CODEWITHSUNDEEP
c++opensslrsa
raidensan
raidensan

Reputation: 1139

Verifying message signature produce HEADER TOO LONG error

Background

I am trying to verify signature of a given binary file using openssl. Actual signing of binary hash is done by a 3rd party. Both 3rd party and I have the same exact certificate - they sent me the certificate.

I have verified health of my certificate by running openssl x509 -noout -text -inform DER -in CERT_PATH. This displays contents of cert correctly.

Following is my code so far - I based it on openssl wiki example here:

static std::vector<char> ReadAllBytes(char const* filename){
    std::ifstream ifs(filename, std::ios::binary|std::ios::ate);
    std::ifstream::pos_type pos = ifs.tellg();

    std::vector<char>  result(pos);

    ifs.seekg(0, std::ios::beg);
    ifs.read(result.data(), pos);

    return result;
}

int main(int ac, const char * av[]) {

    OpenSSL_add_all_algorithms();
    ERR_load_crypto_strings();

    // most of error check omitted for brevity

    auto foundBinBytes = ReadAllBytes("BINARY_PATH");

    auto foundSgnBytes = ReadAllBytes("SIGNATURE_PATH");

    auto foundCertBytes = ReadAllBytes("CERT_PATH");

    ERR_clear_error();
    BIO *b = NULL;
    X509 *c;
    b = BIO_new_mem_buf(reinterpret_cast<const unsigned char *>(foundCertBytes.data()), foundCertBytes.size());

    c = d2i_X509_bio(b, NULL);
    EVP_MD_CTX* ctx = NULL;
    ctx = EVP_MD_CTX_create();

    const EVP_MD* md = EVP_get_digestbyname("SHA256");

    int rc = EVP_DigestInit_ex(ctx, md, NULL);

    EVP_PKEY *k = NULL;
    k = X509_get_pubkey(c);

    rc = EVP_DigestVerifyInit(ctx, NULL, md, NULL, k);

    rc = EVP_DigestVerifyUpdate(ctx, reinterpret_cast<const unsigned char *>(foundBinBytes.data()), foundBinBytes.size());

    ERR_clear_error();
    rc = EVP_DigestVerifyFinal(ctx, reinterpret_cast<const unsigned char *>(foundSgnBytes.data()), foundSgnBytes.size());

    ERR_print_errors_fp( stdout );
    // openssl free functions omitted
    if(ctx) {
        EVP_MD_CTX_destroy(ctx);
        ctx = NULL;
    }

    return 0;
}

Issue

Running this code produces following errors:

4511950444:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:/.../crypto/asn1/asn1_lib.c:152:
4511950444:error:0D068066:asn1 encoding routines:ASN1_CHECK_TLEN:bad object header:/.../crypto/asn1/tasn_dec.c:1152:
4511950444:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:/.../crypto/asn1/tasn_dec.c:314:Type=X509_SIG

Question

What is wrong with my setup/code? Did I miss something along the way?

Upvotes: 1

Views: 7447

Answers (3)

explorer
explorer

Reputation: 769

you need to convert your signature to DER format since OpenSSL expects an ASN.1 DER sequence for ES256/ES384 signatures. Super nice explanation in ASN1 encoding routines errors when verifying ECDSA signature type with openssl

Upvotes: 0

Overnuts
Overnuts

Reputation: 803

If you get these errors in a mosquitto secured server's log, check the config file.

My mosquitto.conf was containing :

require_certificate true

my meross device doesn't send certificate. Turning this to "false" solved my problem after restart

Upvotes: 0

user803422
user803422

Reputation: 2814

You never check the errors when reading the files. You might have errors there (does the file "CERT_PATH" exist? Do you have read permissions? ...).

If "CERT_PATH" cannot be read, then foundCertBytes.data() is an empty byte array, and this explains the subsequent errors.

Upvotes: 1

Related Questions