An update is available that allows Authenticode Signing for CSP signatures in Windows XP SP3 and Windows Server 2003 SP2

This article describes an update that�allows Authenticode Signing for cryptographic service provider (CSP) signatures on a computer that is running Windows XP Service Pack 3 (SP3) or Windows Server 2003 Service Pack 2 (SP2). After you install the update, you can use the Kernel mode Authenticode code signing process to sign a third-party CSP.

Note�By using the Authenticode code signing process, third-party manufacturers can issue code signing certificates that certificate authorities provide and that are recognized by Microsoft (such as VeriSign). Then, third-party manufacturers can use the certificates to sign binary files. Because root certificates�are cross signed by Microsoft, Microsoft can recognize the certificates. Additionally, The public keys and subject names of the Microsoft cross signing certificates are hard-coded in Windows. Therefore, the public keys and subject names are compared when Windows checks the integrity of Authenticode-signed binary files.

How to obtain this update

Microsoft Download Center

The following file is available for download from the Microsoft Download Center:
For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

To apply this hotfix, you must be running Windows XP SP3 or Windows Server 2003 SP2.� For more information about how to obtain a Windows Server 2003 service pack or a Windows XP Professional x64 Edition service pack, click the following article number to view the article in the Microsoft Knowledge Base:

Registry information

To use the hotfix in this package, you do not have to make any changes to the registry.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English (United States) version of this hotfix installs files that have the attributes that are listed in the following tables. The dates and the times for these files are listed in Coordinated Universal Time (UTC). The dates and the times for these files on your local computer are displayed in your local time together with your current daylight saving time (DST) bias. Additionally, the dates and the times may change when you perform certain operations on the files.

Windows XP and Windows Server 2003 file information notes

• In addition to the files that are listed in these tables, this hotfix also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.
• This update contains the binary files for the Windows XP SP3 LDR service branch but does not contain the binary files for the Windows XP SP3 GDR service branch. This is by design. All future updates for Windows XP will also contain only the binary files for the Windows XP SP3 LDR service branch.

For all supported versions of Windows XP

For all supported x86-based versions of Windows Server 2003

For all supported x64-based versions of Windows Server 2003 and of Windows XP

For all supported IA-64-based versions of Windows Server 2003

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base: