Re: cryptCreateSignatureEx segfaults on ASN.1 objects; what am I doing wrong?

Hi Peter (or of course anyone else who may know the answer),

Ok, I think my code had a couple of significant issues.  The major issue is
that the extension certificate needs to be signed before it can be used,
right? (Also, for the hardcoded ASN.1, I wasn't using the proper length,
although it didn't make any real difference;  createSignatureEx still
segfaults trying to write out an attribute.  I also still get a permissions
error if I try to export the certificate myself, but I assume that's because
the certificate signature is failing.).

//Code to create signatureAttributes object and stuff it with ASN.1 is in
postscript below

    status = cryptSetAttribute( signatureAttributes,
CRYPT_CERTINFO_SUBJECTPUBLICKEYINFO, pubKeyContext ); //Strictly speaking
using the public key itself probably isn't necessary;  the private one
should suffice.  Maybe should be certificate?

    status = cryptSetAttribute( CRYPT_UNUSED,
       CRYPT_OPTION_CERT_SIGNUNRECOGNISEDATTRIBUTES, 1 );
    if (cryptStatusError(status)) {
      MYDBGL(DCRITICAL,"cryptlib error line %d error:
%d\n",__LINE__,status);
    }

    //Maybe the X.509 certificate matters here, but it should be getting
automatically used because of privKeyContext.
    //Do we maybe have to put something in the certificate about the X.509
certificate?
    status = cryptSignCert( signatureAttributes, privKeyContext );  //Fails
with -1
    if (cryptStatusError(status)) {
      MYDBGL(DCRITICAL,"cryptlib error line %d error:
%d\n",__LINE__,status);
    }

When I attempt to sign the certificate, I get the param1 invalid error.  I
presume that besides the public key, there are other fields I need to put in
the extension certificate before it can be signed?  What are they?  (I tried
the ones from test/certs.c, but they're for a different certificate type and
didn't work.)  Is there anything else obviously missing?

Thanks,

Paul


P.S.  In case it matters, the code to create the extension certificate is as
follows:

  CRYPT_CERTIFICATE signatureAttributes;
  status = cryptCreateCert( &signatureAttributes, CRYPT_UNUSED,
    CRYPT_CERTTYPE_CMS_ATTRIBUTES );
  if (cryptStatusError(status)) {
    MYDBGL(DCRITICAL,"cryptlib error line %d error: %d\n",__LINE__,status);
  }

  //Hack static ASN.1
  char buf[255];
  MYDBGL(DCRITICAL,"Using fake static ASN.1 instead of real.\n");
  const char *staticData = "\x0C\x04Test";
  strcpy((char*) buf,staticData);
  int length = 6;  //Their value

  // Add in the ASN.1
  status = cryptAddCertExtension( signatureAttributes, "1.2.3.4.5",
CRYPT_UNUSED, buf, length ); //Looks like if ASN.1 itself is wrong, will
error param4 before param3.
  if (cryptStatusError(status)) {
    MYDBGL(DCRITICAL,"cryptlib error line %d error: %d.  If get -5 here, did
you rebuild cryptlib after increasing the attribute size
constant??\n",__LINE__,status);
  }

_______________________________________________
Cryptlib mailing list
[email protected] via Mail: [email protected]
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.