<div dir="ltr">Hi Matt,<div><br></div><div>Thanks so much for your replies. Got my signature verification to fail which makes me happy :-)<br></div><div><br></div><div>The only remaining question is:</div><div><br></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px">> 4 - In general, is there a way of making the Signature/Encryptions in</span><br style="color:rgb(80,0,80);font-size:12.800000190734863px"><span style="color:rgb(80,0,80);font-size:12.800000190734863px">> OpenSSL be deterministic for debugging/testing purposes? ></span><br style="color:rgb(80,0,80);font-size:12.800000190734863px"></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px"><br></span></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px">Any ideas or thoughts?</span></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px"><br></span></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px">cheers,</span></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px">Gelareh</span></div><div><span style="color:rgb(80,0,80);font-size:12.800000190734863px"><br></span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 29, 2017 at 10:07 AM, Matt Caswell <span dir="ltr"><<a href="mailto:matt@openssl.org" target="_blank">matt@openssl.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Some comments inserted below.<br>
<br>
Matt<br>
<span class=""><br>
On 29/12/17 15:20, Gelareh Taban wrote:<br>
> Hi all,<br>
><br>
> Any help would be *much* appreciated. I am playing around with RSA<br>
> signatures with different padding options and I have some questions.<br>
><br>
> I am trying to define different padding options and so am defining and<br>
> using a EVP_PKEY_CTX . However I am not sure if this padding is getting<br>
> used in the signature since my Verify outputs OK regardless of which<br>
> option my Sign uses. Which leads to:<br>
><br>
> 1 - Do I need to use a EVP_PKEY_CTX with the same options when doing<br>
> verify? If so, I assume I can't reuse the same PKey_Ctx and I have to<br>
> define another one. Right now even when I don't use any EVP_PKEY_CTX in<br>
> Verify, I still verify OK, which makes me question if the padding option<br>
> has been set.<br>
<br>
</span>It hasn't. The call to EVP_DigestSignInit() expects an EVP_PKEY_CTX **.<br>
This is because that function creates its *own* EVP_PKEY_CTX * and<br>
stores it in the location you provide (if you give one). In your code<br>
the EVP_PKEY_CTX you are creating is being overwritten by the one<br>
created by EVP_DigestSignInit(). From the documentation:<br>
<br>
EVP_DigestSignInit() sets up signing context ctx to use digest type<br>
from ENGINE impl and private key pkey. ctx must be created with<br>
EVP_MD_CTX_new() before calling this function. If pctx is not NULL the<br>
EVP_PKEY_CTX of the signing operation will be written to *pctx: this<br>
can be used to set alternative signing options.<br>
<br>
Try removing the creation of your own EVP_PKEY_CTX *, and moving the<br>
EVP_PKEY_CTX_set_rsa_padding() call to after EVP_DigestSignInit().<br>
<span class=""><br>
><br>
> 2 - Is there a way to figure out what padding/hashing/etc option was<br>
> used for the Sign/verify operation? This way I can be sure what<br>
> algorithm or standard is being used. <br>
><br>
> 3 - Do I need to set the hash function I am using in both EVP_PKEY_CTX <br>
> as well as EVP_MD_CTX ? Or the latter is what defines this for the<br>
> signing option?<br>
<br>
</span>You only need to specify the hash function in<br>
EVP_DigestSignInit()/EVP_<wbr>DigestVerifyInit().<br>
<br>
To answer your question in the code, there is no need to call<br>
EVP_PKEY_CTX_set_signature_md(<wbr>) directly in this scenario. It is called<br>
for you by EVP_DigestSignInit()/EVP_<wbr>DigestVerifyInit().<br>
<span class=""><br>
><br>
> 4 - In general, is there a way of making the Signature/Encryptions in<br>
> OpenSSL be deterministic for debugging/testing purposes? ><br>
> 5 - I noticed that there are two ways of determining the signature size:<br>
> (a) by calling EVP_PKEY_size(<wbr>rsaKeypair) as I am doing below, as well as<br>
> (b) calling EVP_DigestSignFinal(<wbr>md_ctx, nil, &sig_len) . Is one better<br>
> than the other?<br>
<br>
</span>The former gives you a maximum bound on the size of the signature before<br>
the signature is created. The latter gives you the *actual* size of the<br>
signature that is generated (which could be smaller).<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
><br>
> My sample code is below for reference. It's in Swift (but it should<br>
> still be close enough to C to be readable). Also in Swift, some of the<br>
> complex macros in OpenSSL have to be broken down to be compilable hence<br>
> my usage of EVP_DigestUpdate instead of EVP_DigestVerifyUpdate .<br>
><br>
> Thanks in advance for any insight in the above.<br>
><br>
> cheers!<br>
> Gelareh<br>
><br>
><br>
> let md_ctx = EVP_MD_CTX_create()<br>
><br>
> let md_ctx_verify = EVP_MD_CTX_create()<br>
><br>
> <br>
><br>
> // To define padding option used in signature<br>
><br>
> let pkey_ctx = EVP_PKEY_CTX_new(rsaKeypair, nil)<br>
><br>
> <br>
><br>
> // EVP_PKEY_CTX_set_rsa_padding(<wbr>pkey_ctx, RSA_PKCS1_PADDING) -<br>
> complex macro needs to be replaced<br>
><br>
> EVP_PKEY_CTX_ctrl(pkey_ctx, EVP_PKEY_RSA, -1,<br>
> EVP_PKEY_CTRL_RSA_PADDING, RSA_X931_PADDING, nil)<br>
><br>
><br>
> // EVP_PKEY_CTX_set_signature_md(<wbr>) When should this be set?<br>
><br>
> <br>
><br>
> // SIGN<br>
><br>
> var rc = EVP_DigestSignInit(md_ctx, &pkey_ctx, EVP_sha256(),<br>
> nil, myRSA.rsaKeypair)<br>
><br>
> // EVP_DigestSignUpdate(md_ctx, message, message.count)<br>
><br>
> // Complex macro needs to be replaced<br>
><br>
> rc = EVP_DigestUpdate(md_ctx, message, message.count)<br>
><br>
> <br>
><br>
> // allocate memory for signature<br>
><br>
> var sig_len: Int = Int(EVP_PKEY_size(<wbr>rsaKeypair))<br>
><br>
> let sig = UnsafeMutablePointer<UInt8>.<wbr>allocate(capacity: sig_len)<br>
><br>
><br>
> rc = EVP_DigestSignFinal(md_ctx, sig, &sig_len)<br>
><br>
> <br>
><br>
> <br>
><br>
> // VERIFY<br>
><br>
> rc = EVP_DigestVerifyInit(md_ctx_<wbr>verify, nil, EVP_sha256(), nil,<br>
> rsaKeypair)<br>
><br>
><br>
> // rc = EVP_DigestVerifyUpdate(md_ctx_<wbr>verify, message,<br>
> message.count)<br>
><br>
> rc = EVP_DigestUpdate(md_ctx_<wbr>verify, message, message.count)<br>
><br>
> <br>
><br>
> rc = EVP_DigestVerifyFinal(md_ctx_<wbr>verify, sig, sig_len)<br>
><br>
> print("signature verified = \(rc == 1? "OK": "FAIL")")<br>
><br>
> <br>
><br>
><br>
><br>
><br>
><br>
><br>
><br>
</div></div><span class="HOEnZb"><font color="#888888">--<br>
openssl-users mailing list<br>
To unsubscribe: <a href="https://mta.openssl.org/mailman/listinfo/openssl-users" rel="noreferrer" target="_blank">https://mta.openssl.org/<wbr>mailman/listinfo/openssl-users</a><br>
</font></span></blockquote></div><br></div>