CODEWITHSUNDEEP
ccryptographyelliptic-curvechallenge-responsewolfssl
Mayank Vijh
Mayank Vijh

Reputation: 21

How to verify ECC Signature from wolfSSL with OpenSSL

I am new to Elliptic Curve Cryptography, openSSL and wolfSSL. My context is that I generate KeyPair from command line with openssl and import the private key to my code. Then I use wolfSSL to generate signature and output it.

I save the output in DER format and try to verify with openSSL, the verification fails.

If I Sign and Verify inside my code with wolfSSL, it verifies successfully and also it's successful if I sign and verify in command line with openSSL.

Is there an encoding issue, which I am not sure about?

Update Code

// ECC public key
const uint8_t pubKey[] ={Hex Format key};
// ECC Signature from wolfSSL
char* sigString = {Signature from wolfSSL returned as char};
/* TYPE CONVERTIONS*/
const uint8_t *der_bytes_copy;
const uint8_t *pub_bytes_copy;
der_bytes_copy = (const unsigned char*)sigString;
pub_bytes_copy = pubKey;


EC_KEY *ECpubkey;
size_t keySize = sizeof(pubKey);
int eccgrp;
eccgrp = OBJ_txt2nid("secp256r1");
 ECpubkey = EC_KEY_new_by_curve_name(eccgrp);
o2i_ECPublicKey(&ECpubkey, &pub_bytes_copy, keySize);
ECDSA_SIG *signature;
signature = d2i_ECDSA_SIG(NULL, &der_bytes_copy, signedSize);
uint8_t digest[36];
int verified;
const char message[] = "Test for Authenticate Kernel with ECC";
SHA256_CTX ctx;
SHA256_Init(&ctx);
SHA256_Update(&ctx, (const uint8_t*)message,sizeof(message));
SHA256_Final(digest, &ctx);
verified = ECDSA_do_verify(digest, sizeof(digest), signature, ECpubkey);

The private key is used with wolfSSL to sign the message and then the public key with openssl to verify, but this stops abruptly.

Upvotes: 2

Views: 1595

Answers (1)

Kaleb
Kaleb

Reputation: 611

In the past when working with openSSL and comparing sign values to wolfSSL I have found that OpenSSL does the following steps when signing:

  1. Read in and decode the key
  2. compute a hash
  3. Signature Encode the hash
  4. sign the encoded hash
  5. Base64 Encode the signature

OpenSSL does not make this apparent or user-friendly so unfortunately it's something you have to discover as you have.

Please use the following steps in wolfSSL to achieve your desired output:

1 Create or import your ECC key
2 Compute the sha hash on the input as you did previously
3 Encode the hash with this API call: encodedSz = wc_EncodeSignature(encodedOutput, hashInput, SHA256_DIGEST_SIZE, SHA256h);
4 Sign the encoded hash
5 Now do the verify

Let us know if that works for you.

Upvotes: 1

Related Questions