On Thu, May 08, 2008, Anthony Floyd wrote: > Hi, > > I have a self-signed certificate generated by OpenSSL. I'm using Python > and various libraries (PyCrypto, tlslite) to programmatically access the > certificate. I'm not having any problems pulling the data out of the > certificate. > > Now I want to validate the certificate. My current understanding, and > please correct me if I'm wrong, is that when the certificate was > generated, its data was hashed and the hash was encrypted with the > private key. This signature is then tacked on to the end of the data > and the whole bundle of data + signature algorithm identifier + > signature is the certificate. > > So to check the signature, it should be as easy as to hash the data, > decrypt the signature with the public key and compare the two. > > Is this correct? > > I'm having some problems if that's the case. The biggest problem is > knowing how much of 'the data' to hash. At the moment I'm taking the > binary blob that is essentially the certificate in DER form and > stripping the signature and signature algorithm from the end of the > blob. I then hash the blob and compare the hash to the decrypted > signature. They don't match, so I remove one byte more, compare, and so > on. I've tried stripping only the signature and systematically removing > more and more, but still no match. >
To do that properly you do need to at least parse some of the ASN1 data. There is some header information at the start which contains the SEQUENCE tag+length bytes. The actual bit you will hash is in the middle of the data. One SEQUENCE header is deleted from the start and some data from the ends. If you parse a few tag+length bytes you can work out how much to hash and the position and length of the signature. If you use the asn1parse tool from OpenSSL it will give you lots of useful info. Steve. -- Dr Stephen N. Henson. Email, S/MIME and PGP keys: see homepage OpenSSL project core developer and freelance consultant. Homepage: http://www.drh-consultancy.demon.co.uk ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [EMAIL PROTECTED]
