General guidance for asymetric RSA 2048 signing/verifying

[1bonp]

Greetings everyone,
I'm trying to setup a signserver worker in order to sign some data using asymetric RSA 2048 key pair. I would greatly appreciate any direction of what i would need to setup.

This is what i'm trying to reproduce using manually generated keys:

File example:
$ echo "123" > testfile

Generate keys manually:
Private key:
openssl genrsa 2048 > keys_manual/private.pem
private.pem:
-----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAoj2C/ZpI7H0CUx9AsDr7nDUWEEcKdyfdLNuq29jG4zSgDOdu 60Cr5W48n/kYfkZ46RylCZ+TFAz79twrrXc7tTuXerthWVLx98oT3rHHCJbrwqhk njnDXvHGJWXxVzK1KzddUbkwgmaReUPF8ucqWmeQHmRCCGCy/EQvFQPyykBko8nf ZDjs+ZrNS5momJL3roZJyhWZUfjbCU00Bb31kFYAPP+eBMXYJ2IY7lbN7nGEBOp+ wTe/boPO9WrJ/WRCKV7LVki92fXWS6UD3Tnl48LFow3EF1L5bvbyc4bFWew+rKu4 Qv0k0a/QCXB93CeP6VphunJaHQ+p4dyJOVy+twIDAQABAoIBAQCbipt95R/K0mKb LFhJXJMDBIYdnu4ypJ5QNl2NHjw3camMFYlqs3rZoCExQZAw6AFdhB/ZpQpN69DY r+aUDL7KltI4UVMYXwQqCquYEhp+aqqm2eh1JW3gJa1RB3YkojG8t/yYsBIIwqrv doFdyi/5slYiPP5tp7+RSRFWdY2cRi8weZDdVZiqXRoOmtTzZHHHoeOY2CUfPaue Mr5NGh2hSt6BJW5YFRfMC1vh+JvhLIpHlFuKHJtlPA+pSPJ6om54WI9sUQFa9IX3 QmxEKclyPFZccUGM6B00TZ8HoPEciTl4X74Cv+oKmHRPqakzBZHIm/M0dHVLMbK5 apBCtDwxAoGBAMwa32p+t8DRJrS0D7hxrJDHspKmfSIXNDDfOu7CzswYM5NUnfte hLVL0kWu9MS+7KkPwhet9taRm4XF0sR+c4QDEkbu5dzfjV2UCD5CMu6aMCqoZctI LQFKE1ochs14TVyfrcVv20qkVNqSTXEEBj8XL3JyrcyIIVVwEk79JqFZAoGBAMt9 rfl6hUaC9JwZZB8Bw50k5eo2h8wjkb4/aWZoUtC26DTzFtfgJnL+Kk2Y2Nvd4Mjd 4dM0Uiqzv/D+X1GWX22XTpNi0Sux79USstY6EWbzbqA1Hx/USZuaqCboK/DE/xeh i2caR7RZIP4P2sES0riNCsrWSdH9F/ZvVPeJK86PAoGAA65gZS1P5xxelFfDCNKU CDBx2g9CpoDAojkEeRXuYOP22itmhggYYKSzcCpNo9bFse7k00SB9TC/G1SMDpsx PipIBBt+7dLiW9O1qlnLTV5ejAZpf5cXqLRLUQ6+p6oJyyfeHHd9/wSjuyV0XBt0 eWLTqj7DP7Mc1sukqOQL9FECgYBWxlppF6k7v15mLqG2Yz8yhOiSbvyLveNJmKru o7AlFsqAweTM2+YphV8uxe48HCreHVhOg3JCiXJhZ2foV9KL3kkAqtP96RwX5ahj mFGRcF+Na/nAzfsxosrwBHOwcaFCR3410kwfiR57mPE1AjzfvC2M/8JtDJuqWCGI iXMn2wKBgFlIAtzlrZr2vAIIXeVoCKNzGrMQSI9pv6xWdCWnKWNi/y7ZFpdXmKYk W3Jn9DBJPvXWAumESs7uYDrVEbHReh+OgqCv8ykgvXKXrNpg1mljycLHtRvR1h/F qPfDedDxfNKfVEBOcdBM42ASpzd1k4wh1lDUFMcPpGj1ApwV3Xlq -----END RSA PRIVATE KEY-----

Public key:
openssl rsa -in keys_manual/private.pem -out keys_manual/public.pem -pubout -outform PEM
public.pem:
-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoj2C/ZpI7H0CUx9AsDr7 nDUWEEcKdyfdLNuq29jG4zSgDOdu60Cr5W48n/kYfkZ46RylCZ+TFAz79twrrXc7 tTuXerthWVLx98oT3rHHCJbrwqhknjnDXvHGJWXxVzK1KzddUbkwgmaReUPF8ucq WmeQHmRCCGCy/EQvFQPyykBko8nfZDjs+ZrNS5momJL3roZJyhWZUfjbCU00Bb31 kFYAPP+eBMXYJ2IY7lbN7nGEBOp+wTe/boPO9WrJ/WRCKV7LVki92fXWS6UD3Tnl 48LFow3EF1L5bvbyc4bFWew+rKu4Qv0k0a/QCXB93CeP6VphunJaHQ+p4dyJOVy+ twIDAQAB -----END PUBLIC KEY-----

Sign using manual generated keys:

sha256sum testfile | awk '{print $1}' > testfile.sig
tesfile.sig:
181210f8f9c779c26da1d9b2075bde0127302ee0e3fca38c9a83f5b1dd8e5d3b

openssl dgst -sign keys_manual/private.pem -keyform PEM -sha256 -out testfile.bin testfile

echo "rsa2048: $(xxd -c 4096 -p < testfile.bin)" >> testfile.sig

Output:
testfile.sig:
181210f8f9c779c26da1d9b2075bde0127302ee0e3fca38c9a83f5b1dd8e5d3b rsa2048: 973c3260491428b9e43459efa2c023412f0b0fa831cf307cb3d738ec748d8a2598575c5b8824ccb2555fc125fdea4e264677ad1c0c2017abfa8a50b06abc35ce28fa2359dcf60171e538dcbdab4c9cd856b201e05d9699327017448c58a9bb136334cfc073494eb44c54450a0f09fd9211e99ba6e28d2f2b8d578454e0bd460ffe7f0e770f9b807a8ecccc96d8ba7eb08de7bdcd7beed1c1574b9f5b16ece6458e2a62cc3d63bad7d9ef4d91c35644e102bd2668870bc995a470528ab7c01677ea9243f16b8a9713698972257bef4fcf67e2ee340feb93efbd2fc5a80886269d78142bd8670c1d079fbe7c9a58fdc6aaf44dd5d18c593dbe645af1f2000ecd6a

this .sig file format is sha256 + hex format RSA bit PKCS#1 1.5 signature. The key lengh must be 2048 bits.

**Verify file using public key: **

sig_hex="$(grep rsa2048 testfile.sig | cut -f 2 -d ' ')"
echo ${sig_hex} | xxd -c 4096 -p -r > "verify_testfile.bin"
openssl dgst -verify "keys_manual/public.pem" -signature "verify_testfile.bin" testfile

Output:
Verified OK

Question

So i'm trying to figure out the correct way to setup a worker to replicate the
openssl dgst -sign keys_manual/private.pem -keyform PEM -sha256 -out testfile.bin testfile
command.
and
verifiy the binary using public key extracted from installed Certificate of worker.

So far, i'm able to setup:
-CryptokenP12, create a new RSA 2048 key
-worker, generate the CSR, sign the CSR by CA (manually created CA keys), extract the public key i will use to verify by using this command:
openssl x509 -pubkey -noout -in cert.pem > pubkey_test.pem

i tried several configurations but no success so far. (Tried Plain Signature Worker and CMSSigner).

Could someone point me to a direction about what do I need to setup as type of worker and Configuration options with an example of request command in order to achieve the equivalent of
openssl dgst -verify "keys_manual/public.pem" -signature "verify_testfile.bin" testfile
Command

Any help would be greatly appreciated.
Thank you very much

[netmackan]

Hi 1bonp,

Without looking into the exact details yet here are some pointers:

• The signer to use that corresponds to "openssl dgst -sign" is the PlainSigner
• The Code Signing Guide has a chapter about signing and verifying plain signatures that you can have a look at but it looks like it should work they way you are doing: https://doc.primekey.com/signserver/tutorials-and-guides/code-signing-how-to-guides/code-signing-technical-how-to/code-signing/code-signing-with-plain-signatures

[1bonp]

Hi netmackan,
Thank you for your fast response.

I've managed to finnally get a PlainSigner Worker that works.
I'm able to send a file, get it signed and verify it against the public key :)

However, i have a little problem :
I'm able to send a .txt file (or whatever file with text content) and sign it.

But how to do the same with a .img (for example)?
I get the following error:

Error 500
Upload failed

The file is 47.2 MB , is it because of its size? What can I do to upload the file to the signserver?
Thank you again

My Signserver is configured with
SIGNATUREALGORITHM=SHA256withRSA

and my request:
/usr/bin/curl -k --form workerName=PlainSigner --form [email protected] https://localhost/signserver/process > tmp_sig

<div class="clearBoth"></div> </div> <div> <div id="content" class="full_content"> <h1>Error 500 </h1> <p>Upload failed </p>

Is there a conversion i need to do with .img file in order to send it ? Or is it too large ?
Thank you again

[netmackan]

Great that you got it working.

May I ask you to mark this thread as answered and then open a new thread with the other question, that way it will be easier for others looking for answers to similar questions to find them in the future.

Cheers,