Windows CNG（下一代加密技术）NCryptSignHash 生成的 RSA SHA512 签名与 openssl RSA_sign 生成的签名不匹配
RSA SHA512 signature generated by Windows CNG(Cryptography Next generation ) NCryptSignHash not matching with signature generated by openssl RSA_sign
我们正在尝试使用 CNG 生成 RSA SHA512 签名，我们编写的代码和生成的哈希值与 OpenSSL 不匹配。
我们使用 OpenSSL 命令以 DER 格式生成的用于签名的私钥如下。
openssl genpkey -out privkey.pem -algorithm rsa
openssl pkcs8 -topk8 -inform PEM -outform DER -in privkey.pem -out privkey.der -nocrypt
openssl rsa -in privkey.pem -pubout -outform DER -out pubkey.der
使用下面的代码生成带有 Windows CNG 的签名：
#include<stdio.h>
#include<windows.h>
#include<wincrypt.h>
#pragma comment (lib, "crypt32")
#pragma comment(lib, "ncrypt.lib")
#include<ntstatus.h>
void
isi_hexdump(const char *msg, const unsigned char *in, unsigned int len)
{
printf("%s [%d][", msg, len);
for (; len > 0; len--, in++) {
printf("%02X", *in);
}
printf("]\n");
}
static int
readBinFile(unsigned char **buffer, char *file, long *size)
{
FILE *fp;
size_t foo;
printf("\n inside readBinFile");
fp = fopen(file,"rb");
if (fp == NULL) {
printf("Error: reading the file %s\n", file);
return -1;
}
fseek(fp, 0, SEEK_END);
*size = ftell(fp);
fseek(fp, 0, SEEK_SET);
*buffer = malloc(*size);
if ((foo = fread(*buffer, 1, *size, fp)) != *size)
{
printf("Error: reading the file to buffer %s:%ld\n", file, *size);
return -1;
}
printf("\n exit from readBinFile <%s>",*buffer);
isi_hexdump("Pavan char at :",*buffer,*size);
return 0;
}
NTSTATUS
ComputeHash(
_In_reads_bytes_(DataLength)
PBYTE Data,
_In_ DWORD DataLength,
_Outptr_result_bytebuffer_maybenull_(*DataDigestLengthPointer)
PBYTE *DataDigestPointer,
_Out_ DWORD *DataDigestLengthPointer
)
{
NTSTATUS Status;
BCRYPT_ALG_HANDLE HashAlgHandle = NULL;
BCRYPT_HASH_HANDLE HashHandle = NULL;
PBYTE HashDigest = NULL;
DWORD HashDigestLength = 0;
DWORD ResultLength = 0;
*DataDigestPointer = NULL;
*DataDigestLengthPointer = 0;
//
// Open a Hash algorithm handle
//
Status = BCryptOpenAlgorithmProvider(
&HashAlgHandle,
BCRYPT_SHA512_ALGORITHM,
NULL,
0);
if(Status)
{
}
//
// Calculate the length of the Hash
//
Status= BCryptGetProperty(
HashAlgHandle,
BCRYPT_HASH_LENGTH,
(PBYTE)&HashDigestLength,
sizeof(HashDigestLength),
&ResultLength,
0);
if(Status)
{
}
//allocate the Hash buffer on the heap
HashDigest = (PBYTE)HeapAlloc (GetProcessHeap (), 0, HashDigestLength);
if( NULL == HashDigest )
{
printf("\nNO memory");
Status = STATUS_NO_MEMORY;
}
//
// Create a Hash
//
Status = BCryptCreateHash(
HashAlgHandle,
&HashHandle,
NULL,
0,
NULL,
0,
0);
if(Status)
{
}
//
// Hash Data(s)
//
Status = BCryptHashData(
HashHandle,
(PBYTE)Data,
DataLength,
0);
/* Status = BCryptHashData(
HashHandle,
(PBYTE)Data,
sizeof(Data),
0); */
if(Status)
{
}
//
// Close the Hash
//
Status = BCryptFinishHash(
HashHandle,
HashDigest,
HashDigestLength,
0);
if(Status)
{
}
isi_hexdump("Digest :",HashDigest,HashDigestLength);
*DataDigestPointer = HashDigest;
HashDigest = NULL;
*DataDigestLengthPointer = HashDigestLength;
Status = 0;
cleanup:
if( NULL != HashDigest )
{
HeapFree( GetProcessHeap(), 0, HashDigest );
HashDigest = NULL;
}
if( NULL != HashHandle )
{
Status = BCryptDestroyHash(HashHandle);
HashHandle = NULL;
}
if( NULL != HashAlgHandle )
{
BCryptCloseAlgorithmProvider(HashAlgHandle,0);
}
return Status;
}
int main()
{
long privksize = 0;
unsigned char *privkey = NULL;
if (readBinFile(&privkey, "privkey.der", &privksize) != 0)
return 1;
CRYPT_DECODE_PARA decode_para = {0, 0, 0};
BCRYPT_RSAKEY_BLOB *rsa_private_key = NULL;
DWORD rsa_private_key_size = 0;
BOOL ret_val = FALSE;
PCRYPT_PRIVATE_KEY_INFO PrivateKeyInfo;
ret_val = CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
PKCS_PRIVATE_KEY_INFO,
privkey,
privksize,
CRYPT_DECODE_ALLOC_FLAG|CRYPT_DECODE_NOCOPY_FLAG,
0,
(void**)&PrivateKeyInfo,
&rsa_private_key_size);
if(!ret_val)
{
printf("\nCryptDecodeObjectEx() Failed : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
else
{
printf("\nCryptDecodeObjectEx() Success : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
ret_val = CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
CNG_RSA_PRIVATE_KEY_BLOB,
PrivateKeyInfo->PrivateKey.pbData,
PrivateKeyInfo->PrivateKey.cbData,
CRYPT_DECODE_ALLOC_FLAG,
0,
(void**)&rsa_private_key,
&rsa_private_key_size);
if(!ret_val)
{
printf("\nCryptDecodeObjectEx() Failed : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
else
{
printf("\nCryptDecodeObjectEx() Success : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
LocalFree(PrivateKeyInfo);
BCRYPT_KEY_HANDLE phKey;
NCRYPT_PROV_HANDLE hProvider = 0;
if (NCryptOpenStorageProvider(
&hProvider,
MS_KEY_STORAGE_PROVIDER,
0)) {
printf("\nNCryptOpenStorageProvider() Failed : status <0x%x>",GetLastError());
}
NCRYPT_KEY_HANDLE hKeyNew = 0;
NTSTATUS Status;
if (NCryptImportKey(hProvider,
0,
BCRYPT_RSAPRIVATE_BLOB,
//NCRYPT_PKCS8_PRIVATE_KEY_BLOB,
NULL,
&hKeyNew,
(BYTE *)rsa_private_key,
rsa_private_key_size,
NCRYPT_DO_NOT_FINALIZE_FLAG)) {
printf("\nNCryptOpenStorageProvider() Failed : status <0x%x>",GetLastError());
}
DWORD export_policy = NCRYPT_ALLOW_EXPORT_FLAG | NCRYPT_ALLOW_PLAINTEXT_EXPORT_FLAG;
if (NCryptSetProperty(hKeyNew,
NCRYPT_EXPORT_POLICY_PROPERTY,
(PBYTE)&export_policy,
sizeof(export_policy),
NCRYPT_PERSIST_FLAG)) {
printf("\nFailed to NCryptSetProperty");
}
if(NCryptFinalizeKey(hKeyNew, 0)) {
printf("\nFailed to NCryptFinalizeKey");
}
PBYTE MessageDigest = NULL;
DWORD MessageDigestLength = 0;
PBYTE MessageToSign = "1234567890123456789012345678901234567890123456789012345678901234";
DWORD MessageLength = strlen(MessageToSign);
Status = ComputeHash(MessageToSign,
MessageLength,
&MessageDigest,
&MessageDigestLength);
if( Status )
{
printf("\nFailed to calculate hash");
}
printf("\n hashvalue \n");
isi_hexdump("Digest :",MessageDigest,MessageDigestLength);
PBYTE SignatureBlob = NULL;
DWORD SignatureBlobLength = 0;
DWORD ResultLength = 0;
BCRYPT_PKCS1_PADDING_INFO PKCS1PaddingInfo = {0};
PKCS1PaddingInfo.pszAlgId = BCRYPT_SHA512_ALGORITHM;
Status = NCryptSignHash(
hKeyNew, // Key handle used to sign the hash
&PKCS1PaddingInfo, // Padding information
MessageDigest, // Hash of the message
MessageDigestLength, // Length of the hash
NULL, // Signed hash buffer
0, // Length of the signature(signed hash value)
&SignatureBlobLength, // Number of bytes copied to the signature buffer
BCRYPT_PAD_PKCS1);
if( Status)
{
printf("\nFailed******** 1");
}
printf("\nPavan sign length <%d>",SignatureBlobLength);
//allocate the signature buffer
SignatureBlob = (PBYTE)HeapAlloc (GetProcessHeap (), 0, SignatureBlobLength);
if( NULL == SignatureBlob )
{
Status = NTE_NO_MEMORY;
printf("\nFailed******** 1.0");
}
memset(SignatureBlob, '[=13=]', SignatureBlobLength);
Status = NCryptSignHash(
hKeyNew, // Key handle used to sign the hash
&PKCS1PaddingInfo, // Padding information
MessageDigest, // Hash of the message
MessageDigestLength, // Length of the hash
SignatureBlob, // Signed hash buffer
SignatureBlobLength, // Length of the signature(signed hash value)
&SignatureBlobLength, // Number of bytes copied to the signature buffer
BCRYPT_PAD_PKCS1);
if( Status)
{
printf("\nFailed******** 2 status <0x%x>",Status);
}
else
{
printf("\nSuccess NCryptSignHash");
}
isi_hexdump("Signature :",SignatureBlob,SignatureBlobLength);
return 0;
}
Windows CNG 生成的签名：
NCryptSignHashSignature : [256][6B1CA169DA91DA0CEC2485E571B3EEA1595A94C3B15CA46DF3348E515E28516E3F7E7D9FBC7BC554D294DA994681301FF786058E453EFAA1B713B6D69C6A9C284289B6605B4FB1FD1F95A03632C2A4303D375DB60B6041F93E1E6BC9A2D4F9E1B46756D5CFE1D2054C602913ED905427B76BD9279E08716F7D1FF91897E08577046B3E9AF34A65C8D80C38FAF055CFFB26F1FB49E03070278B56555673729F80514F3A5BB8382C143EB1FA20F0519FD86435CB9333615378F05F0EE17C6824F0C2CA50A3AA65C4BBDBE50652CB0500A7438ECBBA77B9B6D1BB1BA1A86597CA630B4BD7AA132BC661ED66D8B64A06C96822E0FE87080AFDF2FB00CB79583AD95D]
使用以下代码通过 Openssl 生成签名：
#include<stdio.h>
#include<windows.h>
#include <openssl/opensslv.h>
#include <openssl/evp.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/des.h>
#include <openssl/ssl.h>
#include<wincrypt.h>
void
isi_hexdump(const char *msg, const unsigned char *in, unsigned int len)
{
printf("%s [%d][", msg, len);
for (; len > 0; len--, in++) {
printf("%02X", *in);
}
printf("]\n");
}
static int
readBinFile(unsigned char **buffer, char *file, long *size)
{
FILE *fp;
size_t foo;
printf("\n inside readBinFile");
fp = fopen(file,"rb");
if (fp == NULL) {
printf("Error: reading the file %s\n", file);
return -1;
}
fseek(fp, 0, SEEK_END);
*size = ftell(fp);
fseek(fp, 0, SEEK_SET);
*buffer = malloc(*size);
if ((foo = fread(*buffer, 1, *size, fp)) != *size)
{
printf("Error: reading the file to buffer %s:%ld\n", file, *size);
return -1;
}
printf("\nExit from readBinFile <%s>",*buffer);
return 0;
}
int main()
{
unsigned char *privkey = NULL;
unsigned char *pubkey = NULL;
unsigned char *sig = NULL;
long privksize, pubksize;
unsigned int sigSize;
char srcstr[] = "1234567890123456789012345678901234567890123456789012345678901234";
int verified = -1;
if (readBinFile(&privkey, "privkey.der", &privksize) != 0)
return 1;
if (readBinFile(&pubkey, "pubkey.der", &pubksize) != 0)
return 1;
printf("data='%s'\n", srcstr);
sig = calloc(1, sigSize);
EVP_PKEY *private_key = NULL;
RSA *rsa = NULL;
if ((private_key = d2i_AutoPrivateKey(NULL, &privkey, privksize)) == NULL) {
printf("\nFailed d2i_AutoPrivateKey ");
}
sigSize = EVP_PKEY_size(private_key);
sig = calloc(1, sigSize);
if ((rsa = EVP_PKEY_get1_RSA(private_key)) == NULL) {
printf("\nFailed EVP_PKEY_get1_RSA ");
}
if ((RSA_sign(EVP_MD_type(EVP_sha512()),
srcstr, strlen(srcstr), sig, &sigSize, rsa)) != 1) {
printf("\nFailed RSA_sign");
}
isi_hexdump("OpenSSL sig",sig,sigSize);
return 0;
}
Signature with OpenSSL: 045F86E2D7AFE8001A42A1B113F60F7B96513DB829034DF6BAA27D5E7A13AF52896FBD4DE870D0C3F6734AE8AB061BA6959500BF1473F8726E0CB2819A3FC14318AE3CEFED15AA43C82339290A88EBAE363507FE835A02110D5CE8ABF9594F9195AA8033DCD78C10AA589C9BC523A138655E8485C87A8AB4FAE77ED5DA4268C1BC373A9B1C88572AEB3FD020BBF891FAFE223F3DE5FF89E56B7A916663D76303FAD7C69F2014ACF0FB6418305426FB6CAFF6C332126DF138D7FF9220B0B384BD3A053AA123A521D0AACC5D474AD2A2D06416F38647BC0B4F6AE25AA7BBAC3F7DF6BAFFB9EE8EB4E8E00D4C67252E2C2CAFEDB2F344424B9034371FDDA6C8D152
我们还尝试使用 OpenSSL 生成签名并使用 NCryptVerifySignature windows CNG API 对其进行验证，但验证失败。
两种代码的签名方法都没有隐式散列，即必须传递已经散列的数据。这对 CNG 代码是满意的，但对 OpenSSL 代码不满意。
对于 OpenSSL 代码，可以按如下方式确定和应用哈希：
...
char srcstr[] = "1234567890123456789012345678901234567890123456789012345678901234";
unsigned char* digest;
unsigned int digLen;
digest_message((const unsigned char*)srcstr, strlen((const char*)srcstr), &digest, &digLen);
...
if ((RSA_sign(EVP_MD_type(EVP_sha512()), digest, digLen, sig, &sigSize, rsa)) != 1) {
...
与
void digest_message(const unsigned char* message, size_t message_len, unsigned char** digest, unsigned int* digest_len)
{
EVP_MD_CTX* mdctx = EVP_MD_CTX_new();
EVP_DigestInit_ex(mdctx, EVP_sha512(), NULL);
EVP_DigestUpdate(mdctx, message, message_len);
*digest = (unsigned char*)OPENSSL_malloc(EVP_MD_size(EVP_sha512()));
EVP_DigestFinal_ex(mdctx, *digest, digest_len);
EVP_MD_CTX_free(mdctx);
}
来自 OpenSSL 文档的example。
通过此更改，两个代码在我的机器上提供了相同的签名（正如 RSASSA-PKCS1-v1_5 所预期的那样）。
我们正在尝试使用 CNG 生成 RSA SHA512 签名，我们编写的代码和生成的哈希值与 OpenSSL 不匹配。
我们使用 OpenSSL 命令以 DER 格式生成的用于签名的私钥如下。
openssl genpkey -out privkey.pem -algorithm rsa
openssl pkcs8 -topk8 -inform PEM -outform DER -in privkey.pem -out privkey.der -nocrypt
openssl rsa -in privkey.pem -pubout -outform DER -out pubkey.der
使用下面的代码生成带有 Windows CNG 的签名：
#include<stdio.h>
#include<windows.h>
#include<wincrypt.h>
#pragma comment (lib, "crypt32")
#pragma comment(lib, "ncrypt.lib")
#include<ntstatus.h>
void
isi_hexdump(const char *msg, const unsigned char *in, unsigned int len)
{
printf("%s [%d][", msg, len);
for (; len > 0; len--, in++) {
printf("%02X", *in);
}
printf("]\n");
}
static int
readBinFile(unsigned char **buffer, char *file, long *size)
{
FILE *fp;
size_t foo;
printf("\n inside readBinFile");
fp = fopen(file,"rb");
if (fp == NULL) {
printf("Error: reading the file %s\n", file);
return -1;
}
fseek(fp, 0, SEEK_END);
*size = ftell(fp);
fseek(fp, 0, SEEK_SET);
*buffer = malloc(*size);
if ((foo = fread(*buffer, 1, *size, fp)) != *size)
{
printf("Error: reading the file to buffer %s:%ld\n", file, *size);
return -1;
}
printf("\n exit from readBinFile <%s>",*buffer);
isi_hexdump("Pavan char at :",*buffer,*size);
return 0;
}
NTSTATUS
ComputeHash(
_In_reads_bytes_(DataLength)
PBYTE Data,
_In_ DWORD DataLength,
_Outptr_result_bytebuffer_maybenull_(*DataDigestLengthPointer)
PBYTE *DataDigestPointer,
_Out_ DWORD *DataDigestLengthPointer
)
{
NTSTATUS Status;
BCRYPT_ALG_HANDLE HashAlgHandle = NULL;
BCRYPT_HASH_HANDLE HashHandle = NULL;
PBYTE HashDigest = NULL;
DWORD HashDigestLength = 0;
DWORD ResultLength = 0;
*DataDigestPointer = NULL;
*DataDigestLengthPointer = 0;
//
// Open a Hash algorithm handle
//
Status = BCryptOpenAlgorithmProvider(
&HashAlgHandle,
BCRYPT_SHA512_ALGORITHM,
NULL,
0);
if(Status)
{
}
//
// Calculate the length of the Hash
//
Status= BCryptGetProperty(
HashAlgHandle,
BCRYPT_HASH_LENGTH,
(PBYTE)&HashDigestLength,
sizeof(HashDigestLength),
&ResultLength,
0);
if(Status)
{
}
//allocate the Hash buffer on the heap
HashDigest = (PBYTE)HeapAlloc (GetProcessHeap (), 0, HashDigestLength);
if( NULL == HashDigest )
{
printf("\nNO memory");
Status = STATUS_NO_MEMORY;
}
//
// Create a Hash
//
Status = BCryptCreateHash(
HashAlgHandle,
&HashHandle,
NULL,
0,
NULL,
0,
0);
if(Status)
{
}
//
// Hash Data(s)
//
Status = BCryptHashData(
HashHandle,
(PBYTE)Data,
DataLength,
0);
/* Status = BCryptHashData(
HashHandle,
(PBYTE)Data,
sizeof(Data),
0); */
if(Status)
{
}
//
// Close the Hash
//
Status = BCryptFinishHash(
HashHandle,
HashDigest,
HashDigestLength,
0);
if(Status)
{
}
isi_hexdump("Digest :",HashDigest,HashDigestLength);
*DataDigestPointer = HashDigest;
HashDigest = NULL;
*DataDigestLengthPointer = HashDigestLength;
Status = 0;
cleanup:
if( NULL != HashDigest )
{
HeapFree( GetProcessHeap(), 0, HashDigest );
HashDigest = NULL;
}
if( NULL != HashHandle )
{
Status = BCryptDestroyHash(HashHandle);
HashHandle = NULL;
}
if( NULL != HashAlgHandle )
{
BCryptCloseAlgorithmProvider(HashAlgHandle,0);
}
return Status;
}
int main()
{
long privksize = 0;
unsigned char *privkey = NULL;
if (readBinFile(&privkey, "privkey.der", &privksize) != 0)
return 1;
CRYPT_DECODE_PARA decode_para = {0, 0, 0};
BCRYPT_RSAKEY_BLOB *rsa_private_key = NULL;
DWORD rsa_private_key_size = 0;
BOOL ret_val = FALSE;
PCRYPT_PRIVATE_KEY_INFO PrivateKeyInfo;
ret_val = CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
PKCS_PRIVATE_KEY_INFO,
privkey,
privksize,
CRYPT_DECODE_ALLOC_FLAG|CRYPT_DECODE_NOCOPY_FLAG,
0,
(void**)&PrivateKeyInfo,
&rsa_private_key_size);
if(!ret_val)
{
printf("\nCryptDecodeObjectEx() Failed : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
else
{
printf("\nCryptDecodeObjectEx() Success : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
ret_val = CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
CNG_RSA_PRIVATE_KEY_BLOB,
PrivateKeyInfo->PrivateKey.pbData,
PrivateKeyInfo->PrivateKey.cbData,
CRYPT_DECODE_ALLOC_FLAG,
0,
(void**)&rsa_private_key,
&rsa_private_key_size);
if(!ret_val)
{
printf("\nCryptDecodeObjectEx() Failed : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
else
{
printf("\nCryptDecodeObjectEx() Success : status <0x%x>, ret val <%d>",GetLastError(), ret_val);
}
LocalFree(PrivateKeyInfo);
BCRYPT_KEY_HANDLE phKey;
NCRYPT_PROV_HANDLE hProvider = 0;
if (NCryptOpenStorageProvider(
&hProvider,
MS_KEY_STORAGE_PROVIDER,
0)) {
printf("\nNCryptOpenStorageProvider() Failed : status <0x%x>",GetLastError());
}
NCRYPT_KEY_HANDLE hKeyNew = 0;
NTSTATUS Status;
if (NCryptImportKey(hProvider,
0,
BCRYPT_RSAPRIVATE_BLOB,
//NCRYPT_PKCS8_PRIVATE_KEY_BLOB,
NULL,
&hKeyNew,
(BYTE *)rsa_private_key,
rsa_private_key_size,
NCRYPT_DO_NOT_FINALIZE_FLAG)) {
printf("\nNCryptOpenStorageProvider() Failed : status <0x%x>",GetLastError());
}
DWORD export_policy = NCRYPT_ALLOW_EXPORT_FLAG | NCRYPT_ALLOW_PLAINTEXT_EXPORT_FLAG;
if (NCryptSetProperty(hKeyNew,
NCRYPT_EXPORT_POLICY_PROPERTY,
(PBYTE)&export_policy,
sizeof(export_policy),
NCRYPT_PERSIST_FLAG)) {
printf("\nFailed to NCryptSetProperty");
}
if(NCryptFinalizeKey(hKeyNew, 0)) {
printf("\nFailed to NCryptFinalizeKey");
}
PBYTE MessageDigest = NULL;
DWORD MessageDigestLength = 0;
PBYTE MessageToSign = "1234567890123456789012345678901234567890123456789012345678901234";
DWORD MessageLength = strlen(MessageToSign);
Status = ComputeHash(MessageToSign,
MessageLength,
&MessageDigest,
&MessageDigestLength);
if( Status )
{
printf("\nFailed to calculate hash");
}
printf("\n hashvalue \n");
isi_hexdump("Digest :",MessageDigest,MessageDigestLength);
PBYTE SignatureBlob = NULL;
DWORD SignatureBlobLength = 0;
DWORD ResultLength = 0;
BCRYPT_PKCS1_PADDING_INFO PKCS1PaddingInfo = {0};
PKCS1PaddingInfo.pszAlgId = BCRYPT_SHA512_ALGORITHM;
Status = NCryptSignHash(
hKeyNew, // Key handle used to sign the hash
&PKCS1PaddingInfo, // Padding information
MessageDigest, // Hash of the message
MessageDigestLength, // Length of the hash
NULL, // Signed hash buffer
0, // Length of the signature(signed hash value)
&SignatureBlobLength, // Number of bytes copied to the signature buffer
BCRYPT_PAD_PKCS1);
if( Status)
{
printf("\nFailed******** 1");
}
printf("\nPavan sign length <%d>",SignatureBlobLength);
//allocate the signature buffer
SignatureBlob = (PBYTE)HeapAlloc (GetProcessHeap (), 0, SignatureBlobLength);
if( NULL == SignatureBlob )
{
Status = NTE_NO_MEMORY;
printf("\nFailed******** 1.0");
}
memset(SignatureBlob, '[=13=]', SignatureBlobLength);
Status = NCryptSignHash(
hKeyNew, // Key handle used to sign the hash
&PKCS1PaddingInfo, // Padding information
MessageDigest, // Hash of the message
MessageDigestLength, // Length of the hash
SignatureBlob, // Signed hash buffer
SignatureBlobLength, // Length of the signature(signed hash value)
&SignatureBlobLength, // Number of bytes copied to the signature buffer
BCRYPT_PAD_PKCS1);
if( Status)
{
printf("\nFailed******** 2 status <0x%x>",Status);
}
else
{
printf("\nSuccess NCryptSignHash");
}
isi_hexdump("Signature :",SignatureBlob,SignatureBlobLength);
return 0;
}
Windows CNG 生成的签名：
NCryptSignHashSignature : [256][6B1CA169DA91DA0CEC2485E571B3EEA1595A94C3B15CA46DF3348E515E28516E3F7E7D9FBC7BC554D294DA994681301FF786058E453EFAA1B713B6D69C6A9C284289B6605B4FB1FD1F95A03632C2A4303D375DB60B6041F93E1E6BC9A2D4F9E1B46756D5CFE1D2054C602913ED905427B76BD9279E08716F7D1FF91897E08577046B3E9AF34A65C8D80C38FAF055CFFB26F1FB49E03070278B56555673729F80514F3A5BB8382C143EB1FA20F0519FD86435CB9333615378F05F0EE17C6824F0C2CA50A3AA65C4BBDBE50652CB0500A7438ECBBA77B9B6D1BB1BA1A86597CA630B4BD7AA132BC661ED66D8B64A06C96822E0FE87080AFDF2FB00CB79583AD95D]
使用以下代码通过 Openssl 生成签名：
#include<stdio.h>
#include<windows.h>
#include <openssl/opensslv.h>
#include <openssl/evp.h>
#include <openssl/crypto.h>
#include <openssl/err.h>
#include <openssl/rand.h>
#include <openssl/des.h>
#include <openssl/ssl.h>
#include<wincrypt.h>
void
isi_hexdump(const char *msg, const unsigned char *in, unsigned int len)
{
printf("%s [%d][", msg, len);
for (; len > 0; len--, in++) {
printf("%02X", *in);
}
printf("]\n");
}
static int
readBinFile(unsigned char **buffer, char *file, long *size)
{
FILE *fp;
size_t foo;
printf("\n inside readBinFile");
fp = fopen(file,"rb");
if (fp == NULL) {
printf("Error: reading the file %s\n", file);
return -1;
}
fseek(fp, 0, SEEK_END);
*size = ftell(fp);
fseek(fp, 0, SEEK_SET);
*buffer = malloc(*size);
if ((foo = fread(*buffer, 1, *size, fp)) != *size)
{
printf("Error: reading the file to buffer %s:%ld\n", file, *size);
return -1;
}
printf("\nExit from readBinFile <%s>",*buffer);
return 0;
}
int main()
{
unsigned char *privkey = NULL;
unsigned char *pubkey = NULL;
unsigned char *sig = NULL;
long privksize, pubksize;
unsigned int sigSize;
char srcstr[] = "1234567890123456789012345678901234567890123456789012345678901234";
int verified = -1;
if (readBinFile(&privkey, "privkey.der", &privksize) != 0)
return 1;
if (readBinFile(&pubkey, "pubkey.der", &pubksize) != 0)
return 1;
printf("data='%s'\n", srcstr);
sig = calloc(1, sigSize);
EVP_PKEY *private_key = NULL;
RSA *rsa = NULL;
if ((private_key = d2i_AutoPrivateKey(NULL, &privkey, privksize)) == NULL) {
printf("\nFailed d2i_AutoPrivateKey ");
}
sigSize = EVP_PKEY_size(private_key);
sig = calloc(1, sigSize);
if ((rsa = EVP_PKEY_get1_RSA(private_key)) == NULL) {
printf("\nFailed EVP_PKEY_get1_RSA ");
}
if ((RSA_sign(EVP_MD_type(EVP_sha512()),
srcstr, strlen(srcstr), sig, &sigSize, rsa)) != 1) {
printf("\nFailed RSA_sign");
}
isi_hexdump("OpenSSL sig",sig,sigSize);
return 0;
}
Signature with OpenSSL: 045F86E2D7AFE8001A42A1B113F60F7B96513DB829034DF6BAA27D5E7A13AF52896FBD4DE870D0C3F6734AE8AB061BA6959500BF1473F8726E0CB2819A3FC14318AE3CEFED15AA43C82339290A88EBAE363507FE835A02110D5CE8ABF9594F9195AA8033DCD78C10AA589C9BC523A138655E8485C87A8AB4FAE77ED5DA4268C1BC373A9B1C88572AEB3FD020BBF891FAFE223F3DE5FF89E56B7A916663D76303FAD7C69F2014ACF0FB6418305426FB6CAFF6C332126DF138D7FF9220B0B384BD3A053AA123A521D0AACC5D474AD2A2D06416F38647BC0B4F6AE25AA7BBAC3F7DF6BAFFB9EE8EB4E8E00D4C67252E2C2CAFEDB2F344424B9034371FDDA6C8D152
我们还尝试使用 OpenSSL 生成签名并使用 NCryptVerifySignature windows CNG API 对其进行验证，但验证失败。
两种代码的签名方法都没有隐式散列，即必须传递已经散列的数据。这对 CNG 代码是满意的，但对 OpenSSL 代码不满意。
对于 OpenSSL 代码，可以按如下方式确定和应用哈希：
...
char srcstr[] = "1234567890123456789012345678901234567890123456789012345678901234";
unsigned char* digest;
unsigned int digLen;
digest_message((const unsigned char*)srcstr, strlen((const char*)srcstr), &digest, &digLen);
...
if ((RSA_sign(EVP_MD_type(EVP_sha512()), digest, digLen, sig, &sigSize, rsa)) != 1) {
...
与
void digest_message(const unsigned char* message, size_t message_len, unsigned char** digest, unsigned int* digest_len)
{
EVP_MD_CTX* mdctx = EVP_MD_CTX_new();
EVP_DigestInit_ex(mdctx, EVP_sha512(), NULL);
EVP_DigestUpdate(mdctx, message, message_len);
*digest = (unsigned char*)OPENSSL_malloc(EVP_MD_size(EVP_sha512()));
EVP_DigestFinal_ex(mdctx, *digest, digest_len);
EVP_MD_CTX_free(mdctx);
}
来自 OpenSSL 文档的example。
通过此更改，两个代码在我的机器上提供了相同的签名（正如 RSASSA-PKCS1-v1_5 所预期的那样）。