measures to secure their private keys.

Gone are the days when passwords translated into holistic security. They have become old and obsolete. Today, Code Signing Certificates and the application of digital certificates affirm the idea of reliability and trust in the modern digital landscape. Companies use Extended Validation (EV) Code Signing Certificates to secure their software.

However, the application of hardware tokens (issued by the Certificate Authority) allows the certificate’s configuration for timestamping and digital signatures. However, some consider acquiring an EV Code Signing Certificate that does not have Hardware Tokens. So is it possible to get one? Let us find out. But before that, let us get you cleared with EV Signing and hardware tokens means.

What are EV Code Signing and Hardware Tokens?

A Code Signing Certificate can be defined as a file containing the developer organization’s digital signature for signing scripts and executables so that the developer’s identity can be verified. In addition, it will prove that the software is not accessed by any third party since its signature, thereby making it a trusted one.

EV Code Signing certificates are usually issued on a hardware token (which provides two-factor authentication), thus making it more secure. Therefore, they are ideal for signing device drivers and other high-trust software as they offer a default reputation with Microsoft SmartScreen Filter.

The EV Code Signing leverages the advanced hashing mechanism, securing software from malicious actors. Not just that, the applicant also goes through a rigorous vetting process to acquire the certificate. All these factors are the reason why only legitimate businesses are issued the EV Code Signing certificate.

Apart from the above, another reason one must opt for an EV is the application of a Hardware Token. Upon issuing EV Code Signing Certificate by the CA, its private key is sent via an external USB drive. It is an extra security layer so that only a few people can gain access to it. Moreover, it gets stored offline, thereby preventing malicious actors from gaining access.

The external USB or hardware token is the key to security, as a business cannot sign software without one. A hardware token can be defined as a physical device that incorporates robust authentication into a system. So, how is it used in the EV Code Signing Certificate? Let us discuss this.

How does EV Code Signing Certificate Function?

As discussed above, the EV Code Signing Certificate secures the software’s source code with encryption and hashing mechanism. Typically, to maintain the integrity of the code, each organization goes through a series of steps while obtaining the certificate. So, let us talk about those steps.

Step 1: Hashing

As soon as the software is developed, it should be hashed. Hash is a mathematical function that converts the overall source code of the software into an unreadable form, securing it from unauthorized changes and letting the end-users know that the software is not tampered with.

Suppose the hash function produced while downloading is incorrect, the browsers will immediately recognize that the software is compromised and display a warning message to the users.

Step 2: Code Signing

After the software is hashed, the developer must sign the software via the private key stored in an external drive. Then, it can be used to digitally sign and timestamp the software.

By signing and timestamping, the developer lets the browsers know who the publisher is and whether or not it should be trusted or not.

Additionally, a timestamp also gets incorporated into the software, thus, optimizing its authenticity.

Step 3: Uploading

After the publisher hashed and encrypted the software, it will now get uploaded to the server for all the end-users.

Step 4: Downloading

After the software is signed and timestamped, the developers can publish it. So now, when the end-users try to download the browser will immediately know that the software is signed with an EV Code Signing Certificate and the software has come from a reliable developer and has not been subjected to any alteration.

These are the steps involved in code signing software. Now, let us discuss why a Hardware Token is needed for EV Validation Code Signing.

Why is a Hardware Token with EV Code Signing Important?

Typically, EV Code Signing Certificates are for those organizations that have proven the legitimacy of their business. Thus, big enterprises use this certificate to enjoy a seamless security process.

The certificate also helps them bypass the Microsoft Defender SmartScreen alert. Moreover, they buy these certificates for using the of advanced security benefits.

Apart from that, the CAs offer the Hardware Token due to the following reasons:

• To provide state-of-the-art security with the help of a private key, as it is stored on a physical device and has a real chance of getting breached,
• To use the company for allowing limited and authorized persons to change the source code as needed demands,
• To help organizations limit their access to the private key used for digitally signing the software.

Now, let us assume there is no hardware token for your EV Code Signing Certificate. Is it really possible? Let’s find out.

Is it Possible to Get EV Code Signing without External Hardware Token?

No, it is not. Now that you understand how the EV Code Signing Certificate works, you know how necessary is the Hardware tokens. Therefore, every EV applicant receives one from the CA. Moreover, these tokens add much to the popularity of the EV certificate.

EV Code Signing Certificates are also expensive compared to other certificates, and to justify the price, the CAs must offer top-notch protection and value for money. Thus, they provide an external USB. With the external USB, you can protect the private key of your digital signature.

Get Code Signed!

The bottom line is that a Hardware Token is one of the primary components for digitally signing the software. Without it, there would be no EV Code Signing Certificate issuance. And since the certificate offers the highest level of security, there is no compromise with the private key.