OpenSSL在EVP_VerifyFinal失败 [英] OpenSSL Fails at EVP_VerifyFinal
问题描述
经过几天的搜索互联网和openssl docs我打了墙。我尝试使用私钥签署邮件,然后使用公钥验证邮件的真实性。
After a few days of scouring the internet and openssl docs i've hit a wall. I'm attempting to sign a message with a private key, and then verify the authenticity of the message with a public key.
密钥生成代码:
//Generate RSA Keys
EVP_PKEY_CTX* KeyCtx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL);
if (KeyCtx == nullptr)
return false;
if (EVP_PKEY_keygen_init(KeyCtx) <= 0)
return false;
if (EVP_PKEY_CTX_set_rsa_keygen_bits(KeyCtx, RSA_KeyLen) <= 0)
return false;
if (EVP_PKEY_keygen(KeyCtx, &m_ServerKeyPair) <= 0)
return false;
if (EVP_PKEY_keygen(KeyCtx, &m_ClientKeyPair) <= 0)
return false;
//Write Keys to EVP_PKEYS for actual internal encryption,BIO mem is wiped after read so we need a new copy
PEM_read_bio_PrivateKey(KeyToPrivBio(m_ServerKeyPair), &m_ServerPrivateKey, NULL, NULL);
PEM_read_bio_PUBKEY(KeyToPubBio(m_ServerKeyPair), &m_ServerPublicKey, NULL, NULL);
PEM_read_bio_PrivateKey(KeyToPrivBio(m_ClientKeyPair), &m_ClientPrivateKey, NULL, NULL);
PEM_read_bio_PUBKEY(KeyToPubBio(m_ClientKeyPair), &m_ClientPublicKey, NULL, NULL);
RSA Sign:
bool SecureCrypto::RSASign(const unsigned char* Msg, size_t MsgLen,unsigned char** EncMsg, size_t& MsgLenEnc)
{
EVP_PKEY_size(m_ServerPrivateKey);
*EncMsg = (unsigned char*)malloc(EVP_PKEY_size(m_ServerPrivateKey));
if (EVP_SignInit_ex(m_RSASignCtx, EVP_sha1(), 0) <= 0)
{
printf("Failed Init\n");
return false;
}
if (EVP_SignUpdate(m_RSASignCtx, Msg, MsgLen) <= 0)
{
printf("Failed Update\n");
return false;
}
if (EVP_SignFinal(m_RSASignCtx, *EncMsg, &MsgLenEnc, m_ServerPrivateKey) <=0)
{
printf("Failed Final Sign\n");
return false;
}
EVP_MD_CTX_cleanup(m_RSASignCtx);
return true;
}
RSA验证:
bool SecureCrypto::RSAVerifySignature(const unsigned char* MsgHash, size_t MsgHashLen,unsigned char* Msg, size_t MsgLen)
{
if (EVP_VerifyInit(m_RSAVerifyCtx, EVP_sha1()) <= 0)
{
printf("Failed Verify Init\n");
return false;
}
if (EVP_VerifyUpdate(m_RSAVerifyCtx, Msg, MsgLen) <= 0)
{
printf("Failed Verify \n");
return false;
}
if (EVP_VerifyFinal(m_RSAVerifyCtx, MsgHash, MsgHashLen, m_ServerPublicKey)<=0);
{
printf("Failed Final Verify %s\n",ERR_error_string(ERR_get_error(),NULL));
return false;
}
EVP_MD_CTX_cleanup(m_RSAVerifyCtx);
return true;
}
密钥生成成功,我已经查看了它创建的密钥有效,并且格式为 ----- BEGIN PRIVATE KEY -----
,一些大素数, ----- END PRIVATE KEY -----
。符号似乎成功并返回一个散列。 EVP_Verify在最后一步EVP_VerifyFinal失败,ERR_error_string报告:
Key Generation is successful, and i have viewed the keys it creates they appear to be valid and are in the format -----BEGIN PRIVATE KEY-----
, some large prime, -----END PRIVATE KEY-----
. Sign appears to be successful and returns a hash. EVP_Verify fails on the last step EVP_VerifyFinal, ERR_error_string reports this:
error:00000000:lib(0):func(0):reason(0)
这显然没有帮助,有人可以指出我可能做错了。这是我第一次潜入openssl,所以这里可能有一些大问题。
Which is obviously not helpful, can someone please point out what i may be doing wrong. This is my first dive into openssl, so there may be some big issues here.
推荐答案
感谢JWW和indiv i解决我的问题,这是一个问题,我使用较旧的API,和不当的返回检查。解决方案:
Thanks to JWW and indiv i was able to solve my problem, it was an issue with me using older API's, and improper return checking. Solution:
bool SecureCrypto::RSASign(const unsigned char* Msg, size_t MsgLen,unsigned char** EncMsg, size_t* MsgLenEnc)
{
if (EVP_DigestSignInit(m_RSASignCtx,NULL, EVP_sha256(), NULL,m_ServerPrivateKey) <= 0)
{
printf("Failed Init\n");
return false;
}
if (EVP_DigestSignUpdate(m_RSASignCtx, Msg, MsgLen) <= 0)
{
printf("Failed Update\n");
return false;
}
//Get Hash Size
if (EVP_DigestSignFinal(m_RSASignCtx, NULL,MsgLenEnc) <=0)
{
printf("Failed Final Sign\n");
return false;
}
//Allocate Space for hash
*EncMsg = (unsigned char*)malloc(*MsgLenEnc);
if (EVP_DigestSignFinal(m_RSASignCtx, *EncMsg, MsgLenEnc) <= 0)
{
printf("Failed Final Sign 1\n");
return false;
}
EVP_MD_CTX_cleanup(m_RSASignCtx);
return true;
}
bool SecureCrypto::RSAVerifySignature(const unsigned char* MsgHash, size_t MsgHashLen,unsigned char* Msg, size_t MsgLen,bool* Authentic)
{
if (EVP_DigestVerifyInit(m_RSAVerifyCtx,NULL, EVP_sha256(),NULL,m_ServerPrivateKey) <= 0)
{
printf("Failed Verify Init\n");
return false;
}
if (EVP_DigestVerifyUpdate(m_RSAVerifyCtx, Msg, MsgLen) <= 0)
{
printf("Failed Verify \n");
return false;
}
int AuthStatus = EVP_DigestVerifyFinal(m_RSAVerifyCtx, (unsigned char*)MsgHash, MsgHashLen);
if (AuthStatus==1)
{
//Message Authentic
*Authentic = true;
EVP_MD_CTX_cleanup(m_RSAVerifyCtx);
return true;
} else if(AuthStatus==0){
//Message Not Authentic
*Authentic = false;
EVP_MD_CTX_cleanup(m_RSAVerifyCtx);
return true; //Still did our job correctly
} else{
printf("Error\n");
*Authentic = false;
EVP_MD_CTX_cleanup(m_RSAVerifyCtx);
return false;
}
}
我不能相信我错过了这样一个明显的例子,谢谢对你帮助家伙,对不起我看起来那么愚蠢的哈哈。
I cant believe i missed such an obvious example, thanks for you help guys, sorry i looked so stupid lol.
这篇关于OpenSSL在EVP_VerifyFinal失败的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!