Monday, September 23, 2013

Security.framework the java server certificate signed inspection problems

Now doing a project on the server needs to send over the signature strings inspection sign ... server side is written in java, code no problem in windows mobile, android, j2me and other systems that have been adopted
But in iphone using Security Framework signed but not pass inspection ...

SecKeyRawVerify method of padding parameter kSecPaddingPKCS1SHA1 returns -50 (Invalid argument), but with kSecPaddingPKCS1 and kSecPaddingNone returns -9809 (document did not define)

Do not know who has experience in this area, to help out the next idea, or change other signatures / test mode can also be checked. Thank

Part of the signature server java / test sign code, using a very simple
bouncycastle
 
@ Override 
public byte [] createSignature (byte [] rgbHash) {
SHA1Digest dig = new SHA1Digest (); 
RSADigestSigner signer = new RSADigestSigner (dig); 

signer.init (true, keyParameter); 
signer.update (rgbHash, 0, rgbHash.length); 

try {
return signer.generateSignature (); 
} Catch (CryptoException e) {
throw new CryptographicException (e); 
} 
} 

@ Override 
public boolean verifySignature (byte [] rgbHash, byte [] rgbSignature) {
SHA1Digest dig = new SHA1Digest (); 
RSADigestSigner signer = new RSADigestSigner (dig); 

signer.init (false, keyParameter); 
signer.update (rgbHash, 0, rgbHash.length); 

return signer.verifySignature (rgbSignature); 
} 


And here's the code
iphone
 
NSString * cerFilePath = [[NSBundle mainBundle] pathForResource: @ "xxxxAgent" ofType: @ "cer"]; 
NSData * cerFileData = [[NSData alloc] initWithContentsOfFile: cerFilePath]; 

SecCertificateRef certificate = SecCertificateCreateWithData (kCFAllocatorDefault, (CFDataRef) cerFileData); 
CFArrayRef certificates = CFArrayCreate (kCFAllocatorDefault, (const void **) & certificate, 1, NULL); 

SecTrustRef trust; 
SecPolicyRef x509Policy = SecPolicyCreateBasicX509 (); 
OSStatus status = SecTrustCreateWithCertificates (certificates, x509Policy, & trust); 
assert (status == noErr); 
SecTrustResultType trustResult; 
status = SecTrustEvaluate (trust, & trustResult); 
assert (status == noErr); 

NSLog (@ "certificate trust result:% d", trustResult); / / kSecTrustResultRecoverableTrustFailure etc 
SecKeyRef publicKey = SecTrustCopyPublicKey (trust); 

status = SecKeyRawVerify (publicKey, kSecPaddingPKCS1SHA1, regSignature, regSignatureLen, rgbHash, rgbHashLen); 

/ / TODO: check the status 

Reply:
Incorrect signature algorithm set it
Reply:
This landlord does not solve the problem? Security framework like the iPhone do not support self-signed.
Reply:
Thank you, and then did not continue to study ... for using openssl a ...

1 comment: