I'm attempting to automate some checks against a large list of .NET assemblies, and want to include a test to see if the RSA parameters used to sign the assemblies are sensible. However, since I don't have access to their private keys, I'm wondering how far I can go.
At the moment I'm reporting if:
- The modulus $n$ is smaller than 1024 bits (issue)
- The exponent $e$ is not 65537 (informational)
The latter is reported due to it being unusual, rather than a flaw in the cryptography, as I've never come across a case where a signed .NET binary uses anything other than 65537.
Are there any other checks I can perform, given only this limited data?