Hi,
I do some interoperability tests between OpenSSL 0.9.5 and a commercial
crypto library under NT.
I was signing a message with the smime tool and following command line:
openssl smime -sign -signer cert.pem -in mail.txt -out signed_mail.txt
(cert.pem contains a 1024 bit RSA private key)
and I was unable to verify the signature using the commercial toolkit
for following reason:
The raw message (after PKCS #1 encoding, and just before exponentiation)
generated by OpenSSL is the
following:
01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF 00 30 21 30 09
06 05 2B 0E 03 02 1A 05 00 04 14 14 44 0A B6 53 49 25 48 25 A8 02 A3 5C
7C 1A 8C D1 14 F9 00
Studying the last PKCS #1 standard
(ftp://sunsite.cnlab-switch.ch/mirror/pkcs/pkcs-1/pkcs-1v2-1d1.pdf), I
remarked that the DER encoding of the hash algorithm ID and the hash
value is not correct. PKCS #1 standard says (point 9.2.1, pages 31-32)
it should be
01 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF
FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
FF FF FF 00 30 21 30
1F
06 05 2B 0E 03 02 1A 05 00 04 14 14 44 0A B6 53 49 25 48 25 A8 02 A3 5C
7C 1A 8C D1 14 F9 00
or more precisely, DER encoding of alg's ID of OpenSSL is
30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14
and the one of PKCS #1 standard is
30 21 30 1F 06 05 2B 0E 03 02 1A 05 00 04 14
The commercial crypto library rejects the OpenSSL for this purpose.
What do you think about ?
A+
Pascal
PS:
Please CC your responses to me !
--
<~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>
< Pascal Junod >
< Europay AG, Hertistr. 27, CH-8304 Wallisellen >
< [EMAIL PROTECTED] ++41 (0)1 832 93 27 >
< Privat: Ettenfeldstr. 11, CH-8052 Zürich-Seebach >
< [EMAIL PROTECTED] ++41 (0)1 302 14 10 >
<~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~>
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
