|
|
|
date: Mon, 7 Jul 2008 17:35:33 -0700 (PDT),
group: microsoft.public.platformsdk.security
back
Implementation of CardSignData() in smart card modules (minidrivers)
Hello there,
I'm trying to write a smart card minidriver interfacing the Base CSP
to PKCS#11. Googling reveals that I'm not the first one; anyway, I'm
"almost there" and I'd like to release this as OSS once it's finished.
It could also help other people who are trying to write a minidriver.
I'm using certutil.exe from the Win 2003 SP1 admin pack under Win XP
Professional SP2. According to certutil -scinfo, I cannot get
CardSignData to work. I'm trying to make signature with a 1024-bit key
stored on a smart card.
What I'm doing is simply:
1. take the 20 bytes of SHA-1 digest provided in pbData,
2. reverse them,
3. feed them to PKCS#11 who prepends the DigestInfo DER encoding, pads
them in an appropriate structure and feeds them to the card;
4. take the resulting 128-byte signature from the card,
5. reverse the signature,
6. copy it into pbSignedData, setting cbSignedData to 128.
I'm also sure that step #3 is right because I've logged the APDU's
from and to the card.
The result is:
Performing AT_SIGNATURE public key matching test...
Public key matching test succeeded
Key Container = 00000000-0000-0000-0000-123456789AB5
Provider = Microsoft Base Smart Card Crypto Provider
ProviderType = 1
Flags = 1
KeySpec = 2
420.434.0: 0x80090006 (-2146893818)
ERROR: Certificate public key does NOT match private key
317.686.0: 0x80090006 (-2146893818)
I'm quite convinced that the problem is in my implementation of
CardSignData(), because the certificates are read correctly, the
public keys match those in the certificates and AT_KEYEXCHANGE
(through CardRSADecrypt(), quite easier) works correctly:
Performing AT_KEYEXCHANGE public key matching test...
Public key matching test succeeded
Key Container = 00000000-0000-0000-0000-123456789AB5
Provider = Microsoft Base Smart Card Crypto Provider
ProviderType = 1
Flags = 1
KeySpec = 1
Private key verifies
Could you give me any hints? Thanks in advance!
--
Emanuele
date: Mon, 7 Jul 2008 17:35:33 -0700 (PDT)
author: Emanuele Pucciarelli
Re: Implementation of CardSignData() in smart card modules (minidrivers)
Hi,
You should not always add the DigestInfo DER into signature in step 3. This
must be done depending on the value of the dwSigningFlags member of the
pInfo parameter. I advise you to trace all the content of the pInfo
parameter to see how certutil is expecting the data to be computed.
Cheers,
--
Mounir IDRASSI
IDRIX
http://www.idrix.fr
to reach : mounir_idrix_fr (replace the underscores with the at and dot
characters respectively)
"Emanuele Pucciarelli " a écrit dans le
message de news:
c26bfe26-24e0-474c-8d5c-6e83e51a7c95@d45g2000hsc.googlegroups.com...
> Hello there,
>
> I'm trying to write a smart card minidriver interfacing the Base CSP
> to PKCS#11. Googling reveals that I'm not the first one; anyway, I'm
> "almost there" and I'd like to release this as OSS once it's finished.
> It could also help other people who are trying to write a minidriver.
>
> I'm using certutil.exe from the Win 2003 SP1 admin pack under Win XP
> Professional SP2. According to certutil -scinfo, I cannot get
> CardSignData to work. I'm trying to make signature with a 1024-bit key
> stored on a smart card.
>
> What I'm doing is simply:
> 1. take the 20 bytes of SHA-1 digest provided in pbData,
> 2. reverse them,
> 3. feed them to PKCS#11 who prepends the DigestInfo DER encoding, pads
> them in an appropriate structure and feeds them to the card;
> 4. take the resulting 128-byte signature from the card,
> 5. reverse the signature,
> 6. copy it into pbSignedData, setting cbSignedData to 128.
>
> I'm also sure that step #3 is right because I've logged the APDU's
> from and to the card.
>
> The result is:
>
> Performing AT_SIGNATURE public key matching test...
> Public key matching test succeeded
> Key Container = 00000000-0000-0000-0000-123456789AB5
> Provider = Microsoft Base Smart Card Crypto Provider
> ProviderType = 1
> Flags = 1
> KeySpec = 2
> 420.434.0: 0x80090006 (-2146893818)
> ERROR: Certificate public key does NOT match private key
> 317.686.0: 0x80090006 (-2146893818)
>
> I'm quite convinced that the problem is in my implementation of
> CardSignData(), because the certificates are read correctly, the
> public keys match those in the certificates and AT_KEYEXCHANGE
> (through CardRSADecrypt(), quite easier) works correctly:
>
> Performing AT_KEYEXCHANGE public key matching test...
> Public key matching test succeeded
> Key Container = 00000000-0000-0000-0000-123456789AB5
> Provider = Microsoft Base Smart Card Crypto Provider
> ProviderType = 1
> Flags = 1
> KeySpec = 1
> Private key verifies
>
> Could you give me any hints? Thanks in advance!
>
> --
> Emanuele
date: Wed, 9 Jul 2008 04:25:57 +0100
author: Mounir IDRASSI am
|
|
