Re: Problem about the private key signing with SFL

Gianluca,
	One thing I found yesterday is that if the password on the PKCS#8 file
is < 8 characters it doesn't get saved during AddLogin and then you
can't access the private key later because getpassword (in
SMFREE3::SMIT_Sign()) returns "". So IF your password is less than 8
characters try it with more and see if that helps. 

Bob, 
	I assume this 8 character limit is by design?

-Jonathan

Gianluca Ramunno wrote:
> 
> Hi all,
> another problem. About private key.
> 
> As I wrote, the goal of my application is
> * sign a blob
> * verify the signature over this blob
> (very innovative ...  :-))
> 
> I want to use Crypto++ 3.1 free token library, md5RSA or sha1RSA
> signature over that blob and produce a CMS object with or without
> ContentInfo,
> with or without signer's certificate, with or without certification path
> certificates
> Platform: Win32, Compiler VisualC++ 6.0 (within VisualStudio) Professional
> with SP3
> SFL version 1.6 (Free3 CTIL compiled with SM_FREE3_RSA_INCLUDED define)
> 
> In order to try the application with a standard certificate,
> I got a trial certificate from Verisign
> (with automatic enrollment to the Microsoft
> Enhanced Cryptographic Service Provider, the one
> released with a High Encryption Pack for IE)
> Main features are:
> * Version3
> * Public key algorithm: RSA
> * Public key length: 1024 bit
> * Certificate Signature Algorithm: md5RSA
> 
> Then I exported the certificate with a private key from MS local repository
> to a PKCS#12 object.
> Finally using openSSL 0.95a I performed following steps:
> 
> 1) extraction of the private key from PKCS#12 to PEM format
> (I think base64 encoded RSA format, it is not specified in openSSL docs).
> The command used is:
> 
> openssl pkcs12 -in mypkcs12.p12 -nocerts -out keytemp.pem
> 
> Openssl requested password to open pkcs12 object and password
> to protect pem format private key file
> 
> * transcoding from PEM format to PKCS#8 (protected with PKCS#5)
> DER encoded.
> The command used is:
> 
> openssl pkcs8 -in keytemp.pem -inform pem -topk8 -outform der -out
> privkey.p8
> 
> Openssl requested password to pem format key and password
> to protect PKCS#8 object
> 
> **********************************
> Now the application. Some key source code line:
> 
> * For login:
>         SME(pES_AppLogin= (CSM_AppLogin *) new
> CSM_AppLogin(FREE3_DLL_NAME,DLLBuildParam));
>         pCSMIME = (CSMIME *)pES_AppLogin;
> 
> Following previous mails between Bob and Jonathan (about default alg - DSA -
> for
> Free3 CTIL) I added following code
> 
>         pCSMIME->m_pCSInsts->SetCurrToFirst();
>         pCurr_CSInst=pCSMIME->m_pCSInsts->Curr();
>         pDigestAlgOID = new CSM_OID(md5);
>         pDig_EncAlgOID = new CSM_OID(md5WithRSAEncryption);
>         pCurr_CSInst->SetPreferredCSInstAlgs(pDigestAlgOID ,
>                 pDig_EncAlgOID , NULL, NULL);
> 
> Because of the fact that the application had produced a PKCS#7 object
> containing SignedData without SignerInfos/SignerInfo data, I debugged the
> code
> and I saw that before calling SMTI_Sign method it was controlled that
> Applicable bit value within CSM_CInst instance was true.
> So I added following code:
> 
>         pCurr_CSInst->SetApplicable(true);
> 
> * For instancing and preparing CSM_MsgToSign object
> 
>         CSM_Buffer *p;
> 
>         p= new CSM_Buffer(DATA_TO_BE_SIGNED_FILENAME);
>         m_pESSignMsg= (CSM_MsgToSign *) new CSM_MsgToSign(p);
> 
>         // CMS (RFC 2630) OID definition for SignedData type
>         m_pESSignMsg->setContentType(CSM_OID("1.2.840.113549.1.7.2"));
> 
>         m_pESSignMsg->SetIncludeOrigCertsFlag(true);
>         m_pESSignMsg->m_bIssOrSki = false;                      //Usa IssuerAndSerialNumber
> 
>         // for the following flag: true->enveloping signature
>         // false->detached signature
>         m_pESSignMsg->SetIncludeContentFlag(true);
> 
> * For signing
> 
>         if ((ret=m_pESSignMsg->Sign(pCSMIME))==SM_NO_ERROR)
>         {
>                 CSM_Buffer *pbufContent=m_pESSignMsg->GetEncodedContentInfo();
>                 pbufContent->ConvertMemoryToFile(SIGNED_DATA_FILENAME);
>                 delete pbufContent;
>         }
> 
> *******************************************************
> 
> The problem:
> 
> The application return to me following exception:
> 
> F:\Tesi\es\escmd\lib>escmd
> ERROR INFORMATION AND STACK:
> 
>  ERROR INFORMATION: PrivateKeyInfo::BDec: ERROR - wrong tag
> 
>         ERROR CODE: 34  SOURCE LINE NUMBER: 3054
>         FILE: f:\tesi\smimer1.6\alg_libs\sm_free3\sm_free3.cpp
>         FUNCTION: CSM_Free3::DecryptPrivateKey
> 
> CSM_Free3::SMTI_Sign IN f:\tesi\smimer1.6\alg_libs\sm_free3\sm_free3.cpp,
> line 8
> 1.
> CSM_SignBuf::SignBuf IN f:\tesi\smimer1.6\libcert\src\sm_signbuf.cpp, line
> 193.
> ProduceSignerInfo IN F:\Tesi\smimeR1.6\libsrc\hilevel\sm_Sign.cpp, line 301.
> UpdateSignedDataSIs IN F:\Tesi\smimeR1.6\libsrc\hilevel\sm_Sign.cpp, line
> 195.
> Sign IN F:\Tesi\smimeR1.6\libsrc\hilevel\sm_Sign.cpp, line -1.
> sign IN f:\tesi\es\escmd\src\escmd.cpp, line -1.
> 
> I can't debug the application within SMTI_Sign (CSM_TokenInterface
> class or, better, CSM_Free3 class) method because
> for the following code in sm_SignBuf.cpp
> 
>     {
>          SME(tmpTokenIF->SMTI_Sign(pSigContentBuf,
>              pSigBuf,                // returned result
>              pDigest));               // data digest (Hash of Content)
>     }
> 
> the behavior of F11(step into) debug command is similar to F10 (step over),
> so I can't see values of various structures within the objects (from
> CSM_AppLogin and
> CSM_MsgToSign classes) just before exception is generated.
> 
> I thinked I have compiled SFL with bad options, so
> I tried to verify key management
> using command
> auto_hid.exe lolevel\crypto.cfg:
> it returned to me no message (The meaning is:
> Test passed?).
> I tried to change randomly password in
> a free3 section of the crypto.cfg file
> ant it returned to me no message ...
> So I can't understand if SFL libraries have been built
> correctly
> 
> Finally trying to generate a certificate using
> CertificateBuilder:
> 1) Using dialog box I can generate
> certificate only with DSA public key
> (which way for storing generated private key?)
> 2) Using a config file (e.g. DaisyRSA.cfg included
> in SFL package) CertificateBuilder returns an error
> (in libcert)
> 
> *****************************************************************
> 
> Now the questions:
> 
> 1) Is my usage of pCurr_CSInst->SetApplicable(true)
> method correct or the use it's not mandatory (and I
> had to use it because I forgot something else?)
> 
> 2) Did I do something wrong while estracting private key
> from PKCS#12 and converting to PKCS#8? Which is the
> right way for obtaining a private key file suitable for
> SFL Free3 CTIL ?
> There is some requirement for the password
> (length and others)?
> 
> 3) Which way can I generate a couple private-public key
> RSA and a public key certificate signed using md5RSA
> or sha1RSA algorithms using CertificateBuilder (either
> using dialog windows or config file)?
> I tried to do the above operations but I wasn't able to force
> CertificateBuilder to use RSA algorithm and store private
> key somewhere into a file.
> 
> The following questions aren't related to private key problem
> 
> 3) Using the constructor
> CSM_AppLogin(FREE3_DLL_NAME,DLLBuildParam))
> (with DLLBuildParam="SM_FREE3DLL certsign.der keysign.p8 password sm_FREE3")
> the last parameter, token ID (sm_FREE3), is ininfluent, because is the
> 
> *CSM_Free3::AddLoginStatic method which copies ID string (FREE3) to a buffer
> pointed by the pointer passed as parameter, in the above case pointer to
> "sm_FREE3"
> parameter.
> 
> The only need is passing a string with length equal or greather than FREE3
> in order to allocate string buffer memory large enough for th copy made
> by AddLoginStatic method
> 
> It's true? If yes, why?
> 
> 4) What's the difference between sha_1WithRSAEncryption
> and sha_1WithRSAEncryption_ALT AsnOid contants?
> 
> 5) Have you (Wang) planned a CTIL for a MSCryptoAPI?
> Someone else had developed it?
> 
> Thank's
> Gianluca
> 
> ---------------------------------------------------------------------
> Gianluca Ramunno ([email protected])

-- 
==============================================================================
Jonathan C. Schulze-Hewett        Email: [email protected]
Software Engineer                 
Information Security Corporation  Voice: 708-445-1704       
1011 W. Lake Street, Suite 212    Fax:   708-455-9705
Oak Park, IL  60301               WWW:   http://www.infoseccorp.com