Tcl

RSASSA-PSS Sign Text

Signs text to create a PKCS7/CMS signature. The signature algorithm is RSASSA-PSS with SHA256. Tcl

load ./chilkat.dll

set success 0

# This example requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

set crypt [new_CkCrypt2]

# Get a digital certificate with private key from a .pfx
# (Chilkat has many different ways to provide a cert + private key for siging.
# Using a PFX is just one possible option.)
set pfx [new_CkPfx]

set success [CkPfx_LoadPfxFile $pfx "qa_data/rsassa-pss/privatekey.pfx" "PFX_PASSWORD"]
if {$success == 0} then {
    puts [CkPfx_lastErrorText $pfx]
    delete_CkCrypt2 $crypt
    delete_CkPfx $pfx
    exit
}

# Get the certificate to be used for signing.
# (The typical case for a PFX is that it contains a cert with an associated private key,
# as well as other certificates in the chain of authentication.  The cert with the private
# key should be in the first position at index 0.)

set cert [new_CkCert]

set success [CkPfx_CertAt $pfx 0 $cert]
if {$success == 0} then {
    puts [CkPfx_lastErrorText $pfx]
    delete_CkCrypt2 $crypt
    delete_CkPfx $pfx
    delete_CkCert $cert
    exit
}

CkCrypt2_SetSigningCert $crypt $cert

# Indicate that RSASSA-PSS with SHA256 should be used.
CkCrypt2_put_SigningAlg $crypt "pss"
CkCrypt2_put_HashAlgorithm $crypt "sha256"

CkCrypt2_put_EncodingMode $crypt "base64_mime"

# Build a string to sign
set sb [new_CkStringBuilder]

set i 1
while {$i < 12} {
    CkStringBuilder_AppendInt $sb $i
    CkStringBuilder_Append $sb " the quick brown fox jumped over the lazy dog.\r\n"
    set i [expr $i + 1]
}

puts [CkStringBuilder_getAsString $sb]

# The string to be encrypted looks like this:

# 1 the quick brown fox jumped over the lazy dog.
# 2 the quick brown fox jumped over the lazy dog.
# 3 the quick brown fox jumped over the lazy dog.
# 4 the quick brown fox jumped over the lazy dog.
# ...

# Make sure to specify the byte representation (character encoding)
CkCrypt2_put_Charset $crypt "utf-8"

# Sign the string to get a PKCS7 detached signature in base64 format.
set pkcs7sig [CkCrypt2_signSbENC $crypt $sb]
puts "Detached PCKS7 Signature:"
puts "$pkcs7sig"

# This signature looks like this:

# MIIG5wYJKoZIhvcNAQcCoIIG2DCCBtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg
# ggL4MIIC9DCCAl2gAwIBAgIJAMPsJCT11cniMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJB
# VTERMA8GA1UECAwIVmljdG9yaWExEjAQBgNVBAcMCU1lbGJvdXJuZTEhMB8GA1UECgwYSW50ZXJu
# ZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDDAZXaWRnZXQxKDAmBgkqhkiG9w0BCQEWGWFkbWlu
# QGludGVybmV0d2lkZ2V0cy5jb20wHhcNMTYxMTAxMTY1MjMyWhcNMjExMDMxMTY1MjMyWjCBkjEL
# MAkGA1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIwEAYDVQQHDAlNZWxib3VybmUxITAfBgNV
# BAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEPMA0GA1UEAwwGV2lkZ2V0MSgwJgYJKoZIhvcN
# AQkBFhlhZG1pbkBpbnRlcm5ldHdpZGdldHMuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
# gQDGIdoCjyavs+F/Rm0VIB4m6O7VL1j+1IqieoR9NEX2GQvu2VCdceyxf9qaw1bxipEvjLwUkw7M
# e+BTlLpWQbBMH87s6KpsC8MVyXhMLpP0oM8NFix/vLz2wdLhUh7CZvJA0plqkJk9bj57QIu+EO1k
# tUHM2DFb6sckvCL2yybD1wIDAQABo1AwTjAdBgNVHQ4EFgQUONKKu2zsXIrinWxIGT654vrcQwsw
# HwYDVR0jBBgwFoAUONKKu2zsXIrinWxIGT654vrcQwswDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
# AQsFAAOBgQArFvdi5u9i2QF1Qw+cdC1l7w2Y3+q6RIkln2W8rWJFje00644o8hXy7v46giJCedmF
# ULlhm1n7XIsZGy2W3lJ77v5agn9gFwXu1h3cqkGXkoteE6SQJQXWgsW3GWPveObvTL8LF4y57fgM
# 9ZWS+V9MJajeu44Rf/tU17TLYKjvEjGCA7MwggOvAgEBMIGgMIGSMQswCQYDVQQGEwJBVTERMA8G
# A1UECAwIVmljdG9yaWExEjAQBgNVBAcMCU1lbGJvdXJuZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lk
# Z2l0cyBQdHkgTHRkMQ8wDQYDVQQDDAZXaWRnZXQxKDAmBgkqhkiG9w0BCQEWGWFkbWluQGludGVy
# bmV0d2lkZ2V0cy5jb20CCQDD7CQk9dXJ4jANBglghkgBZQMEAgEFAKCCAjQwGAYJKoZIhvcNAQkD
# MQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTcwNDI5MTYzNTQ3WjAvBgkqhkiG9w0BCQQx
# IgQgnXqtpfBjs9ZZUJxbNYbwYvpmXTGgIbYErkIA3jQo0EEwXwYJKoZIhvcNAQkPMVIwUDALBglg
# hkgBZQMEAQIwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMA0GCCqGSIb3DQMCAgFAMAcGBSsO
# AwIHMA0GCCqGSIb3DQMCAgEoMIGxBgkrBgEEAYI3EAQxgaMwgaAwgZIxCzAJBgNVBAYTAkFVMREw
# DwYDVQQIDAhWaWN0b3JpYTESMBAGA1UEBwwJTWVsYm91cm5lMSEwHwYDVQQKDBhJbnRlcm5ldCBX
# aWRnaXRzIFB0eSBMdGQxDzANBgNVBAMMBldpZGdldDEoMCYGCSqGSIb3DQEJARYZYWRtaW5AaW50
# ZXJuZXR3aWRnZXRzLmNvbQIJAMPsJCT11cniMIGzBgsqhkiG9w0BCRACCzGBo6CBoDCBkjELMAkG
# A1UEBhMCQVUxETAPBgNVBAgMCFZpY3RvcmlhMRIwEAYDVQQHDAlNZWxib3VybmUxITAfBgNVBAoM
# GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEPMA0GA1UEAwwGV2lkZ2V0MSgwJgYJKoZIhvcNAQkB
# FhlhZG1pbkBpbnRlcm5ldHdpZGdldHMuY29tAgkAw+wkJPXVyeIwPQYJKoZIhvcNAQEKMDCgDTAL
# BglghkgBZQMEAgGhGjAYBgkqhkiG9w0BAQgwCwYJYIZIAWUDBAIBogMCASAEgYBFgBS1vtBoac6P
# /NRcY3jdytoxK7xc8vEYW/PhgsbE+sP7dvu6eoRLVicoQ8RIeMh3CtPZFq1+JcL5NNzQoAotizTX
# EKhiceX1mC5ocCeEvgNouxkN2Qr/X12m60rNvNl5r+GEqiqx/1fs2yRAl5sIzwPsMMY3p9tGOpy0
# 5p7sRQ==

# The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
# then copy-and-paste the Base64 signature into the form and decode..

# The signature can be verified against the original data like this:
set success [CkCrypt2_VerifySbENC $crypt $sb $pkcs7sig]
puts "Signature verified: $success"

delete_CkCrypt2 $crypt
delete_CkPfx $pfx
delete_CkCert $cert
delete_CkStringBuilder $sb