Lua Requires Chilkat v11.0.0+

RSASSA-PSS Sign String to Create Base64 PCKS7 Signature

See more Digital Signatures Examples

Signs a string to create a PKCS7 signature in the base64 encoding. The signature algorithm is RSASSA-PSS with SHA256. Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local crypt = chilkat.Crypt2.new()

-- Get a digital certificate with private key from a .pfx
-- (Chilkat has many different ways to provide a cert + private key for siging.
-- Using a PFX is just one possible option.)
local pfx = chilkat.Pfx.new()
local success = pfx:load_pfx_file("qa_data/rsassa-pss/privatekey.pfx", "PFX_PASSWORD")
if not success then
    print(pfx.last_error_text)
    return
end

-- Get the certificate to be used for signing.
-- (The typical case for a PFX is that it contains a cert with an associated private key,
-- as well as other certificates in the chain of authentication.  The cert with the private
-- key should be in the first position at index 0.)

local cert = chilkat.Cert.new()
success = pfx:cert_at(0, cert)
if not success then
    print(pfx.last_error_text)
    return
end

crypt:set_signing_cert(cert)

-- Indicate that RSASSA-PSS with SHA256 should be used.
crypt.signing_alg = "pss"
crypt.hash_algorithm = "sha256"

crypt.encoding_mode = "base64"

-- Sign a string and return the base64 PKCS7 detached signature
local originalText = "This is a test"
local pkcs7sig = crypt:sign_string_enc(originalText)
print("Detached Signature:")
print(pkcs7sig)

-- This signature looks like this:
-- MIIG5wYJKoZIhvcNAQcCoIIG2DCCBtQCAQExDzANBgl .. YToLqEwTdU87ox5g7rvw==

-- The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
-- then copy-and-paste the Base64 signature into the form and decode..

-- The signature can be verified against the original data like this:
success = crypt:verify_string_enc(originalText, pkcs7sig)
print("Signature verified: " .. tostring(success))
success = crypt:verify_string_enc("Not the original text", pkcs7sig)
print("Signature verified: " .. tostring(success))

-- Now we'll create an opaque signature (the opposite of a detached signature).
-- An opaque signature is a PKCS7 message that contains both the original data and
-- the signature.  The verification process extracts the original data.
local opaqueSig = crypt:opaque_sign_string_enc(originalText)
print("Opaque Signature:")
print(opaqueSig)

-- The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
-- then copy-and-paste the Base64 signature into the form and decode..

-- We can verify and extract the original data:
local origTxt = crypt:opaque_verify_string_enc(opaqueSig)
if not crypt.last_method_success then
    print("Signature verification failed.")
    print(crypt.last_error_text)
    return
end

print("Signature verified.")
print("Extracted text:" .. origTxt)