On Dec 8, 2009, at 12:58 AM, Marshall Clow <[email protected]> wrote:
> At 8:35 PM -0500 12/7/09, Chris Morgan wrote: >> On Mon, Dec 7, 2009 at 6:35 AM, Charlie <[email protected]> >> wrote: >>> Hi! >>> >>> I know how to sign a string with crypto++, but, how can I sign a C >>> struct, for example, the next struct? >>> >> Why not just think of the struct as a series of bytes? Then you could >> create your signature like: >> >> struct c myc; >> thesignature = yoursignaturefunctionhere(myc, sizeof(struct c)); >> >> Then package it however you want. > > I know the answer to this one ;) > > Except in limited cases, this doesn't work - because a C/C++ struct > may have "holes" in it, where the compiler has inserted pad bytes so > that the fields are aligned for fastest access. > > Suppose you have (on some unnamed compiler) a struct that looks like > this: > struct Foo { > short s; > long l; > }; > > sizeof(struct Foo) may be 8 bytes. Two bytes for the short, two bytes > of padding, and four for the long. > If you calculate the signature over the entire structure, you will be > including the contents of the padding in the signature, and you will > never get a signature to match - except by chance. > > This is also the reason that you can't compare two structs by saying: > if ( memcmp ( &a, &b, sizeof ( struct Foo )) == 0 ) // > structs are the same! > because this also compares the contents of the pad byte, which you > have no control over. > -- > -- Marshall Yes, I had forgotten about this because I do alot of embedded work where byte packing is enabled. Two possible solutions come to mind but someone may know a better one. Add the packing pragma or gcc attribute, is one of those standard across many compilers?, to pack on a byte boundary. Or, use a c++ equivalent of a .net MemoryStream and write the bytes to a buffer and encode the buffer. Basically manual serialization and deserialization. Chris -- You received this message because you are subscribed to the "Crypto++ Users" Google Group. To unsubscribe, send an email to [email protected]. More information about Crypto++ and this group is available at http://www.cryptopp.com.
