But in iphone using Security Framework signed but not pass inspection ...
SecKeyRawVerify method of padding parameter kSecPaddingPKCS1SHA1 returns -50 (Invalid argument), but with kSecPaddingPKCS1 and kSecPaddingNone returns -9809 (document did not define)
Do not know who has experience in this area, to help out the next idea, or change other signatures / test mode can also be checked. Thank
Part of the signature server java / test sign code, using a very simple
bouncycastle
@ Override
public byte [] createSignature (byte [] rgbHash) {
SHA1Digest dig = new SHA1Digest ();
RSADigestSigner signer = new RSADigestSigner (dig);
signer.init (true, keyParameter);
signer.update (rgbHash, 0, rgbHash.length);
try {
return signer.generateSignature ();
} Catch (CryptoException e) {
throw new CryptographicException (e);
}
}
@ Override
public boolean verifySignature (byte [] rgbHash, byte [] rgbSignature) {
SHA1Digest dig = new SHA1Digest ();
RSADigestSigner signer = new RSADigestSigner (dig);
signer.init (false, keyParameter);
signer.update (rgbHash, 0, rgbHash.length);
return signer.verifySignature (rgbSignature);
}
And here's the code
iphone
NSString * cerFilePath = [[NSBundle mainBundle] pathForResource: @ "xxxxAgent" ofType: @ "cer"]; NSData * cerFileData = [[NSData alloc] initWithContentsOfFile: cerFilePath]; SecCertificateRef certificate = SecCertificateCreateWithData (kCFAllocatorDefault, (CFDataRef) cerFileData); CFArrayRef certificates = CFArrayCreate (kCFAllocatorDefault, (const void **) & certificate, 1, NULL); SecTrustRef trust; SecPolicyRef x509Policy = SecPolicyCreateBasicX509 (); OSStatus status = SecTrustCreateWithCertificates (certificates, x509Policy, & trust); assert (status == noErr); SecTrustResultType trustResult; status = SecTrustEvaluate (trust, & trustResult); assert (status == noErr); NSLog (@ "certificate trust result:% d", trustResult); / / kSecTrustResultRecoverableTrustFailure etc SecKeyRef publicKey = SecTrustCopyPublicKey (trust); status = SecKeyRawVerify (publicKey, kSecPaddingPKCS1SHA1, regSignature, regSignatureLen, rgbHash, rgbHashLen); / / TODO: check the status
Reply:
Incorrect signature algorithm set it
Reply:
This landlord does not solve the problem? Security framework like the iPhone do not support self-signed.
Reply:
Thank you, and then did not continue to study ... for using openssl a ...
i am also facing same problem.. any idea..
ReplyDelete