At:
http://msdn.microsoft.com/library/de...b70c04.xml.asp
Driver Signatures and PnP Device Installation (Windows Vista)
[This is preliminary documentation and subject to change.]
Plug and Play (PnP) device installation on Windows Vista
uses a digital signature of a driver package catalog file to
verify the identity of the publisher of the driver package
and to determine whether the driver package was altered
after it was published. PnP device installation on Windows
Vista supports the following types of digital signatures for
driver packages:
* Signature types that can be used for drivers that are
released to the general public.
o Signatures generated by a Windows signing
authority for inbox drivers, the Windows Hardware Quality
Lab (WHQL) Logo Program, and Windows Sustained Engineering
updates.
o Signatures that are not generated by a Windows
signing authority, but that do comply with Windows Vista
kernel-mode code signing policy and PnP driver signing
requirements for x64-based versions of Windows Vista. This
type of signature is generated by using a Software Publisher
Certificate (SPC) that is obtained from a third-party CA
that is authorized by Microsoft to issue such certificates.
o Signatures that are not generated by a Windows
signing authority, but that do comply with PnP driver
signing requirements. This type of signature can be used to
sign kernel-mode drivers on 32-bit versions of Windows
Vista. This type of signature is generated by using a
commercial release certificate that is obtained from CA that
is a member of the Microsoft Root Certificate Program.
* Signatures for deploying drivers only within
corporate network environments, which are created by a
digital certificate that is created and managed by an
Enterprise CA. For information about creating an Enterprise
CA, see the "Code Signing Best Practices" white paper on the
Driver Signing Requirements for Windows Web site and the
readme selfsign_readme.htm, which is located in the
bin\selfsign directory of the WDK..
* Signature types that can be used in-house during the
development and test of drivers:
o Signatures generated by the WHQL test signature
program
o Signatures generated by a MakeCert test certificate
o Signatures created by a commercial test
certificate that is obtained from CA that is a member of the
Microsoft Root Certificate Program
o Signatures generated by Enterprise CA test
certificate
Windows Vista includes the following features that are
related to support for signatures that are generated by
third parties:
* Administrators can control which driver publishers
Windows Vista trusts. Windows Vista installs drivers from
trusted publishers without prompting. It never installs
drivers from publishers that the administrator has chosen
not to trust.
* Driver-signing policy is always set to Warn,
eliminating the Block and Ignore options that were available
in earlier versions of Windows. An administrator must always
authorize the installation of unsigned drivers or a driver
from publisher that is not yet trusted.
* All device setup classes are treated equally.
Certclas.inf does not exist in Windows Vista.
* When there are several compatible drivers to choose
from, the ranking algorithm that Windows Vista uses to pick
the best driver includes drivers with third-party
signatures. By default, Microsoft signatures take priority
over third-party signatures, but IT departments can
configure them to be equivalent.
Before installing a driver, Windows analyzes the driver’s
signature. If a signature is present, Windows uses the
signature to verify the driver package files. Based on the
results of this analysis, Windows categorizes the driver
signature, as follows:
* Signed by a Windows signing authority. These drivers
are either in-box, signed for release by WHQL, or signed by
Windows Sustained Engineering.
* Signed by a trusted publisher. These drivers have
been signed by a third party, and user has explicitly chosen
to always trust signed drivers from this publisher.
* Signed by an untrusted publisher. These drivers have
been signed by a third party, and the user has explicitly
chosen to never trust drivers from this publisher.
* Signed by a publisher of unknown trust. These drivers
have been signed by a third party, and the user has not
indicated whether to trust this publisher.
* Altered. These drivers are signed, but Windows has
detected that at least one file in the driver package has
been altered after the package was signed.
* Unsigned. These drivers are either unsigned or have
an invalid signature. Valid signatures must be created with
a certificate that was issued by a trusted CA.
Before Windows installs a driver on a computer the first
time, it preinstalls, or stages, the driver in the driver
store. To preinstall a driver, Windows copies the driver
package to the driver store and adds a copy of the INF file
to the system INF directory. Windows subsequently will
silently install a driver for a matching device by using the
copy of the driver package in the driver store. User
interaction is not required when Windows installs a
preinstalled driver on a device.
Whether Windows will preinstall a driver package depends on
the signature category, user credentials, and user
interaction, as follows:
* Signed by a Windows signing authority or a trusted
publisher. Windows silently preinstalls the driver for
system administrators and standard users (users without
administrator credentials). Windows does not display user
dialog boxes.
* Signed by an untrusted publisher. Windows does not
preinstall the driver package.
* Signed by a publisher of unknown trust. Windows
displays a dialog box to a system administrator that informs
the administrator that the publisher is not yet trusted. The
dialog box provides the administrator the option to install
the driver and the option to always trust the publisher.
Windows does not display a dialog box to a standard user and
does not preinstall the driver for the standard user.
* Altered or unsigned. Windows displays a dialog box
that appropriately warns a system administrator that the
signature could not be verified. The dialog box provides the
administrator the option to install or not to install the
driver. Windows does not display a dialog box to a standard
user and does not preinstall the driver for a standard user.
© 2006 Microsoft Corporation
Built on August 25, 2006
Build machine: CAPEBUILD
Mark Gillespie wrote:
> I had great hopes that x64 would progress from a niche OS, with Vista
> x64, but Microsoft have killed that..
>
> Why?
>
> the "Works with Vista" logo..
>
> There is now much less pressure on hardware manufacturers to produce x64
> drivers, to get the "Certified For Vista" logo, they can now just get it
> working with 32bit Vista, and slap a "Works With Vista" sticker on the box.
>
> Poor show Microsoft...