Sign up or Log in
Support
Home
Jobs
Forums
Forge
Ideas
Members
Badges

[CryptoAPI] Digital Signatures?

New Post
Forge Component

(18)
Published on 2018-11-11 by Ricardo Silva
18 votes
Published on 2018-11-11 by Ricardo Silva
I have a need to both encrypt and digitally sign a document.  Can this library be used for digital signatures?  I understand that you would want to hash a document and then encrypt the digest with the signer's private key.  When I tried using the library, I was successful in encrypting with the public key and decrypting with the private key, but encrypting with the private key gives an error when trying to decrypt with the public key.  

I am new to this subject so I'm sure I'm doing something wrong, but could you help me.  I'm using the RSA encryption algorithm, with keys created using your methods (GenerateRSAKey & GetRSAPublicKey).

Thanks for any help you can provide.
Dislike(0)
Like(0)
Dislike(0)
Like(0)
Hello Joe,

I have not implemented signatures with RSA keys in CryptoAPI.

Can you provide a more concrete example of what you are trying to achieve? What are the security properties you want to have?

In particular, when you say you want to "encrypt and digitally sign a document", are we talking about a binary file, or a piece of text?
Dislike(0)
Like(0)
Dislike(0)
Like(0)
I am building an app that brokers the exchange of confidential documents.  To date, they are all JSON documents (therefore all text).  The process I want to enable is:
Alice makes a request and provides her public key.  I forward the request to Bob.  Bob creates a JSON object, which he would has using SHA-256 to create a digest.  Bob would encrypt the digest with his private key to digitally sign the document.  Bob would then create a JSON document that had original JSON + Signature + Bob's public key + hash method + encryption method.  Bob would then encrypt the composite JSON document with Alice's public key and return it to me.  I then forward the ciphertext to Alice which would decrypt using her private key.  Extract Bob's public key to validate the digital signature.  This is where I'm failing  Bob's public key needs to be able to decrypt the digest so Alice can compare that against her hashing the first JSON document to verify nothing has been modified and provide non-repudiation.   Hope that gives you what you're looking for.

I really appreciate the help!
Dislike(0)
Like(0)
Dislike(0)
Like(0)
Hi Joe,

While the concept with RSA is that you encrypt with your private key to sign something, in practice there are other things you need to take into consideration. So the signing "algorithm" is slightly different from the encryption algorithm. Basically what changes is the way you pad the value you encrypt.

In your case, that probably wouldn't work. Encrypting with RSA is roughly limited to the size of the RSA key, and the output of an encryption is the same size as the key. This means that most like you won't be able to encrypt the JSON + Signature + hash method + encryption method with the same key.

What's usually done is you encrypt a symmetric key with the public key and encrypt the data with the symmetric key. In CryptoAPI terms that would be:

Encrypt_RSA(Alice's key, GenerateAESKey()) + Encrypt(AESKey, json document)

In any case, back to the signing part: Currently CryptoAPI does not have this. I'm not sure when I would be able to pick this up to ensure it works in both .NET and Java. In any case I believe you can look at the CryptoAPI code and make your own signing functions based on the .NET APIs .
Dislike(0)
Like(0)
Dislike(0)
Like(0)
Ricardo,
Thanks for your help.  As you can tell I am new to encryption details.  There is always so much to learn moving from the theory to the practice!  :-)  I appreciate the advice and the great work that you have done for the community.  I'm also using ardoJSON.

Best regards,
Joe
Dislike(0)
Like(0)
Dislike(0)
Like(0)

Hi Ricardo,

I also have a need to sign an SHA1 hash with an RSA private key. I'm wondering if you had a chance to work on this since this old thread started back in 2015? If not, is there any chance you could add this function to CryptoAPI anytime soon?

Thanks in advance.

Charles

Dislike(0)
Like(0)
Dislike(0)
Like(0)

Hi Charles,

I did look into this but did not reach any conclusion of how I should present this to OutSystems Platform users.

Can you provide some more information on what you're trying to achieve? Who you're trying to integrate with?

Best regards,

Dislike(0)
Like(0)
Dislike(0)
Like(0)

Hi Ricardo,

Thanks for your reply. I was trying to connect to a Private Application in Xero. This requires an RSA-SHA1 signature to be sent as part of the Authorisation header of the request.

There is some general info here as a starting point: https://developer.xero.com/documentation/auth-and-limits/private-applications

I did manage to solve this in the meantime by creating a .Net extension. I'm considering publishing it to the Forge as a separate extension, and I'd be happy for you to incorporate it into the CryptoAPI too if there is a demand for it, but I can't help you with the Java version.

Dislike(0)
Like(0)
Dislike(0)
Like(0)

Charles Papp wrote:

I did manage to solve this in the meantime by creating a .Net extension. I'm considering publishing it to the Forge as a separate extension...

UPDATE: I published the function to generate the RSA-SHA1 signature from a Plain Text string with a Private Key (in XML format) as part of the CryptoSign component, in case anyone else finds a need for this.


Dislike(0)
Like(0)
Dislike(0)
Like(0)

Question 


Can I use this forge component for a digital signature. The signature needs to be legally valid.

Dislike(0)
Like(0)
Dislike(0)
Like(0)

Hello Edward,

For determining whether a digital / electronic signature is legally valid, I recommend reaching out to a lawyer in the country you wish for the signature to be valid.

What this component allows is getting a digital signature over a piece of text. If you need to obtain that for a document, it currently does not provide an interface for it.

The term "digital signature" for legal purposes is also pretty ambiguous as it can mean "a cryptographically strong digital signature" (what this component could provide you with) or "a digital representation of a handwritten signature", which this component does not help you with.

Even if a digital signature in the cryptographic sense is what's required, there are also probably other legal, non-technical, requirements that are needed for the signature to be accepted. Again, I have ABSOLUTELY NO KNOWLEDGE OF THIS, and am not in any manner or form any kind of expert in legal manners, so you should reach out to a lawyer to understand exactly what you need to do.

Dislike(0)
Like(0)
Dislike(0)
Like(0)
Login to reply
Company
Corporate Site
Contacts
Support
Technical Support
Community Forums
 OutSystems© All rights reserved. Custom built with (h) and (o)