ASN1_item_sign¶

#include <openssl/x509.h>

int ASN1_item_sign_ex(const ASN1_ITEM *it, X509_ALGOR *algor1,
                      X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
                      const void *data, const ASN1_OCTET_STRING *id,
                      EVP_PKEY *pkey, const EVP_MD *md, OSSL_LIB_CTX *libctx,
                      const char *propq);

int ASN1_item_sign(const ASN1_ITEM *it, X509_ALGOR *algor1, X509_ALGOR *algor2,
                   ASN1_BIT_STRING *signature, const void *data,
                   EVP_PKEY *pkey, const EVP_MD *md);

int ASN1_item_sign_ctx(const ASN1_ITEM *it, X509_ALGOR *algor1,
                       X509_ALGOR *algor2, ASN1_BIT_STRING *signature,
                       const void *data, EVP_MD_CTX *ctx);

int ASN1_item_verify_ex(const ASN1_ITEM *it, const X509_ALGOR *alg,
                        const ASN1_BIT_STRING *signature, const void *data,
                        const ASN1_OCTET_STRING *id, EVP_PKEY *pkey,
                        OSSL_LIB_CTX *libctx, const char *propq);

int ASN1_item_verify(const ASN1_ITEM *it, const X509_ALGOR *alg,
                     const ASN1_BIT_STRING *signature, const void *data,
                     EVP_PKEY *pkey);

int ASN1_item_verify_ctx(const ASN1_ITEM *it, const X509_ALGOR *alg,
                         const ASN1_BIT_STRING *signature, const void *data,
                         EVP_MD_CTX *ctx);

#include <openssl/x509.h>
#include <openssl/asn1t.h>

/* An object used to store the ASN1 data fields that will be signed */
typedef struct MySignInfoObject_st
{
    ASN1_INTEGER *version;
    X509_ALGOR sig_alg;
} MySignInfoObject;

DECLARE_ASN1_FUNCTIONS(MySignInfoObject)
/*
 * A higher level object containing the ASN1 fields, signature alg and
 * output signature.
 */
typedef struct MyObject_st
{
    MySignInfoObject info;
    X509_ALGOR sig_alg;
    ASN1_BIT_STRING *signature;
} MyObject;

DECLARE_ASN1_FUNCTIONS(MyObject)

/* The ASN1 definition of MySignInfoObject */
ASN1_SEQUENCE_cb(MySignInfoObject, NULL) = {
    ASN1_SIMPLE(MySignInfoObject, version, ASN1_INTEGER)
    ASN1_EMBED(MySignInfoObject, sig_alg, X509_ALGOR),
} ASN1_SEQUENCE_END_cb(MySignInfoObject, MySignInfoObject)

/* new, free, d2i & i2d functions for MySignInfoObject */
IMPLEMENT_ASN1_FUNCTIONS(MySignInfoObject)

/* The ASN1 definition of MyObject */
ASN1_SEQUENCE_cb(MyObject, NULL) = {
    ASN1_EMBED(MyObject, info, MySignInfoObject),
    ASN1_EMBED(MyObject, sig_alg, X509_ALGOR),
    ASN1_SIMPLE(MyObject, signature, ASN1_BIT_STRING)
} ASN1_SEQUENCE_END_cb(MyObject, MyObject)

/* new, free, d2i & i2d functions for MyObject */
IMPLEMENT_ASN1_FUNCTIONS(MyObject)

int test_asn1_item_sign_verify(const char *mdname, EVP_PKEY *pkey, long version)
{
   int ret = 0;
   unsigned char *obj_der = NULL;
   const unsigned char *p = NULL;
   MyObject *obj = NULL, *loaded_obj = NULL;
   const ASN1_ITEM *it = ASN1_ITEM_rptr(MySignInfoObject);
   EVP_MD_CTX *sctx = NULL, *vctx = NULL;
   int len;

   /* Create MyObject and set its version */
   obj = MyObject_new();
   if (obj == NULL)
       goto err;
   if (!ASN1_INTEGER_set(obj->info.version, version))
       goto err;

   /* Set the key and digest used for signing */
   sctx = EVP_MD_CTX_new();
   if (sctx == NULL
       || !EVP_DigestSignInit_ex(sctx, NULL, mdname, NULL, NULL, pkey))
       goto err;

   /*
    * it contains the mapping between ASN.1 data and an object MySignInfoObject
    * obj->info is the 'MySignInfoObject' object that will be
    *   converted into DER data and then signed.
    * obj->signature will contain the output signature.
    * obj->sig_alg is filled with the private key's signing algorithm id.
    * obj->info.sig_alg is another copy of the signing algorithm id that sits
    * within MyObject.
    */
   len = ASN1_item_sign_ctx(it, &obj->sig_alg, &obj->info.sig_alg,
                            obj->signature, &obj->info, sctx);
   if (len <= 0
       || X509_ALGOR_cmp(&obj->sig_alg, &obj->info.sig_alg) != 0)
       goto err;

   /* Output MyObject in der form */
   len = i2d_MyObject(obj, &obj_der);
   if (len <= 0)
       goto err;

   /* Set the key and digest used for verifying */
   vctx = EVP_MD_CTX_new();
   if (vctx == NULL
       || !EVP_DigestVerifyInit_ex(vctx, NULL, mdname, NULL, NULL, pkey))
       goto err;

   /* Load the der data back into an object */
   p = obj_der;
   loaded_obj = d2i_MyObject(NULL, &p, len);
   if (loaded_obj == NULL)
       goto err;
   /* Verify the loaded object */
   ret = ASN1_item_verify_ctx(it, &loaded_obj->sig_alg, loaded_obj->signature,
                              &loaded_obj->info, vctx);