In some C# code I have taken over (in Visual Studio 2005), I have noticed that the assemblies are all signed with the same .snk file.
- Why would the previous author have signed the assemblies in this way?
- Is signing assemblies necessary and what would be wrong with not signing?
- What disadvantages are there in signing assemblies - does it cause delays?
Why would the previous author have signed the assemblies in this way?
No idea, maybe he wanted all his assemblies to be signed with the same key.
Is signing assemblies necessary and what would be wrong with not signing it?
No, it is not necessary but it is a mechanism allowing you to ensure the authenticity of an assembly. It allows you to ensure that an assembly hasn't been tampered with and indeed it origins from this author. It is also necessary if you want to put them into the GAC.
What disadvantages are there in signing assemblies - does it cause delays?
Signed assemblies can only load other signed assemblies. Also they are tied to a specific version meaning that you need to use binding redirects or recompile the application if you wanted to use a different version. There's a little performance overhead as well due to the verification of the signature but it is so little that you shouldn't be concerned about.
You need to sign assemblies if you want to put them in the GAC.
If you sign an executable, then any class libraries it links to also needs to be signed. This can be difficult if you're using a third-party library (especially if you need to use an ActiveX control or similar).
Richard Grimes have written a good workshop about security in .NET and that includes a chapter about this: Security Workshop
The reason for all the assemblies being signed with the same .snk file could be if he used unit testing with code coverage. To be able to do code coverage (at least with the tools built into the testing version of Visual Studio 2005) and if the assemblies are signed, you need to specify what .snk files are used for the signing, but I think you can only specify one .snk file for the whole solution, so if you sign the various class libraries with different .snk files you can only check the code coverage on one of them at a time.
A very important reason to sign an assembly is so you can be sure it is your assembly. Since the private key is yours, nobody else can sign an assembly with that same key. This means that when the public key of an assembly is one you know (you can retrieve this using the GetType().Assembly.GetName().GetPublicKey() function), the assembly is yours and it has not been tampered with.
Inspite of all the usages of signing dll, the dll should be signed for only two reasons
1. Versioning
2. Authentication
a. Versioning denotes what version the dll has been build on and while pushing them into GAC two dll with same name can exists but different version
b. Authentication denotes whether the dll is not tampered and does exists the same when it was created.
If you want to understand more about the basics and dll signing you can refer here
In addition to existing answers, I would add that you must use the signing when your DLL is going to be dynamically loaded and consumed by 3rd party software. It is not technical requirement per se but it is rational, therefore very common, that the 3rd party software producer enforces such policy due security concerns.
Examples where you must sign an assembly:
- development of Windows Shell / Windows Explorer extension, like: context menu extension for Windows Explorer
- development of Visual Studio extensions, like: Project/Item Template Wizard GUI
Signing and assembly is important. In order to ensure that exe or assembly that is installed on that PC only.
Ie: if you copy that folder and put into another PC it does not work. since it is signing that assembly in to that machine only.
来源：https://stackoverflow.com/questions/3975723/c-why-sign-an-assembly