Skip to content

provider hash-then-sign support - #536

Open
GauriSpears wants to merge 1 commit into
gost-engine:masterfrom
GauriSpears:master
Open

GauriSpears wants to merge 1 commit into
gost-engine:masterfrom
GauriSpears:master

Conversation

@GauriSpears

Copy link
Copy Markdown

raw SIGN/VERIFY (hash-then-sign) support

Problem

Node.js createSign('md_gost12_256').update(...).sign(key) ends in OpenSSL as:

  1. hash message → digest bytes
  2. EVP_PKEY_sign_init
  3. EVP_PKEY_CTX_set_signature_md(md)
  4. EVP_PKEY_sign(digest)

That requires the provider to export OSSL_FUNC_SIGNATURE_SIGN_INIT / SIGN (and verify counterparts) plus SET_CTX_PARAMS for the digest.

gost_prov_signature.c only registered DIGEST_SIGN / DIGEST_VERIFY.
Result: ERR_OSSL_EVP_PROVIDER_SIGNATURE_NOT_SUPPORTED (provider signature not supported).

crypto.sign('md_gost12_256', data, key) uses DigestSign and workes.

So in Node.JS:

const fs = require('fs');
const crypto = require('crypto');
const privateKey = fs.readFileSync('../key.pem');
const publicKey = fs.readFileSync('../cer.cer');

//it works:
const SignatureValue = crypto.sign('md_gost12_256', 'this is test string', privateKey);

//it fails:
const sign = crypto.createSign('md_gost12_256');
sign.update('this is test string');
const SignatureValue2 = sign.sign(privateKey,'base64');

//it works:
crypto.verify('md_gost12_256', 'this is test string', publicKey, SignatureValue);

//it fails:
const verify = crypto.createVerify('md_gost12_256');
verify.update('this is test string');
verify.verify(publicKey, SignatureValue , 'base64');

Fix

In gost_prov_signature.c:

  • Implement signature_sign_init / signature_sign / signature_verify_init / signature_verify calling existing internal_pkey_ec_cp_sign / verify.
  • Register them in id_signature_functions.
  • Export SET_CTX_PARAMS / SETTABLE_CTX_PARAMS (handler already existed).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant