thank you stephen,
but my already exisitng infrastructure is build on the lower level of
OpenSSL
so it was easier/better? to implement RSA_sign and RSA_verify.
Still you pointed me at the right track with your answer.
FYI i have solved my problem like this:
void CryptoMachineRSA::loadCertificate(Certificate& cert)
{
X509* x509 = utility::CertificateToX509(&cert);
EVP_PKEY* evp_pukey = X509_get_pubkey(x509);
RSA_free(this->rsa_sign);
this->rsa_sign = EVP_PKEY_get1_RSA(evp_pukey);
SSL_GUARD(this->rsa_sign == NULL);
}
it seems to be working fine loading certificates like this.
thx again for pointing me in the right direction
Michael
On Fri, Sep 11, 2009 at 6:04 PM, Dr. Stephen Henson <[email protected]>wrote:
> On Fri, Sep 11, 2009, Michael Prinzinger wrote:
>
> > Dear Group,
> >
> > I want to use the openssl crypt library to sign and verify messages.
> > Apparently I can use a RSA struct and RSA_sign and RSA_verify for that.
> >
> > however my certificates are of the form
> > -----BEGIN CERTIFICATE-----
> > MIIDDTCCAnagAwIBAgIJAMWKwoNrQvTvMA0GCSqGSIb3DQEBBQUAMGMxCzAJBgNV
> > ...
> > -----END CERTIFICATE-----
> >
> > how ever can I load such a certificate into my RSA struct?
> > concerning encryption, for public and private keys I could use
> > PEM_read_RSAPublicKey and PEM_read_bio_RSAPublicKey
> > to load my keys.
> >
> > Are there methods like this for certificates and certificate private
> keys?
> >
>
> The low level RSA_sign() and RSA_verify() functions shouldn't be used to
> sign
> bulk data. Instead you should use the EVP_Sign*() and EVP_Verify*()
> interface.
> There you use a generalised key structure EVP_PKEY. You can get a public
> key
> from a certificate using X509_get_pubkey().
>
> You can get a private key into an EVP_PKEY structure using
> PEM_read_PrivateKey() and a certificate into an X509 structure using
> PEM_read_X509(). See the manual pages for more information and actual
> examples.
>
> Steve.
> --
> Dr Stephen N. Henson. OpenSSL project core developer.
> Commercial tech support now available see: http://www.openssl.org
> ______________________________________________________________________
> OpenSSL Project http://www.openssl.org
> User Support Mailing List [email protected]
> Automated List Manager [email protected]
>
