Joe Ivey
Rank: #28325
443Views
11Comments
[CryptoAPI] Digital Signatures?
Question
Forge
CryptoAPI
Forge component by Ricardo Silva
34
Published on 03 Mar 2019
I have a need to both encrypt and digitally sign a document.  Can this library be used for digital signatures?  I understand that you would want to hash a document and then encrypt the digest with the signer's private key.  When I tried using the library, I was successful in encrypting with the public key and decrypting with the private key, but encrypting with the private key gives an error when trying to decrypt with the public key.  

I am new to this subject so I'm sure I'm doing something wrong, but could you help me.  I'm using the RSA encryption algorithm, with keys created using your methods (GenerateRSAKey & GetRSAPublicKey).

Thanks for any help you can provide.
0
0
on 2015-11-17
Copy link to comment
Ricardo Silva
Rank: #0
Hello Joe,

I have not implemented signatures with RSA keys in CryptoAPI.

Can you provide a more concrete example of what you are trying to achieve? What are the security properties you want to have?

In particular, when you say you want to "encrypt and digitally sign a document", are we talking about a binary file, or a piece of text?
0
0
on 2015-11-18
Copy link to comment
Joe Ivey
Rank: #28325
I am building an app that brokers the exchange of confidential documents.  To date, they are all JSON documents (therefore all text).  The process I want to enable is:
Alice makes a request and provides her public key.  I forward the request to Bob.  Bob creates a JSON object, which he would has using SHA-256 to create a digest.  Bob would encrypt the digest with his private key to digitally sign the document.  Bob would then create a JSON document that had original JSON + Signature + Bob's public key + hash method + encryption method.  Bob would then encrypt the composite JSON document with Alice's public key and return it to me.  I then forward the ciphertext to Alice which would decrypt using her private key.  Extract Bob's public key to validate the digital signature.  This is where I'm failing  Bob's public key needs to be able to decrypt the digest so Alice can compare that against her hashing the first JSON document to verify nothing has been modified and provide non-repudiation.   Hope that gives you what you're looking for.

I really appreciate the help!
0
0
on 2015-11-18
Copy link to comment
Ricardo Silva
Rank: #0
Hi Joe,

While the concept with RSA is that you encrypt with your private key to sign something, in practice there are other things you need to take into consideration. So the signing "algorithm" is slightly different from the encryption algorithm. Basically what changes is the way you pad the value you encrypt.

In your case, that probably wouldn't work. Encrypting with RSA is roughly limited to the size of the RSA key, and the output of an encryption is the same size as the key. This means that most like you won't be able to encrypt the JSON + Signature + hash method + encryption method with the same key.

What's usually done is you encrypt a symmetric key with the public key and encrypt the data with the symmetric key. In CryptoAPI terms that would be:

Encrypt_RSA(Alice's key, GenerateAESKey()) + Encrypt(AESKey, json document)

In any case, back to the signing part: Currently CryptoAPI does not have this. I'm not sure when I would be able to pick this up to ensure it works in both .NET and Java. In any case I believe you can look at the CryptoAPI code and make your own signing functions based on the .NET APIs .
0
0
on 2015-11-18
Copy link to comment
Joe Ivey
Rank: #28325
Ricardo,
Thanks for your help.  As you can tell I am new to encryption details.  There is always so much to learn moving from the theory to the practice!  :-)  I appreciate the advice and the great work that you have done for the community.  I'm also using ardoJSON.

Best regards,
Joe
0
0
on 2015-11-18
Copy link to comment
Charles Papp
Rank: #2288

Hi Ricardo,

I also have a need to sign an SHA1 hash with an RSA private key. I'm wondering if you had a chance to work on this since this old thread started back in 2015? If not, is there any chance you could add this function to CryptoAPI anytime soon?

Thanks in advance.

Charles

0
0
on 2018-06-11
Copy link to comment
Ricardo Silva
Rank: #0

Hi Charles,

I did look into this but did not reach any conclusion of how I should present this to OutSystems Platform users.

Can you provide some more information on what you're trying to achieve? Who you're trying to integrate with?

Best regards,

0
0
on 2018-06-11
Copy link to comment
Charles Papp
Rank: #2288

Hi Ricardo,

Thanks for your reply. I was trying to connect to a Private Application in Xero. This requires an RSA-SHA1 signature to be sent as part of the Authorisation header of the request.

There is some general info here as a starting point: https://developer.xero.com/documentation/auth-and-limits/private-applications

I did manage to solve this in the meantime by creating a .Net extension. I'm considering publishing it to the Forge as a separate extension, and I'd be happy for you to incorporate it into the CryptoAPI too if there is a demand for it, but I can't help you with the Java version.

0
0
on 2018-06-12
Copy link to comment

Question 


Can I use this forge component for a digital signature. The signature needs to be legally valid.

0
0
on 2019-01-02
Copy link to comment
Ricardo Silva
Rank: #0

Hello Edward,

For determining whether a digital / electronic signature is legally valid, I recommend reaching out to a lawyer in the country you wish for the signature to be valid.

What this component allows is getting a digital signature over a piece of text. If you need to obtain that for a document, it currently does not provide an interface for it.

The term "digital signature" for legal purposes is also pretty ambiguous as it can mean "a cryptographically strong digital signature" (what this component could provide you with) or "a digital representation of a handwritten signature", which this component does not help you with.

Even if a digital signature in the cryptographic sense is what's required, there are also probably other legal, non-technical, requirements that are needed for the signature to be accepted. Again, I have ABSOLUTELY NO KNOWLEDGE OF THIS, and am not in any manner or form any kind of expert in legal manners, so you should reach out to a lawyer to understand exactly what you need to do.

0
0
on 2019-01-02
Copy link to comment
Abeer ElAssal
Rank: #1137

Hi,

 I'm hoping if someone can help me.


I'm getting an error when trying the component.

First: I tried using

RSA_NewKey

and it gives me the private key, when I use the function 

RSA_GetPublicKey

to extract public key from the private one generated, I get empty text.



So I thought of sending the private key without these two texts "<RSAKeyValue><Modulus>" and "</RSAKeyValue>" and i'm getting wrong syntax, any lead how to do so?


0
0
on 2020-10-19
Copy link to comment