~ubuntu-branches/ubuntu/oneiric/likewise-open/oneiric

Received: from orb.mincom.oz.au (eay@orb.mincom.oz.au [192.55.197.1]) by cygnus.mincom.oz.au (8.7.5/8.7.3) with SMTP id MAA25900 for <ssl-users@listserv.mincom.oz.au>; Mon, 30 Sep 1996 12:43:39 +1000 (EST)

Received: by orb.mincom.oz.au id AA12688

(5.65c/IDA-1.4.4 for ssl-users@listserv.mincom.oz.au); Mon, 30 Sep 1996 12:43:16 +1000

Date: Mon, 30 Sep 1996 12:43:15 +1000 (EST)

From: Eric Young <eay@mincom.com>

X-Sender: eay@orb

To: Sampo Kellomaki <sampo@neuronio.pt>

Cc: ssl-users@mincom.com, sampo@brutus.neuronio.pt

Subject: Re: Signing with envelope routines

In-Reply-To: <199609300037.BAA08729@brutus.neuronio.pt>

Message-Id: <Pine.SOL.3.91.960930121504.11800Y-100000@orb>

Mime-Version: 1.0

Content-Type: TEXT/PLAIN; charset=US-ASCII

Sender: ssl-lists-owner@mincom.com

Precedence: bulk

Status: O

X-Status:

On Mon, 30 Sep 1996, Sampo Kellomaki wrote:

> I have been trying to figure out how to produce signatures with EVP_

> routines. I seem to be able to read in private key and sign some

> data ok, but I can't figure out how I am supposed to read in

> public key so that I could verify my signature. I use self signed

> certificate.

hmm... a rather poorly documented are of the library at this point in time.

> I figured I should use

> EVP_PKEY* pkey = PEM_ASN1_read(d2i_PrivateKey, PEM_STRING_EVP_PKEY,

> fp, NULL, NULL);

> to read in private key and this seems to work Ok.

> However when I try analogous

> EVP_PKEY* pkey = PEM_ASN1_read(d2i_PublicKey, PEM_STRING_X509,

> fp, NULL, NULL);

What you should do is

X509 *x509=PEM_read_X509(fp,NULL,NULL);

/* which is the same as PEM_ASN1_read(d2i_X509,PEM_STRING_X509,fp,

* NULL,NULL); */

Then

EVP_PKEY *pkey=X509_extract_key(x509);

There is also a X509_REQ_extract_key(req);

which gets the public key from a certificate request.

I re-worked quite a bit of this when I cleaned up the dependancy on

RSA as the private key.

> I figured that the second argument to PEM_ASN1_read should match the

> name in my PEM encoded object, hence PEM_STRING_X509.

> PEM_STRING_EVP_PKEY seems to be somehow magical

> because it matches whatever private key there happens to be. I could

> not find a similar constant to use with getting the certificate, however.

:-), PEM_STRING_EVP_PKEY is 'magical' :-). In theory I should be using a

standard such as PKCS#8 to store the private key so that the type is

encoded in the asn.1 encoding of the object.

> Is my approach of using PEM_ASN1_read correct? What should I pass in

> as name? Can I use normal (or even self signed) X509 certificate for

> verifying the signature?

The actual public key is kept in the certificate, so basically you have

to load the certificate and then 'unpack' the public key from the

certificate.

> When will SSLeay documentation be written ;-)? If I would contribute

> comments to the code, would Eric take time to review them and include

> them in distribution?

:-) After SSLv3 and PKCS#7 :-). I actually started doing a function list

but what I really need to do is do quite a few 'this is how you do xyz'

type documents. I suppose the current method is to post to ssl-users and

I'll respond :-).

I'll add a 'demo' directory for the next release, I've appended a

modified version of your program that works, you were very close :-).

eric

/* sign-it.cpp - Simple test app using SSLeay envelopes to sign data

29.9.1996, Sampo Kellomaki <sampo@iki.fi> */

/* converted to C - eay :-) */

#include <stdio.h>

#include "rsa.h"

#include "evp.h"

#include "objects.h"

#include "x509.h"

#include "err.h"

#include "pem.h"

#include "ssl.h"

100

101

void main ()

102

{

103

int err;

104

int sig_len;

105

unsigned char sig_buf [4096];

106

static char certfile[] = "plain-cert.pem";

107

static char keyfile[] = "plain-key.pem";

108

static char data[] = "I owe you...";

109

EVP_MD_CTX md_ctx;

110

EVP_PKEY * pkey;

111

FILE * fp;

112

X509 * x509;

113

114

/* Just load the crypto library error strings,

115

* SSL_load_error_strings() loads the crypto AND the SSL ones */

116

/* SSL_load_error_strings();*/

117

ERR_load_crypto_strings();

118

119

/* Read private key */

120

121

fp = fopen (keyfile, "r"); if (fp == NULL) exit (1);

122

pkey = (EVP_PKEY*)PEM_ASN1_read ((char *(*)())d2i_PrivateKey,

123

PEM_STRING_EVP_PKEY,

124

fp,

125

NULL, NULL);

126

if (pkey == NULL) { ERR_print_errors_fp (stderr); exit (1); }

127

fclose (fp);

128

129

/* Do the signature */

130

131

EVP_SignInit (&md_ctx, EVP_md5());

132

EVP_SignUpdate (&md_ctx, data, strlen(data));

133

sig_len = sizeof(sig_buf);

134

err = EVP_SignFinal (&md_ctx,

135

sig_buf,

136

&sig_len,

137

pkey);

138

if (err != 1) { ERR_print_errors_fp (stderr); exit (1); }

139

EVP_PKEY_free (pkey);

140

141

/* Read public key */

142

143

fp = fopen (certfile, "r"); if (fp == NULL) exit (1);

144

x509 = (X509 *)PEM_ASN1_read ((char *(*)())d2i_X509,

145

PEM_STRING_X509,

146

fp, NULL, NULL);

147

if (x509 == NULL) { ERR_print_errors_fp (stderr); exit (1); }

148

fclose (fp);

149

150

/* Get public key - eay */

151

pkey=X509_extract_key(x509);

152

if (pkey == NULL) { ERR_print_errors_fp (stderr); exit (1); }

153

154

/* Verify the signature */

155

156

EVP_VerifyInit (&md_ctx, EVP_md5());

157

EVP_VerifyUpdate (&md_ctx, data, strlen((char*)data));

158

err = EVP_VerifyFinal (&md_ctx,

159

sig_buf,

160

sig_len,

161

pkey);

162

if (err != 1) { ERR_print_errors_fp (stderr); exit (1); }

163

EVP_PKEY_free (pkey);

164

printf ("Signature Verified Ok.\n");

165

}

166

167

168

169

170

Older »