6.3.1 Signature Creation
As mentioned earlier, a digital signature is the result of encrypting a hash value
with the signer's private key. Hash values are calculated using the CryptoHash
object described in Chapter 3.
The CryptoHash object provides the Sign method that signs the underlying
hash value with one of the two private keys associated with the context from which this
CryptoHash object was created. Just like the GetUserKey method described earlier, the
Sign method accepts a Boolean argument which specifies which of the two keys
to use for the signing: the signature key if set to False or key-exchange key if set to True.
The Sign method returns the signature as a CryptoBlob object.
For example, the following code snippet signs a text string
with the signature key of the "mycontainer" context and outputs the signature value in Base64 encoding:
| VBScript |
|---|
Set CM = Server.CreateObject("Persits.CryptoManager")
Set Context = CM.OpenContext("mycontainer", true )
Set Hash = Context.CreateHash
Hash.AddText "The text to be signed"
Set Blob = Hash.Sign( false )
Response.Write Blob.Base64 |
| C# |
|---|
ICryptoManager objCM = new CryptoManager();
ICryptoContext objContext = objCM.OpenContext( "mycontainer",true,Missing.Value );
ICryptoHash objHash = objContext.CreateHash(Missing.Value);
objHash.AddText( "The text to be signed" );
ICryptoBlob objBlob = objHash.Sign( false );
Response.Write( objBlob.Base64 ); |
If we were to create the signature of a file, the call to CryptoHash.AddText would be replaced with
a call to CryptoHash.AddFile:
| VBScript |
|---|
...
Hash.AddFile "c:\path\file.ext"
... |
| C# |
|---|
...
objHash.AddFile( @"c:\path\file.ext" );
... |
The output of the script above would look similar to the following:
Mj8H40K1f3vZsNpetr3hUu+8irAP56bbgKD4dcgIqSgWXCVViHy83UX0jgNsv5aqEk+Z9xir+8hs
ilYGevZVNZiUnQZ2PgLBnrQNBF1uZew2kXUopenTYdDZbe+oGslIFHBa8EO7qJezJeGLgzzv6hrT
6KVUtP3H6Gnxna3P8Qs=
The compact format of the signatures produced by the CryptoHash.Sign method is referred to as PKCS#1.
It only contains the encrypted hash value and nothing else. There is another format
called PKCS#7 which contains the signature as well as the signer certificate. AspEncrypt
supports it also. PKCS#7 signatures and envelopes will be covered in Chapter 9.
6.3.2 Signature Verification
The signature verification process goes as follows:
1. Compute your own hash value of the file or text string.
2. Decrypt the signature using the signer's public key.
3. Compare the values obtained in Steps 1 and 2. If they match the signature is verified.
With AspEncrypt, steps 2 and 3 are performed with the CryptoHash method VerifySignature
which accepts two arguments: a CryptoBlob object containing the signature being verified and a
CryptoKey object containing the public key corresponding to the private key used to create the signature.
This method returns True if the signature is verified, and False otherwise.
To verify the Base64 value created by the code snippet above, you may use the following code:
| VBScript |
|---|
Set CM = Server.CreateObject("Persits.CryptoManager")
Set Context = CM.OpenContext("", true )
Set Hash = Context.CreateHash
Hash.AddText "The text to be signed"
Set Blob = CM.CreateBlob
Blob.Base64 = "<insert signature value here>"
Set Key = Context.ImportKeyFromFile( Nothing, "c:\path\key.pub", 0 )
Response.Write Hash.VerifySignature( Blob, Key ) |
| C# |
|---|
ICryptoManager objCM = new CryptoManager();
ICryptoContext objContext = objCM.OpenContext("", true, Missing.Value);
ICryptoHash objHash = objContext.CreateHash(Missing.Value);
objHash.AddText( "The text to be signed" );
ICryptoBlob objBlob = objCM.CreateBlob();
objBlob.Base64 = "<insert signature value here>";
ICryptoKey objKey = objContext.ImportKeyFromFile( null, @"c:\path\key.pub", 0 );
Response.Write( objHash.VerifySignature( objBlob, objKey ) ); |
The following code sample combines the code snippets above. It performs both the
signing and signature verification of a text string. To avoid
creating temporary files, it uses the
methods CryptoKey.ExportToBlob and CryptoContext.ImportKeyFromBlob instead of
ExportToFile and ImportKeyFromFile.
Click the links below to run this code sample:
http://localhost/aspencrypt/manual_06/06_sign_verify.asp
http://localhost/aspencrypt/manual_06/06_sign_verify.aspx
