In message <[EMAIL PROTECTED]> on Wed, 24 Mar 2004 13:37:06 +0800, "linux guy" <[EMAIL
PROTECTED]> said:
linuxguy> thx,I am sorry for that i misdescribe my problem,the
linuxguy> fact is that I can generate 256 RSA key,but I can't create
linuxguy> certificate with this key,the wrong mesg is as below:
linuxguy> 20239:error:04075070:rsa routines:RSA_sign:digest too big for rsa
key:rsa_sign.c:116:
linuxguy> 20239:error:0D072006:asn1 encoding routines:ASN1_sign:bad get asn1 object
call:a_sign.c:129:
linuxguy> well,could anyone help me?
Well, the digest that's part of the signature will be at least 160
bits (160 bits for MD5, 200 bits for SHA1). Since RSA_sign() does
PKCS1 padding, it adds at least 11 bytes (88 bits), making the size of
the message to do a private encrypt 248 or 288 bits. There would be
additional padding if the size of your key is larger. If your key is
smaller, you lose, and that's what happens to you. Unfortunately for
you, deviating from this would break standards, so you'd have to
forget SSL altogether either way.
As you can see, there's reason for the 256 bits limit.
Oh, and the message to private encrypt must have the same size as the
key. That has already been discussed here yesterday.
--
Richard Levitte \ Tunnlandsv�gen 52 \ [EMAIL PROTECTED]
[EMAIL PROTECTED] \ S-168 36 BROMMA \ T: +46-708-26 53 44
\ SWEDEN \
Procurator Odiosus Ex Infernis -- [EMAIL PROTECTED]
Member of the OpenSSL development team: http://www.openssl.org/
Unsolicited commercial email is subject to an archival fee of $400.
See <http://www.stacken.kth.se/~levitte/mail/> for more info.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
