Re: Why don't openssl RSA work for Word Document file?
I don't know WHY you would want to do that, but I don't know WHY NOT to give you an objective answer. Maybe you are trying to understand some crypto basics and want to test how a signature scheme works, I don't know. So, what you need is to sign the HASH, not the document. Sign process: 1) Generate a hash of the document 2) Sign this hash 3) Send hash, public key and the document for the verifier Verify process: 1) Generate a (new) hash of the document 2) Verify (decrypt) the signed hash 3) Compare result of 1 and 2. If the same, signature is ok. But for any porpouse that is not study and understand signature schemes, forget about this. Go for any of the suggestion other people have given here. Cristian 2010/2/1 Namrata Sorte > > How do you want to sign or encrypt this document? Do you want to do it > natively from> word? Or do you want to do this from a Unix command > prompt? What formats do you want > it encrypted in? How will the consumer > decrypt or verify the document? Again, do you want > this to happen from the > command line? Transparently when the user opens the file from the > > filesystem? > > > Thanks all for replying to my thread. > > Ya to be more specific, I want to sign and verify Word Document File and > using command line will be fine for now. For this I am using SHA-1 to > generate hash of the input message, than I want to use RSA for signing this > message digest, which finally will be appended to Word Document containing > the input message. > > So now the problem I am facing here is using OpenSSL rsautl > > OpenSSL> rsautl -sign -in file1.doc -inkey private.pem -out sig > > > > Loading 'screen' into random state - done > RSA operation error 660:error:0406C06E:rsa routines: > RSA_padding_add_PKCS1_type_1:data too large for key size: > .\crypto\rsa\rsa_pk1.c:73: error in rsautl > > > What should I do to fix this error so that it supports long word document > files too? > > Thanks, > Namrata > > __ > OpenSSL Project http://www.openssl.org > User Support Mailing Listopenssl-users@openssl.org > Automated List Manager majord...@openssl.org >
RE: Why don't openssl RSA work for Word Document file?
Namrata Sorte wrote: > Ya to be more specific, I want to sign and verify Word Document > File and using command line will be fine for now. For this I am > using SHA-1 to generate hash of the input message, than I want > to use RSA for signing this message digest, which finally will > be appended to Word Document containing the input message. Please, for all that is holy, DO NOT DO THIS. Do not invent your own signature scheme. Others have already developed such schemes that are known to work. Why are you trying to invent your own? Yes, it's possible to design a signature scheme where you make the SHA1 hash of the file. Yes, it's possible to design a scheme that uses RSA as the signature primitive. BUT YOU ARE NOT COMPETENT TO DESIGN SUCH A SCHEME. Why are you trying? > So now the problem I am facing here is using OpenSSL rsautl > OpenSSL> rsautl -sign -in file1.doc -inkey private.pem -out sig WHY?! RSA is a primitive. It is *NOT* suitable for direct use for either encryption or signatures. > What should I do to fix this error so that it supports > long word document files too? Use an encryption system designed by a competent security expert rather than trying to roll your own. You were given links to such systems in previous messages. (Google 'GPG' if you like.) DS __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
On Mon, Feb 01, 2010, Ujwal Chinthala wrote: > Hmm, that could be a problem. > > This code is going to run on a box which is shipped to the customer. > So I don't believe we want to ship these boxes with private keys in them :). > I didn't mean that. I mean that if you create a certificate containing the public key using the private key then you should have no problems. You just ship the certificate to the customer. > > Does Openssl have any API which can extract the PKCS7 data from the CMS > structure, which > in turn can be used with PKCS7 API's? The feature you've used with CMS (signing using a key identifier) is a CMS only feature and not compatible with PKCS#7. That's why you got the error in the first place. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Server won't request for client certificate
Dear Kyle, David and Dr.Henson, thanks for all your replies. I will have a look on the debug generated by s_client and probably post them here in a minute. In the meantime, let me appologise for not being specific about the error I am getting and provide you with more information: When the client doesn't have a certificate at all, BIO_do_handshake() fails, accusing this: 20070:error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate:s3_srvr.c:2455: (Which is the correct behaviour) When I use my client (with the proper CA signed certificates), BIO_do_handshake() actually succeeds. The error I get is that SSL_get_peer_certificate() actually returns NULL (when I believe it should return my client's certificate instead). My best regards, Felipe On 1 Feb 2010, at 19:08, Dr. Stephen Henson wrote: On Mon, Feb 01, 2010, Felipe Franciosi wrote: Dear Patrick, Thanks for the reply! I took the error checking out on purpose for the sake of the message size. I'm sending my client's code, but I still think the problem is on the server. What error printing do you do? You should call ERR_print_errors_fp(stderr) or similar and see if it gives you any useful message (see FAQ). Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Server won't request for client certificate
On Mon, Feb 01, 2010, Felipe Franciosi wrote: > Dear Patrick, > > Thanks for the reply! > > I took the error checking out on purpose for the sake of the message size. > I'm sending my client's code, but I still think the problem is on the > server. What error printing do you do? You should call ERR_print_errors_fp(stderr) or similar and see if it gives you any useful message (see FAQ). Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Server won't request for client certificate
On Mon, Feb 01, 2010, David wrote: > > I'm not sure if it would make a diff, but I use a callback function in my > SSL_CTX_set_verify(). > No, a callback is not always necessary and some debugging ones ones which some people blindly copy and paste are downright dangerous. Steve. -- Dr Stephen N. Henson. OpenSSL project core developer. Commercial tech support now available see: http://www.openssl.org __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Harcoded Private RSA Key
Thanks for your help again Stephen, I will try that, if it works I will post my result. []s Douglas Gemignani On Fri, Jan 29, 2010 at 11:14 AM, Dr. Stephen Henson wrote: > On Fri, Jan 29, 2010, Douglas Gemignani wrote: > >> Hello, >> >> I would like to know if it is possible to embed a RSA private Key on >> my code. Yes, I know this is not a very good practice. >> I currently use PEM_read_PrivateKey(fp, NULL, NULL, password) for >> reading the key from the file. >> >> I tried to call i2d_PrivateKey (pkey, &p) hardcoding the output and >> reading it again with d2i_PrivateKey (0, &pkey, &p, certlen) but it >> didn't work, it doesn't build the EVP_PKEY structure properly. >> >> My following solution was to create a BIO, exporting the key to it, >> dumping the output then calling: >> rsa=PEM_read_bio_RSAPrivateKey(bio,NULL,NULL,NULL)) >> EVP_PKEY_new() >> EVP_PKEY_assign_RSA(pkey, rsa) >> EVP_PKEY_set1_RSA(CApkey, rsa) >> >> But I guess I missed something here. >> >> Anybody know if a mmap/CreateFileMapping would work with >> PEM_read_PrivateKey? >> > > You can create a BIO from a memory buffer directly using BIO_new_mem_buf(). > > Steve. > -- > Dr Stephen N. Henson. OpenSSL project core developer. > Commercial tech support now available see: http://www.openssl.org > __ > OpenSSL Project http://www.openssl.org > User Support Mailing List openssl-us...@openssl.org > Automated List Manager majord...@openssl.org > __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: Server won't request for client certificate
I'm not sure if it would make a diff, but I use a callback function in my
SSL_CTX_set_verify().
Regards,
David
--
From: "Felipe Franciosi"
Sent: Monday, February 01, 2010 10:55 AM
To:
Subject: Re: Server won't request for client certificate
Dear Patrick,
Thanks for the reply!
I took the error checking out on purpose for the sake of the message
size. I'm sending my client's code, but I still think the problem is
on the server.
If I use s_server with my client, it works. If I use s_client with my
server, it fails. If I use my server with my client, it fails.
Here's my client's code:
SSL_load_error_strings();
ERR_load_BIO_strings();
SSL_library_init();
OpenSSL_add_all_algorithms();
X509 *peerCert;
X509_NAME *xname;
BIO *bio;
SSL * ssl;
SSL_CTX * ctx = SSL_CTX_new(SSLv23_client_method());
char buf[256];
memset(buf, 0, sizeof(buf));
if (!SSL_CTX_load_verify_locations(ctx, "ca.crt", NULL)) { /*
print error and abort */ }
if (!SSL_CTX_use_certificate_file(ctx, "client.crt",
SSL_FILETYPE_PEM)) { /* print error and abort */ }
if (!SSL_CTX_use_PrivateKey_file(ctx, "client.key",
SSL_FILETYPE_PEM)) { /* print error and abort */ }
if ((bio = BIO_new_ssl_connect(ctx)) == NULL) { /* print
error and abort */ }
BIO_get_ssl(bio, & ssl);
SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
BIO_set_conn_hostname(bio, "localhost:9443");
if(BIO_do_connect(bio) <= 0) { /* print error and abort */ }
if (SSL_get_verify_result(ssl) != X509_V_OK) { /* print error
and abort */ }
peerCert = SSL_get_peer_certificate(ssl);
xname = X509_get_subject_name(peerCert);
X509_NAME_get_text_by_NID(xname, NID_commonName, buf,
sizeof(buf));
printf("buf = %s\n", buf);
memset(buf, 0, sizeof(buf));
printf("Reading from BIO\n");
if(BIO_read(bio, buf, sizeof(buf)) <= 0) { /* print error and
abort */ }
printf("buf = %s\n", buf);
BIO_free_all(bio);
I think my certificates are fine. I can regenerate them and paste here
the exact commands I use if you think it's necessary!
Again, thanks and any feedback is appreciated as I am completely
stuck! =(
Regards,
Felipe
On 1 Feb 2010, at 14:18, Eisenacher, Patrick wrote:
Hi Felipe,
-Original Message-
From: Felipe Franciosi
[snip]
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_ONCE, NULL);
I believe my client is irrelevant at this point, because if I use
"openssl s_server", it works beautifully with my client.
However, when
I use my server and my client (or openssl s_client), it fails
accusing
my client of not providing the certificate. All points to my server
not requesting the client certificate properly.
You configured your server to stop the handshake if the client
doesn't provide a certificate. And that's - according to the
information you provide - exactly what you see.
So all points to your client indeed: You have to find out why your
client does not send the certificate that your server requests.
If you use s_client with your server, I guess you'll see the
certificate request message your server is sending. In that message
the server tells the client which CAs and which certificates it
accepts.
So either your client's code is buggy (do you check for error
conditions in your OpenSSL invocations? your snippet didn't seem to
indicate so), it can't access its certificate, its certificate is
not of the types requested by the server or its certificate is not
issued by one of the CAs accepted by the server - as indicated in
the above mentioned certificate request message.
HTH,
Patrick Eisenacher
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
Re: Server won't request for client certificate
Use 'script noclientcert.txt openssl s_client -debug -state -showcerts
-connect host:port' to see what the certificate CA name requested by
the server is. Then, 'script withclientcert.txt openssl s_client
-state -debug -showcerts -connect host:port -key keyfile.pem -cert
certfile.pem' to determine what actually happens when the certificate
is appropriately selected.
Then, please attach include the text of noclientcert.txt and
withclientcert.txt if you still cannot figure out what's going on.
(What is the server running, do you know?)
-Kyle H
On Mon, Feb 1, 2010 at 7:55 AM, Felipe Franciosi wrote:
> Dear Patrick,
>
> Thanks for the reply!
>
> I took the error checking out on purpose for the sake of the message size.
> I'm sending my client's code, but I still think the problem is on the
> server.
> If I use s_server with my client, it works. If I use s_client with my
> server, it fails. If I use my server with my client, it fails.
>
> Here's my client's code:
>
> SSL_load_error_strings();
> ERR_load_BIO_strings();
> SSL_library_init();
> OpenSSL_add_all_algorithms();
>
> X509 *peerCert;
> X509_NAME *xname;
>
> BIO *bio;
> SSL * ssl;
> SSL_CTX * ctx = SSL_CTX_new(SSLv23_client_method());
> char buf[256];
> memset(buf, 0, sizeof(buf));
>
> if (!SSL_CTX_load_verify_locations(ctx, "ca.crt", NULL)) { /* print
> error and abort */ }
> if (!SSL_CTX_use_certificate_file(ctx, "client.crt",
> SSL_FILETYPE_PEM)) { /* print error and abort */ }
> if (!SSL_CTX_use_PrivateKey_file(ctx, "client.key",
> SSL_FILETYPE_PEM)) { /* print error and abort */ }
>
> if ((bio = BIO_new_ssl_connect(ctx)) == NULL) { /* print error and
> abort */ }
> BIO_get_ssl(bio, & ssl);
> SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
> BIO_set_conn_hostname(bio, "localhost:9443");
> if(BIO_do_connect(bio) <= 0) { /* print error and abort */ }
> if (SSL_get_verify_result(ssl) != X509_V_OK) { /* print error and
> abort */ }
> peerCert = SSL_get_peer_certificate(ssl);
> xname = X509_get_subject_name(peerCert);
> X509_NAME_get_text_by_NID(xname, NID_commonName, buf, sizeof(buf));
> printf("buf = %s\n", buf);
> memset(buf, 0, sizeof(buf));
> printf("Reading from BIO\n");
> if(BIO_read(bio, buf, sizeof(buf)) <= 0) { /* print error and abort
> */ }
> printf("buf = %s\n", buf);
> BIO_free_all(bio);
>
> I think my certificates are fine. I can regenerate them and paste here the
> exact commands I use if you think it's necessary!
>
> Again, thanks and any feedback is appreciated as I am completely stuck! =(
>
> Regards,
> Felipe
>
>
> On 1 Feb 2010, at 14:18, Eisenacher, Patrick wrote:
>
>> Hi Felipe,
>>
>>> -Original Message-
>>> From: Felipe Franciosi
>>
>> [snip]
>>
>>> SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER |
>>> SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_ONCE, NULL);
>>
>>> I believe my client is irrelevant at this point, because if I use
>>> "openssl s_server", it works beautifully with my client.
>>> However, when
>>> I use my server and my client (or openssl s_client), it fails
>>> accusing
>>> my client of not providing the certificate. All points to my server
>>> not requesting the client certificate properly.
>>
>> You configured your server to stop the handshake if the client doesn't
>> provide a certificate. And that's - according to the information you provide
>> - exactly what you see.
>>
>> So all points to your client indeed: You have to find out why your client
>> does not send the certificate that your server requests.
>>
>> If you use s_client with your server, I guess you'll see the certificate
>> request message your server is sending. In that message the server tells the
>> client which CAs and which certificates it accepts.
>>
>> So either your client's code is buggy (do you check for error conditions
>> in your OpenSSL invocations? your snippet didn't seem to indicate so), it
>> can't access its certificate, its certificate is not of the types requested
>> by the server or its certificate is not issued by one of the CAs accepted by
>> the server - as indicated in the above mentioned certificate request
>> message.
>>
>> HTH,
>> Patrick Eisenacher
>> __
>> OpenSSL Project http://www.openssl.org
>> User Support Mailing List openssl-us...@openssl.org
>> Automated List Manager majord...@openssl.org
>
> __
> OpenSSL Project http://www.openssl.org
> User Support Mailing List openssl-us...@openssl.org
> Automated List Manager majord...@openssl.org
>
__
OpenSSL Project
Re: Server won't request for client certificate
Dear Patrick,
Thanks for the reply!
I took the error checking out on purpose for the sake of the message
size. I'm sending my client's code, but I still think the problem is
on the server.
If I use s_server with my client, it works. If I use s_client with my
server, it fails. If I use my server with my client, it fails.
Here's my client's code:
SSL_load_error_strings();
ERR_load_BIO_strings();
SSL_library_init();
OpenSSL_add_all_algorithms();
X509 *peerCert;
X509_NAME *xname;
BIO *bio;
SSL * ssl;
SSL_CTX * ctx = SSL_CTX_new(SSLv23_client_method());
char buf[256];
memset(buf, 0, sizeof(buf));
if (!SSL_CTX_load_verify_locations(ctx, "ca.crt", NULL)) { /*
print error and abort */ }
if (!SSL_CTX_use_certificate_file(ctx, "client.crt",
SSL_FILETYPE_PEM)) { /* print error and abort */ }
if (!SSL_CTX_use_PrivateKey_file(ctx, "client.key",
SSL_FILETYPE_PEM)) { /* print error and abort */ }
if ((bio = BIO_new_ssl_connect(ctx)) == NULL) { /* print
error and abort */ }
BIO_get_ssl(bio, & ssl);
SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
BIO_set_conn_hostname(bio, "localhost:9443");
if(BIO_do_connect(bio) <= 0) { /* print error and abort */ }
if (SSL_get_verify_result(ssl) != X509_V_OK) { /* print error
and abort */ }
peerCert = SSL_get_peer_certificate(ssl);
xname = X509_get_subject_name(peerCert);
X509_NAME_get_text_by_NID(xname, NID_commonName, buf,
sizeof(buf));
printf("buf = %s\n", buf);
memset(buf, 0, sizeof(buf));
printf("Reading from BIO\n");
if(BIO_read(bio, buf, sizeof(buf)) <= 0) { /* print error and
abort */ }
printf("buf = %s\n", buf);
BIO_free_all(bio);
I think my certificates are fine. I can regenerate them and paste here
the exact commands I use if you think it's necessary!
Again, thanks and any feedback is appreciated as I am completely
stuck! =(
Regards,
Felipe
On 1 Feb 2010, at 14:18, Eisenacher, Patrick wrote:
Hi Felipe,
-Original Message-
From: Felipe Franciosi
[snip]
SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER |
SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_ONCE, NULL);
I believe my client is irrelevant at this point, because if I use
"openssl s_server", it works beautifully with my client.
However, when
I use my server and my client (or openssl s_client), it fails
accusing
my client of not providing the certificate. All points to my server
not requesting the client certificate properly.
You configured your server to stop the handshake if the client
doesn't provide a certificate. And that's - according to the
information you provide - exactly what you see.
So all points to your client indeed: You have to find out why your
client does not send the certificate that your server requests.
If you use s_client with your server, I guess you'll see the
certificate request message your server is sending. In that message
the server tells the client which CAs and which certificates it
accepts.
So either your client's code is buggy (do you check for error
conditions in your OpenSSL invocations? your snippet didn't seem to
indicate so), it can't access its certificate, its certificate is
not of the types requested by the server or its certificate is not
issued by one of the CAs accepted by the server - as indicated in
the above mentioned certificate request message.
HTH,
Patrick Eisenacher
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
__
OpenSSL Project http://www.openssl.org
User Support Mailing Listopenssl-users@openssl.org
Automated List Manager majord...@openssl.org
RE: Server won't request for client certificate
Hi Felipe, > -Original Message- > From: Felipe Franciosi [snip] > SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | > SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_ONCE, NULL); > I believe my client is irrelevant at this point, because if I use > "openssl s_server", it works beautifully with my client. > However, when > I use my server and my client (or openssl s_client), it fails > accusing > my client of not providing the certificate. All points to my server > not requesting the client certificate properly. You configured your server to stop the handshake if the client doesn't provide a certificate. And that's - according to the information you provide - exactly what you see. So all points to your client indeed: You have to find out why your client does not send the certificate that your server requests. If you use s_client with your server, I guess you'll see the certificate request message your server is sending. In that message the server tells the client which CAs and which certificates it accepts. So either your client's code is buggy (do you check for error conditions in your OpenSSL invocations? your snippet didn't seem to indicate so), it can't access its certificate, its certificate is not of the types requested by the server or its certificate is not issued by one of the CAs accepted by the server - as indicated in the above mentioned certificate request message. HTH, Patrick Eisenacher __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
