PureBasic

RSASSA-PSS Sign Text

Signs text to create a PKCS7/CMS signature. The signature algorithm is RSASSA-PSS with SHA256. PureBasic

IncludeFile "CkCert.pb"
IncludeFile "CkStringBuilder.pb"
IncludeFile "CkPfx.pb"
IncludeFile "CkCrypt2.pb"

Procedure ChilkatExample()

    success.i = 0

    ; This example requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    crypt.i = CkCrypt2::ckCreate()
    If crypt.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; Get a digital certificate with private key from a .pfx
    ; (Chilkat has many different ways to provide a cert + private key for siging.
    ; Using a PFX is just one possible option.)
    pfx.i = CkPfx::ckCreate()
    If pfx.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkPfx::ckLoadPfxFile(pfx,"qa_data/rsassa-pss/privatekey.pfx","PFX_PASSWORD")
    If success = 0
        Debug CkPfx::ckLastErrorText(pfx)
        CkCrypt2::ckDispose(crypt)
        CkPfx::ckDispose(pfx)
        ProcedureReturn
    EndIf

    ; Get the certificate to be used for signing.
    ; (The typical case for a PFX is that it contains a cert with an associated private key,
    ; as well as other certificates in the chain of authentication.  The cert with the private
    ; key should be in the first position at index 0.)

    cert.i = CkCert::ckCreate()
    If cert.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkPfx::ckCertAt(pfx,0,cert)
    If success = 0
        Debug CkPfx::ckLastErrorText(pfx)
        CkCrypt2::ckDispose(crypt)
        CkPfx::ckDispose(pfx)
        CkCert::ckDispose(cert)
        ProcedureReturn
    EndIf

    CkCrypt2::ckSetSigningCert(crypt,cert)

    ; Indicate that RSASSA-PSS with SHA256 should be used.
    CkCrypt2::setCkSigningAlg(crypt, "pss")
    CkCrypt2::setCkHashAlgorithm(crypt, "sha256")

    CkCrypt2::setCkEncodingMode(crypt, "base64_mime")

    ; Build a string to sign
    sb.i = CkStringBuilder::ckCreate()
    If sb.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    i.i = 1
    While i < 12
        CkStringBuilder::ckAppendInt(sb,i)
        CkStringBuilder::ckAppend(sb," the quick brown fox jumped over the lazy dog." + Chr(13) + Chr(10))
        i = i + 1
    Wend

    Debug CkStringBuilder::ckGetAsString(sb)

    ; The string to be encrypted looks like this:

    ; 1 the quick brown fox jumped over the lazy dog.
    ; 2 the quick brown fox jumped over the lazy dog.
    ; 3 the quick brown fox jumped over the lazy dog.
    ; 4 the quick brown fox jumped over the lazy dog.
    ; ...

    ; Make sure to specify the byte representation (character encoding)
    CkCrypt2::setCkCharset(crypt, "utf-8")

    ; Sign the string to get a PKCS7 detached signature in base64 format.
    pkcs7sig.s = CkCrypt2::ckSignSbENC(crypt,sb)
    Debug "Detached PCKS7 Signature:"
    Debug pkcs7sig

    ; This signature looks like this:

    ; MIIG5wYJKoZIhvcNAQcCoIIG2DCCBtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg
    ; ggL4MIIC9DCCAl2gAwIBAgIJAMPsJCT11cniMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJB
    ; VTERMA8GA1UECAwIVmljdG9yaWExEjAQBgNVBAcMCU1lbGJvdXJuZTEhMB8GA1UECgwYSW50ZXJu
    ; ZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDDAZXaWRnZXQxKDAmBgkqhkiG9w0BCQEWGWFkbWlu
    ; QGludGVybmV0d2lkZ2V0cy5jb20wHhcNMTYxMTAxMTY1MjMyWhcNMjExMDMxMTY1MjMyWjCBkjEL
    ; MAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIwEAYDVQQHDAlNZWxib3VybmUxITAfBgNV
    ; BAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEPMA0GA1UEAwwGV2lkZ2V0MSgwJgYJKoZIhvcN
    ; AQkBFhlhZG1pbkBpbnRlcm5ldHdpZGdldHMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
    ; gQDGIdoCjyavs+F/Rm0VIB4m6O7VL1j+1IqieoR9NEX2GQvu2VCdceyxf9qaw1bxipEvjLwUkw7M
    ; e+BTlLpWQbBMH87s6KpsC8MVyXhMLpP0oM8NFix/vLz2wdLhUh7CZvJA0plqkJk9bj57QIu+EO1k
    ; tUHM2DFb6sckvCL2yybD1wIDAQABo1AwTjAdBgNVHQ4EFgQUONKKu2zsXIrinWxIGT654vrcQwsw
    ; HwYDVR0jBBgwFoAUONKKu2zsXIrinWxIGT654vrcQwswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
    ; AQsFAAOBgQArFvdi5u9i2QF1Qw+cdC1l7w2Y3+q6RIkln2W8rWJFje00644o8hXy7v46giJCedmF
    ; ULlhm1n7XIsZGy2W3lJ77v5agn9gFwXu1h3cqkGXkoteE6SQJQXWgsW3GWPveObvTL8LF4y57fgM
    ; 9ZWS+V9MJajeu44Rf/tU17TLYKjvEjGCA7MwggOvAgEBMIGgMIGSMQswCQYDVQQGEwJBVTERMA8G
    ; A1UECAwIVmljdG9yaWExEjAQBgNVBAcMCU1lbGJvdXJuZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lk
    ; Z2l0cyBQdHkgTHRkMQ8wDQYDVQQDDAZXaWRnZXQxKDAmBgkqhkiG9w0BCQEWGWFkbWluQGludGVy
    ; bmV0d2lkZ2V0cy5jb20CCQDD7CQk9dXJ4jANBglghkgBZQMEAgEFAKCCAjQwGAYJKoZIhvcNAQkD
    ; MQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwNDI5MTYzNTQ3WjAvBgkqhkiG9w0BCQQx
    ; IgQgnXqtpfBjs9ZZUJxbNYbwYvpmXTGgIbYErkIA3jQo0EEwXwYJKoZIhvcNAQkPMVIwUDALBglg
    ; hkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsO
    ; AwIHMA0GCCqGSIb3DQMCAgEoMIGxBgkrBgEEAYI3EAQxgaMwgaAwgZIxCzAJBgNVBAYTAkFVMREw
    ; DwYDVQQIDAhWaWN0b3JpYTESMBAGA1UEBwwJTWVsYm91cm5lMSEwHwYDVQQKDBhJbnRlcm5ldCBX
    ; aWRnaXRzIFB0eSBMdGQxDzANBgNVBAMMBldpZGdldDEoMCYGCSqGSIb3DQEJARYZYWRtaW5AaW50
    ; ZXJuZXR3aWRnZXRzLmNvbQIJAMPsJCT11cniMIGzBgsqhkiG9w0BCRACCzGBo6CBoDCBkjELMAkG
    ; A1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIwEAYDVQQHDAlNZWxib3VybmUxITAfBgNVBAoM
    ; GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEPMA0GA1UEAwwGV2lkZ2V0MSgwJgYJKoZIhvcNAQkB
    ; FhlhZG1pbkBpbnRlcm5ldHdpZGdldHMuY29tAgkAw+wkJPXVyeIwPQYJKoZIhvcNAQEKMDCgDTAL
    ; BglghkgBZQMEAgGhGjAYBgkqhkiG9w0BAQgwCwYJYIZIAWUDBAIBogMCASAEgYBFgBS1vtBoac6P
    ; /NRcY3jdytoxK7xc8vEYW/PhgsbE+sP7dvu6eoRLVicoQ8RIeMh3CtPZFq1+JcL5NNzQoAotizTX
    ; EKhiceX1mC5ocCeEvgNouxkN2Qr/X12m60rNvNl5r+GEqiqx/1fs2yRAl5sIzwPsMMY3p9tGOpy0
    ; 5p7sRQ==

    ; The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
    ; then copy-and-paste the Base64 signature into the form and decode..

    ; The signature can be verified against the original data like this:
    success = CkCrypt2::ckVerifySbENC(crypt,sb,pkcs7sig)
    Debug "Signature verified: " + Str(success)


    CkCrypt2::ckDispose(crypt)
    CkPfx::ckDispose(pfx)
    CkCert::ckDispose(cert)
    CkStringBuilder::ckDispose(sb)


    ProcedureReturn
EndProcedure