Problem verifying a X509Certificate's signature

• Previous message: Eugene Mayevski: "Creating an object (event, mutex) with "everybody allowed" security permissions"
• Next in thread: Sebastien Pouliot: "Re: Problem verifying a X509Certificate's signature"
• Reply: Sebastien Pouliot: "Re: Problem verifying a X509Certificate's signature"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: 16 Sep 2004 16:54:32 -0700

Hello all,
I'm implementing a class that extends the .NET 1.1 framework
X509Certificate class. The purpose is to end up with a class that has
the (inhereted) functionalities of the X509Certificate class plus some
more.
One of the methods I am implementing is the Verify method.

Let's call my class, the X509CertificateEnhanced class. The Verify
method is declared as such:

bool Verify(byte[] publicKey)

This method will verify if a given X509Certificate (in this case, a
X509CertificateEnhanced) is signed by the public key (of another
certificate) passed as a parameter.

To help implementing this method (and others) I use the BouncyCastle
C# Port (a lightweight version of the Java BouncyCastle API,
www.bouncycastle.org/csharp/) and the X509KeyParser (found on the
Internet, I'll post the link where I found it as soon as I get to my
computer at work).

I use the .NET VerifyHash method, of the class
RSACryptoServiceProvider, to verify if the certificate's hash
validates with its signature, given the other certificate's public
key.

public bool VerifyHash(byte[] rgbHash, string str, byte[]
rgbSignature)

I'm trying to do this validation this way:
- Initialize the RSACryptoServiceProvider class with the the
RSAParameters (returned by a static method of the class X509KeyParser,
that accepts a public key byte[], which in turn was got using the
method X509Certificate.GetPublicKey) that correspond to the other
certificate's public key.
- Use the method X509Certificate.GetCertHash to get the X509
certificate's hash that will be passed as the parameter "rgbHash".
- The "str" parameter will be the return value of
CryptoConfig.MapNameToOID("SHA1").
- Use the method (from the BouncyCastle API)
X509CertificateStructure.GetSignature().GetBytes() to get the X509
certificate's signature, to be used in the "rgbSignature" parameter.

The problem is that I am getting a "false" return result when I do all
this with the public key of a certificate that did sign the other
certificate that I am verifying.
I am using the public key of the certificate that is in the upper
position (in the chain with the 2 certificates) and the hash and
signature of the certificate in the lower position.

I'm almost sure that I have the correct RSAParameters (public key) to
initialize the RSACryptoServiceProvider as I got the same
RSAParameters using the Web Service Enhancements 2.0
X509Certificate.PublicKey property (which returns an instance of a
RSACryptoServiceProvider class, already initialized with the puclic
key of that certificate), so the problem would either be in the hash
or in the signature.

On one hand, I'm not that sure that the X509Certificate.GetCertHash
method returns the hash of the X509 certificate part that was used to
generate its signature.
On the other hand, I'm not also 100% sure that the method
X509CertificateStructure.GetSignature().GetBytes() (documentation in
http://www.bouncycastle.org/docs/docs1.4/index.html) returns the
certificate's signature the way that it is needed in the VerifyHash
method.

p.s.:(don't mind that the BouncyCastle API is in javadoc, the API is
the same as the Java one but with fewer classes. ex: there is no
X509CertificateObject in the C# version, that's why I have to use The
X509CertificateStructure class)

Any help will be glad,
  thanks in advance

    Ricardo Pereira

• Previous message: Eugene Mayevski: "Creating an object (event, mutex) with "everybody allowed" security permissions"
• Next in thread: Sebastien Pouliot: "Re: Problem verifying a X509Certificate's signature"
• Reply: Sebastien Pouliot: "Re: Problem verifying a X509Certificate's signature"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]