Re: CPSignHash error 80090008

From: lelteto (lelteto_at_discussions.microsoft.com)
Date: 12/22/04

  • Next message: Zachovich: "Re: database password and encryption" 
    Date: Wed, 22 Dec 2004 14:19:03 -0800

    I don't think the RSA FULL provider will understand / allow CALG_SSL3_SHAMD5
    as the hash algo. That's why I assumed Ian needs the RSA SSL provider
    downstream.

    Laszlo Elteto
    SafeNet, Inc.

    "Doug Barlow" wrote:

    > One thing I noticed in your earlier code examples was that in your
    > CPAcquireContext routine, you didn't pass the pszContainer parameter to the
    > CryptAcquireContext call -- you substituted NULL. This means the keys you
    > are using are coming from the default container instead of the container
    > named by the certificate information. This could explain the confusion over
    > which keyset is to be used, and the signature validation errors.
    >
    > Lazlo's earlier excellent information on using the PROV_RSA_SCHANNEL
    > provider type really only applies to web servers; since it now looks like
    > you're trying to do client-side authentication, the PROV_RSA_FULL provider
    > type is fine.
    >
    > Doug Barlow
    > The Soft Pedal Shop
    > CSP Design & Development Consulting
    > http://www.SoftPedal.net
    >
    > --
    > "iandoll" <iandoll@yahoo.com> wrote in message
    > news:1103742538.944353.151990@z14g2000cwz.googlegroups.com...
    > > Thanks Doug,
    > >
    > > I have used AT_SIGNATURE (2), but when I put AT_KEYEXCHANGE (1) then
    > > there is NO
    > > Error!
    > > What should I use in case of client authentication?
    > >
    > > And on the first look everything working fine, except that I got
    > > "page cannot be displayed"
    > > So, I didn't get to https site :) Following functions are called (in
    > > this order), and every call seems to be ok.
    > >
    > > - CPAcquireContext
    > > - CPCreateHash (ALG_ID=0x00008008)
    > > - CPSetHashParam (dwParam=0x2)
    > > - CPSignHash (dwKeySpec=0x1 <-- AT_KEYEXCHANGE) returns 128 as size
    > > - CPSignHash (dwKeySpec=0x1 <-- AT_KEYEXCHANGE, *pcbSigLen=128)
    > > pbSignature has some value
    > > - CPDestroyHash
    > > - CPReleaseContext
    > >
    > > After that I get "The page cannot be displayed" in IE. When I try with
    > > same cert,
    > > but using default CSP, then everything working fine.
    > >
    > > Here is code how I tell certificate to use my CSP, maybe is problem in
    > > it:
    > >
    > > pCertContext = ... load CERT ...
    > >
    > > CRYPT_KEY_PROV_INFO keyProv;
    > > memset(&keyProv, 0, sizeof(CRYPT_KEY_PROV_INFO));
    > >
    > > keyProv.pwszProvName = L"MyCSP Provider";
    > > keyProv.dwProvType = PROV_RSA_SCHANNEL;
    > > //keyProv.dwKeySpec = AT_SIGNATURE;
    > > keyProv.dwKeySpec = AT_KEYEXCHANGE;
    > >
    > > if (!CertSetCertificateContextProperty(
    > > pCertContext,
    > > CERT_KEY_PROV_INFO_PROP_ID,
    > > CERT_STORE_NO_CRYPT_RELEASE_FLAG, //CERT_STORE_NO_CRYPT_RELEASE_FLAG
    > > &keyProv)) {
    > > printf("ERROR:CertSetCertificateContextProperty:[%x]\n",GetLastError());
    > > }
    > >
    > > Now, when I go to desired HTTPS, windows loads my client certificate
    > > (for this site) and invoke MyCSP.
    > >
    > > Is this everythnig what I need to do, or something else should be done?
    > > Thanks,
    > > Ian
    > >
    >
    >
    >

  • Next message: Zachovich: "Re: database password and encryption"

    Relevant Pages

    • RE: write your own CSP basic question
      ... on the specified provider Microsoft's CAPI ... layer routes the call to the appropriate CSP's CP... ... In that case your CSP can ... operations - everything else (eg. hashing and symmetric crypto) you probably ...
      (microsoft.public.platformsdk.security)
    • Custom CSP in Office 2003?
      ... I've developed a custom CSP. ... However, in Office 2003, I found my CSP ... Provider type is PROV_RSA_SIG. ... Here's how I register the certificate into system cert store: ...
      (microsoft.public.platformsdk.security)
    • Debug self written CSP
      ... I now make a certificate request ... from my WinXP machine to a 2003 Server (by selecting "My Cryptographic ... Provider" in the webform). ... The requesting procedure runns until my CSP has to return its name. ...
      (microsoft.public.platformsdk.security)
    • Re: Which is the strongest encryption?
      ... There is no benefit inherent in using any particular CSP (Cryptographic Service Provider); what matters is the facilities that they offer, and the way in which they are used. ... With earlier versions you only have RC4 but with 128-bit keys you should be reasonably safe unless you're involved in international espionage ...
      (microsoft.public.word.docmanagement)
    • Using more powerful hash function with CAPI
      ... attacks on hash algorithms, it's becoming all the more desirable for MS ... either generate or verify a signature using a hash algorithm that is not ... implemented in a CSP presents on the machine? ... Will a future update change that provider to the final ...
      (microsoft.public.platformsdk.security)