Nabble - Cryptlib

Re: Public Key Context

2009-11-12T03:08:31Z

I found a post from 2005 where someone tried something similiar. My problem is still that I can't add the private key that I added with

int privkeycontext = crypt.GetPrivateKey(keyset, crypt.KEYID_NAME, "Private Key", "password");
crypt.SetAttribute(envelope, crypt.ENVINFO_PRIVATEKEY, privkeycontext);

the post:
http://old.nabble.com/Can%27t-decrypt-with-private-key-td405683.html#a405683

I don't really get it, the context is the public key also? I thought my self-signed certificate is the public key?

Best Regards,

Benjamin

Re: Public Key Context

2009-11-11T06:10:57Z

Hi Peter,

I keep writing so I'm glad if you could help me this time. I wrote this code to test if I can use the certificate instead of the pubkeycontext because I don't know how to get it and in the end I also have to write a CA for Fraunhofer. Following is the code where I try to set the certificate as private key. Why does that not work? I have a similar problem when I want to decrypt with setting the private key. In the following are both functions.

greetings from Germany.

Benjamin

private static byte[] encrypt(String message)
{
byte[] envelopedData = new byte[100];
int bytescopied;

int cryptContext = crypt.CreateContext(crypt.UNUSED, crypt.ALGO_RSA);
crypt.SetAttributeString(cryptContext, crypt.CTXINFO_LABEL, "Private Key");

int keyset = crypt.KeysetOpen(crypt.UNUSED, crypt.KEYSET_FILE, "C:\\tee.p15", crypt.KEYOPT_CREATE);

crypt.GenerateKey(cryptContext);

//key stuff
int cryptcertificate = crypt.CreateCert(crypt.UNUSED, crypt.CERTTYPE_CERTIFICATE);
crypt.SetAttribute(cryptcertificate, crypt.CERTINFO_SUBJECTPUBLICKEYINFO, cryptContext);
crypt.SetAttributeString(cryptcertificate, crypt.CERTINFO_COMMONNAME, "Susanne");
crypt.SetAttributeString(cryptcertificate, crypt.CERTINFO_COUNTRYNAME, "DE");
crypt.SetAttributeString(cryptcertificate, crypt.CERTINFO_ORGANIZATIONNAME, "FHG");
crypt.SetAttributeString(cryptcertificate, crypt.CERTINFO_ORGANISATIONALUNITNAME, "IAT");

crypt.SetAttribute(cryptcertificate, crypt.CERTINFO_SELFSIGNED, 1);
crypt.SetAttribute(cryptcertificate, crypt.CERTINFO_CA, 1);

crypt.AddPrivateKey(keyset, cryptContext, "password");
crypt.SignCert(cryptcertificate, cryptContext);
crypt.AddPublicKey(keyset, cryptcertificate);

int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_PUBLICKEY, cryptcertificate);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);

bytescopied = crypt.PopData(cryptEnvelope, envelopedData, envelopedData.Length);

crypt.DestroyEnvelope(cryptEnvelope);
crypt.KeysetClose(keyset);
crypt.DestroyCert(cryptcertificate);
crypt.DestroyContext(cryptContext);

return envelopedData;
}

private static String decrypt(byte[] decmessage)
{
int bytescopied;

int keyset = crypt.KeysetOpen(crypt.UNUSED, crypt.KEYSET_FILE, "C:\\tee.p15", crypt.KEYOPT_READONLY);
int privkey = crypt.GetPrivateKey(keyset, crypt.KEYID_NAME, "Private Key", "password");
byte[] messagebuffer = new Byte[decmessage.Length];

int envelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_AUTO);
// crypt.SetAttribute(envelope, crypt.ENVINFO_KEYSET_DECRYPT, keyset );
bytescopied = crypt.PushData(envelope, decmessage);
crypt.FlushData(envelope);
bytescopied = crypt.PopData(envelope, messagebuffer, messagebuffer.Length);
crypt.DestroyEnvelope(envelope);

return System.Text.Encoding.UTF8.GetString(messagebuffer);
}

I also tried the cryptcontext but that does not work.

int cryptContext = crypt.CreateContext(crypt.UNUSED, crypt.ALGO_RSA);
crypt.SetAttributeString(cryptContext, crypt.CTXINFO_LABEL, "Private Key");
// crypt.GenerateKey(cryptContext);

//key stuff
int keyset = crypt.KeysetOpen(crypt.UNUSED, crypt.KEYSET_FILE, "C:\\te.p15", crypt.KEYOPT_CREATE);
crypt.AddPrivateKey(keyset, cryptContext, "password");
crypt.SetAttribute(cryptcertificate, crypt.CERTINFO_SUBJECTPUBLICKEYINFO, cryptContext);

any suggestions?

Best Regards,

Benjamin

BenjaminF wrote:

same thing here. how do I generate this public key context?

Scott Neugroschl wrote:

OK, I'm probably a total idiot, but I'm can't figure this out.

In several places, the manual refers to a public-key context, but I
can't really find how to create said context when generating a key.

If I'm generating a key, and want to save the public key in a certificate,
is the public-key context merely the CRYPT_CONTEXT used to generate the key?

e.g.:

CRYPT_CONTEXT context;

cryptCreateContext(&context, CRYPT_UNUSED, CRYPT_ALGO_RSA);
cryptSetAttributeString(context, CRYPT_CTX_INFO_LABEL,
"MY-KEY",6);
cryptGenerateKey(context);

At this point, is the variable "context" the public-key context?

_______________________________________________
Cryptlib mailing list
Cryptlib@mbsks.franken.deAdministration via Mail: cryptlib-request@mbsks.franken.de
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Public Key Context

2009-11-09T01:39:41Z

I also tried the cryptcontext but that does not work.

int cryptContext = crypt.CreateContext(crypt.UNUSED, crypt.ALGO_RSA);
crypt.SetAttributeString(cryptContext, crypt.CTXINFO_LABEL, "Private Key");
// crypt.GenerateKey(cryptContext);

//key stuff
int keyset = crypt.KeysetOpen(crypt.UNUSED, crypt.KEYSET_FILE, "C:\\te.p15", crypt.KEYOPT_CREATE);
crypt.AddPrivateKey(keyset, cryptContext, "password");
crypt.SetAttribute(cryptcertificate, crypt.CERTINFO_SUBJECTPUBLICKEYINFO, cryptContext);

any suggestions?

Best Regards,

Benjamin

same thing here. how do I generate this public key context?

Scott Neugroschl wrote:

OK, I'm probably a total idiot, but I'm can't figure this out.

In several places, the manual refers to a public-key context, but I
can't really find how to create said context when generating a key.

If I'm generating a key, and want to save the public key in a certificate,
is the public-key context merely the CRYPT_CONTEXT used to generate the key?

e.g.:

CRYPT_CONTEXT context;

cryptCreateContext(&context, CRYPT_UNUSED, CRYPT_ALGO_RSA);
cryptSetAttributeString(context, CRYPT_CTX_INFO_LABEL,
"MY-KEY",6);
cryptGenerateKey(context);

At this point, is the variable "context" the public-key context?

_______________________________________________
Cryptlib mailing list
Cryptlib@mbsks.franken.deAdministration via Mail: cryptlib-request@mbsks.franken.de
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Public Key Context

2009-11-09T01:02:46Z

same thing here. how do I generate this public key context?

Scott Neugroschl wrote:

OK, I'm probably a total idiot, but I'm can't figure this out.

In several places, the manual refers to a public-key context, but I
can't really find how to create said context when generating a key.

If I'm generating a key, and want to save the public key in a certificate,
is the public-key context merely the CRYPT_CONTEXT used to generate the key?

e.g.:

CRYPT_CONTEXT context;

cryptCreateContext(&context, CRYPT_UNUSED, CRYPT_ALGO_RSA);
cryptSetAttributeString(context, CRYPT_CTX_INFO_LABEL,
"MY-KEY",6);
cryptGenerateKey(context);

At this point, is the variable "context" the public-key context?

_______________________________________________
Cryptlib mailing list
Cryptlib@mbsks.franken.deAdministration via Mail: cryptlib-request@mbsks.franken.de
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Simple Question about the Buffers in cryptPopData

2009-11-05T05:56:06Z

ok, figured it out. For those who are interested:

private static String decrypt(byte[] decmessage)
{
int bytescopied;
string label = "Private_Key";

int cryptContext = crypt.CreateContext(crypt.UNUSED, crypt.ALGO_AES);
byte[] messagebuffer = new Byte[decmessage.Length];

int envelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_AUTO);
cryptContext = crypt.CreateContext(crypt.UNUSED, crypt.ALGO_AES);
bytescopied = crypt.PushData(envelope, decmessage);
crypt.SetAttributeString(cryptContext, crypt.CTXINFO_LABEL, label);
crypt.DestroyContext(cryptContext);
crypt.FlushData(envelope);
bytescopied = crypt.PopData(envelope, messagebuffer, messagebuffer.Length);

Console.WriteLine(ByteArrayToString(messagebuffer));

crypt.DestroyEnvelope(envelope);

return System.Text.Encoding.UTF8.GetString(messagebuffer);
}

ok, I think I figured out now that I need two envelopes. One for encryption and one for decryption. But my decryption still doesn't work. I wrote:

string message = "hallo Welt!";
string result ="";

byte[] mes = new byte[message.Length];
try
{

mes = encrypt(message);
}
catch (Exception e) {
Console.WriteLine("######### ENCRYPT: " + e.Message + " ############");
}

try
{
result = decrypt(mes);
}
catch (Exception e) {

Console.WriteLine("######### DECRYPT: " + e.Message + " ############");
}

Console.WriteLine(result);

}
catch (Exception e)
{
Console.WriteLine("test");
Console.WriteLine(e.Message);
}

}

private static byte[] encrypt(String message) {
int bytescopied;
byte[] sd = new Byte[message.Length];

crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
char[] env = new char[bytescopied];
bytescopied = crypt.PopData(cryptEnvelope, sd, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
crypt.End();

return sd;

}

private static String decrypt(byte[] decmessage)
{
int bytescopied;
byte[] x2 = new Byte[decmessage.Length];
crypt.Init();
int envelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_AUTO);
//crypt.SetAttribute(envelope, crypt.ENVINFO_DATASIZE, decmessage.Length + 1);
bytescopied = crypt.PushData(envelope, decmessage,0,decmessage.Length);
crypt.FlushData(envelope);
bytescopied = crypt.PopData(envelope, x2,decmessage.Length,bytescopied);

System.Text.ASCIIEncoding enc = new System.Text.ASCIIEncoding();

Console.WriteLine(Convert.ToBase64String(x2));

Console.WriteLine(enc.GetString(x2));
Console.WriteLine("fertig");
crypt.End();
return enc.GetString(x2);
}

If I run this it always says in the Exception that it is not enough data available. How can that be? What do I do wrong?

Best Regards,

Benjamin

BenjaminF wrote:

I forgot to mention that I develope with C#.

BenjaminF wrote:

Hey Guys,

I got a real dumn question but I can't figure out how it works and the manual is not really helping at that point. I wrote a simple example to see how the system works:

string message = "hallo Welt!";
int bytescopied;
crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
bytescopied = crypt.PopData(cryptEnvelope, envelopedData, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
Console.WriteLine(envelopedData);
Console.WriteLine("fertig");
crypt.End();

The thing is that I have no clue how to initialize the envelopedData. If I initialize it with
byte[] envelopedData = ... then I have to set all dimensions and that stuff. Do I really have to do this? Also how can I get from there my String back? I was looking for Stringbuffers but found nothing.

Could you help me with this? :)

Thanks!

Benjamin

Re: Simple Question about the Buffers in cryptPopData

2009-11-05T01:38:42Z

ok, I think I figured out now that I need two envelopes. One for encryption and one for decryption. But my decryption still doesn't work. I wrote:

string message = "hallo Welt!";
string result ="";

byte[] mes = new byte[message.Length];
try
{

mes = encrypt(message);
}
catch (Exception e) {
Console.WriteLine("######### ENCRYPT: " + e.Message + " ############");
}

try
{
result = decrypt(mes);
}
catch (Exception e) {

Console.WriteLine("######### DECRYPT: " + e.Message + " ############");
}

Console.WriteLine(result);

}
catch (Exception e)
{
Console.WriteLine("test");
Console.WriteLine(e.Message);
}

}

private static byte[] encrypt(String message) {
int bytescopied;
byte[] sd = new Byte[message.Length];

crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
char[] env = new char[bytescopied];
bytescopied = crypt.PopData(cryptEnvelope, sd, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
crypt.End();

return sd;

}

private static String decrypt(byte[] decmessage)
{
int bytescopied;
byte[] x2 = new Byte[decmessage.Length];
crypt.Init();
int envelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_AUTO);
//crypt.SetAttribute(envelope, crypt.ENVINFO_DATASIZE, decmessage.Length + 1);
bytescopied = crypt.PushData(envelope, decmessage,0,decmessage.Length);
crypt.FlushData(envelope);
bytescopied = crypt.PopData(envelope, x2,decmessage.Length,bytescopied);

System.Text.ASCIIEncoding enc = new System.Text.ASCIIEncoding();

Console.WriteLine(Convert.ToBase64String(x2));

Console.WriteLine(enc.GetString(x2));
Console.WriteLine("fertig");
crypt.End();
return enc.GetString(x2);
}

If I run this it always says in the Exception that it is not enough data available. How can that be? What do I do wrong?

Best Regards,

Benjamin

I forgot to mention that I develope with C#.

BenjaminF wrote:

Hey Guys,

I got a real dumn question but I can't figure out how it works and the manual is not really helping at that point. I wrote a simple example to see how the system works:

string message = "hallo Welt!";
int bytescopied;
crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
bytescopied = crypt.PopData(cryptEnvelope, envelopedData, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
Console.WriteLine(envelopedData);
Console.WriteLine("fertig");
crypt.End();

The thing is that I have no clue how to initialize the envelopedData. If I initialize it with
byte[] envelopedData = ... then I have to set all dimensions and that stuff. Do I really have to do this? Also how can I get from there my String back? I was looking for Stringbuffers but found nothing.

Could you help me with this? :)

Thanks!

Benjamin

Re: Simple Question about the Buffers in cryptPopData

2009-11-04T00:12:41Z

I forgot to mention that I develope with C#.

BenjaminF wrote:

Hey Guys,

I got a real dumn question but I can't figure out how it works and the manual is not really helping at that point. I wrote a simple example to see how the system works:

string message = "hallo Welt!";
int bytescopied;
crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
bytescopied = crypt.PopData(cryptEnvelope, envelopedData, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
Console.WriteLine(envelopedData);
Console.WriteLine("fertig");
crypt.End();

The thing is that I have no clue how to initialize the envelopedData. If I initialize it with
byte[] envelopedData = ... then I have to set all dimensions and that stuff. Do I really have to do this? Also how can I get from there my String back? I was looking for Stringbuffers but found nothing.

Could you help me with this? :)

Thanks!

Benjamin

Simple Question about the Buffers in cryptPopData

2009-11-03T06:04:10Z

Hey Guys,

I got a real dumn question but I can't figure out how it works and the manual is not really helping at that point. I wrote a simple example to see how the system works:

string message = "hallo Welt!";
int bytescopied;
crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
bytescopied = crypt.PopData(cryptEnvelope, envelopedData, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
Console.WriteLine(envelopedData);
Console.WriteLine("fertig");
crypt.End();

The thing is that I have no clue how to initialize the envelopedData. If I initialize it with
byte[] envelopedData = ... then I have to set all dimensions and that stuff. Do I really have to do this? Also how can I get from there my String back? I was looking for Stringbuffers but found nothing.

Could you help me with this? :)

Thanks!

Benjamin

Simple Question about the Buffers in cryptPopData

2009-11-03T06:03:45Z

Simple Question about the Buffers in cryptPopData

2009-11-03T06:02:21Z

Simple Question about the Buffers in cryptPopData

2009-11-03T05:57:50Z

Hey Guys,

I got a real dumn question but I can't figure out how it works and the manual is not really helping at that point. I wrote a simple example in C# to see how the system works:

string message = "hallo Welt!";
int bytescopied;
crypt.Init();
int cryptEnvelope = crypt.CreateEnvelope(crypt.UNUSED, crypt.FORMAT_CRYPTLIB);
crypt.SetAttribute(cryptEnvelope, crypt.ENVINFO_DATASIZE, message.Length);
bytescopied = crypt.PushData(cryptEnvelope, message);
crypt.FlushData(cryptEnvelope);
bytescopied = crypt.PopData(cryptEnvelope, envelopedData, message.Length);

crypt.DestroyEnvelope(cryptEnvelope);
Console.WriteLine(envelopedData);
Console.WriteLine("fertig");
crypt.End();

The thing is that I have no clue how to initialize the envelopedData. If I initialize it with
byte[] envelopedData = ... then I have to set all dimensions and that stuff. Do I really have to do this? Also how can I get from there my String back? I was looking for Stringbuffers but found nothing.

Could you help me with this? :)

Thanks!

Benjamin

Re: storing a certificate chain in a key store

2009-10-22T03:48:43Z

Abhijit Menon-Sen <ams@...> writes:

>I have three certificates in bundle.crt and one in server.crt; both are in
>text format, i.e. base64 wrapped in BEGIN CERTIFICATE/END CERTIFICATE lines.
>I put all four certificates into all.crt, read the file contents, and call
>cryptImportCert(). The result has a CRYPT_CERTINFO_CERTTYPE of
>CRYPT_CERTFORMAT_CERTIFICATE, not CRYPT_CERTFORMAT_CERTCHAIN.

If you put four separate encoded certificates into a single file in base64
format that you've got four distinct certs, not a certificate chain. cryptlib
reads the first cert and then imports it, giving you a
CRYPT_CERTFORMAT_CERTIFICATE.

>Do I need to export the chain in some other format? (PKCS #7?) I tried
>"openssl crl2pkcs7 -nocrl -certfile bundle.crt -certfile server.crt -out
>all.p7" and using all.p7 in place of all.crt, but then cryptImportCert()
>fails with CRYPT_ERROR_BADDATA.

You need to export it as a PKCS #7 certificate chain. What does dumpasn1 tell
you about the chain?

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: storing a certificate chain in a key store

2009-10-21T02:25:18Z

At 2009-10-17 17:21:34 +1300, pgut001@... wrote:
>
> With a standard cryptImportCert()

That's what I thought, but I must be doing something wrong.

I have three certificates in bundle.crt and one in server.crt; both are
in text format, i.e. base64 wrapped in BEGIN CERTIFICATE/END CERTIFICATE
lines. I put all four certificates into all.crt, read the file contents,
and call cryptImportCert(). The result has a CRYPT_CERTINFO_CERTTYPE of
CRYPT_CERTFORMAT_CERTIFICATE, not CRYPT_CERTFORMAT_CERTCHAIN.

(That was with the server certificate first and the others following it
in the file. If instead I put the three bundle.crt certificates first,
cryptAddPublicKey() fails.)

Do I need to export the chain in some other format? (PKCS #7?) I tried
"openssl crl2pkcs7 -nocrl -certfile bundle.crt -certfile server.crt -out
all.p7" and using all.p7 in place of all.crt, but then cryptImportCert()
fails with CRYPT_ERROR_BADDATA.

What am I missing?

-- ams

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: storing a certificate chain in a key store

2009-10-16T21:21:34Z

Abhijit Menon-Sen <ams@...> writes:

>What should I be doing instead? How should I import a certificate chain?

With a standard cryptImportCert(). Then when you do a cryptAddPublicKey()
it'll add all the relevant certs in the chain to the keyset. It doesn't make
any difference whether you use a single cert or a whole chain, the API is the
same.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

storing a certificate chain in a key store

2009-10-16T11:50:13Z

Hi.

I cryptKeysetOpen() a CRYPT_KEYSET_FILE store.

I cryptAddPrivateKey() a suitably-labelled RSA private key.

Then I cryptImportCert() from a .crt file, and cryptAddPublicKey() to
the keyset, and all is well.

All of that works well. Now here's the complication: I want to store not
only the certificate that corresponds to the private key, but the chain
of certificates leading to it as well.

I have two files, foo.crt and cabundle.crt, that represent this chain.
Running "openssl verify -verbose -CAfile cabundle.crt foo.crt" says OK,
so I know that all the certificates I need are in those two files.

Google tells me that some Java programs in this situation interoperate
with openssl by exporting the key and certificate chain into a PKCS#12
file and importing from that. While I can export my certificates thus,
cryptlib won't read PKCS#12 files; and the FAQ explains why not. Fine.

What should I be doing instead? How should I import a certificate chain?
(The manual has examples of how to sign, verify, and export chains, but
doesn't say how to import them that I can see.) Once I have the chain
imported, will cryptAddPrivateKey() do the right thing when I try to
store it?

Any help would be very greatly appreciated.

-- ams

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: sign and timestamp PDF files

2009-09-28T04:42:28Z

GuTyKa <gutyka@...> writes:

>Is there a way to achieve signing and timestamping PDF files with Cryptlib or
>with the aid of Crytplib?

PDF signatures use standard PKCS #7/SMIME signatures, so all you need to do is
embed a cryptlib detached signature in a PDF file. cryptlib handles all of
the crypto, but you'll need to write your own code to process the PDF file.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

sign and timestamp PDF files

2009-09-24T07:13:17Z

Hi!

Is there a way to achieve signing and timestamping PDF files with Cryptlib or
with the aid of Crytplib?

Thank you!

Regards,
GuTyKa

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Compiling on Leopard & Snow Leopard

2009-09-16T23:55:28Z

It's definitely a bug in dlopen() in OS X 10.6. To work around this, at line
41 (or thereabouts) of cryptlib.c, add:

#undef USE_THREADS

and rebuild. This will disable the use of dlopen() from a worker thread.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Compiling on Leopard & Snow Leopard

2009-09-16T23:47:02Z

So a preliminary update, the problem is due to a SIGTRAP in dlopen(), an
(apparent) bug introduced in Snow Leopard. Others have found this as well,
see e.g. http://openradar.appspot.com/7209349.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Compiling on Leopard & Snow Leopard

2009-09-16T08:39:13Z

Peter Gutmann wrote:
>> stovetop:cryptlib-3.3.3 tmiller$ make testlib
>> Undefined symbols:

> Ah, that's an easy one, to fix it just undefine USE_DNSSRV in misc/config.h.

Okay, now I get:

stovetop:cryptlib-3.3.3 tmiller$ make testlib
stovetop:cryptlib-3.3.3 tmiller$ ./testlib
Trace/BPT trap

This is with a debug build.

-- Tim

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (4K) Download Attachment

Re: Is deriving a key in a context equivalent to RFC2898 PBKDF2?

2009-09-15T22:57:42Z

"Timothy J. Miller" <tmiller@...> writes:

>I.e., if I did:
>
>data = <some data encrypted under a PBKDF2 derived key>
>ctx = cryptCreateContext(CRYPT_UNUSED, CRYPT_ALGO_3DES);
>s = cryptSetAttribute(ctx, CRYPT_CTXINFO_IV, iv, sizeof(iv));
>s = cryptSetAttribute(ctx, CRYPT_CTXINFO_KEYING_ITERATIONS, count);
>s = cryptSetAttributeString(ctx, CRYPT_CTXINFO_KEYING_SALT, salt, sizeof(salt));
>s = cryptSetAttributeString(ctx, CRYPT_CTXINFO_KEYING_VALUE, password, sizeof(password));
>s = cryptDecrypt(ctx, data, sizeof(data));
>
>Do I get the right plaintext? :)

Yes, provided the values you're setting are the same as what was set when the
data was encrypted, that should give you the correct plaintext.

(Note that there's an easier way to do this, just use password-based
enveloping and the only thing you need to worry about is the password/key).

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Couple of questions re: attributes

2009-09-15T22:42:04Z

"Timothy J. Miller" <tmiller@...> writes:

>python: device/system.c:788: setDeviceSystem: Assertion `( ( deviceInfo ) !=
>((void *)0) && ( void * ) ( deviceInfo ) > ( void * ) &_etext && ( sizeof(
>DEVICE_INFO ) ) > 0 )' failed.
>Aborted.

Ah, damn, I forgot about that, that's triggering a gcc compiler bug when you
enable debug mode (there are checks in the code for this, and that's one of
them being triggered).

>Methinks I'mna hafta either drop python or drop cryptlib since I don't have a
>lot of work time to commit to this, either of which is a shame.

Well, I'd try at least the C interface, and see if anyone responds to the
request for help with the Python script.

I can also prepare a slightly newer release for you that resolves the
(identified :-) issues you've had if you like.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Couple of questions re: attributes

2009-09-15T22:38:53Z

"Timothy J. Miller" <tmiller@...> writes:

>Who's the maintainer of this binding? Is there one? It could use updating,
>even for 2.6, and I doubt it will work under 3.0.

Yeah, the 2.x -> 3 transition was a bit of a headache... unfortunately the
person who created the Python script has been a bit busy with other work for
awhile, another person (I'm avoiding names so there's no finger-pointing at
anyone) who did the Delphi/VB/etc scripts was kind enough to have a look at
the Python one, but if there are any Python users on the list it'd be nice to
get someone to give it a once-over to fix it up for 3.0 and resolve any other
minor issues.

>I can try to skip the binding and call to cryptlib directly using ctypes.

That would be useful, or even just anything where I can see what's being
passed to the C code so I can reproduce the problem.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Compiling on Snow Leopard

2009-09-15T22:29:24Z

"Miller, Timothy J." <tmiller@...> writes:

>FWIW, I'm also getting ranlib complaining about no symbols.

That's a problem with Apple's ranlib, you can ignore that.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Compiling on Leopard & Snow Leopard

2009-09-15T22:28:29Z

"Miller, Timothy J." <tmiller@...> writes:

>I can't give you access, but here's what I get:
>
>stovetop:cryptlib-3.3.3 tmiller$ make testlib
>Undefined symbols:

Ah, that's an easy one, to fix it just undefine USE_DNSSRV in misc/config.h.

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Is deriving a key in a context equivalent to RFC2898 PBKDF2?

2009-09-15T13:08:38Z

I.e., if I did:

data = <some data encrypted under a PBKDF2 derived key>
ctx = cryptCreateContext(CRYPT_UNUSED, CRYPT_ALGO_3DES);
s = cryptSetAttribute(ctx, CRYPT_CTXINFO_IV, iv, sizeof(iv));
s = cryptSetAttribute(ctx, CRYPT_CTXINFO_KEYING_ITERATIONS, count);
s = cryptSetAttributeString(ctx, CRYPT_CTXINFO_KEYING_SALT, salt,
sizeof(salt));
s = cryptSetAttributeString(ctx, CRYPT_CTXINFO_KEYING_VALUE, password,
sizeof(password));
s = cryptDecrypt(ctx, data, sizeof(data));

Do I get the right plaintext? :)

-- Tim

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (4K) Download Attachment

Re: Couple of questions re: attributes

2009-09-14T12:03:49Z

Timothy J. Miller wrote:

> When I retry with a debug build I get (-3, 'Bad argument, parameter 3')
> instead. As near as I can tell the Python binding doesn't pass on
> anything else. I can try to skip the binding and call to cryptlib
> directly using ctypes.

Amend that. I forgot to install the dang sharedlib prior to rebuilding
the cryptlib_py binding.

Now the module load, but aborts on cryptInit():

>>> from cryptlib_py import *
>>> cryptInit()
python: device/system.c:788: setDeviceSystem: Assertion `( ( deviceInfo
) != ((void *)0) && ( void * ) ( deviceInfo ) > ( void * ) &_etext && (
sizeof( DEVICE_INFO ) ) > 0 )' failed.
Aborted.

Methinks I'mna hafta either drop python or drop cryptlib since I don't
have a lot of work time to commit to this, either of which is a shame.

-- Tim

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (4K) Download Attachment

Re: Couple of questions re: attributes

2009-09-14T09:54:09Z

Peter Gutmann wrote:

> At the native API level it should be binary data, however I'm not sure whatz
> Python's marshalling does when it passes the data to the native API, perhaps
> someone else can answer this.

As near as I can tell it's using the old C embedding/extension
protocols. It's a direct conversion of a Python str into a C char*
using the PyObject_AsCharBuffer() call.

http://docs.python.org/c-api/objbuffer.html

Who's the maintainer of this binding? Is there one? It could use
updating, even for 2.6, and I doubt it will work under 3.0.

>>>> cryptSetAttributeString(ctx, CRYPT_CTXINFO_KEYING_VALUE, 'password')
>> Traceback (most recent call last):
>> File "<stdin>", line 1, in <module>
>> cryptlib_py.CryptException: (-16, 'Internal consistency check failed')

> Hmm, can you provide details of what gets passed to the native API to trigger
> this? Or can you build the debug version of the code, which will throw an
> exception for the check indicating where it's being done?

When I retry with a debug build I get (-3, 'Bad argument, parameter 3')
instead. As near as I can tell the Python binding doesn't pass on
anything else. I can try to skip the binding and call to cryptlib
directly using ctypes.

-- Tim

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (4K) Download Attachment

Compiling on Snow Leopard

2009-09-14T06:48:59Z

FWIW, I'm also getting ranlib complaining about no symbols. I added -
flat_namespace with no effect.

-- Tim

ranlib: file: libcl.a(ec_lib.o) has no symbols
ranlib: file: libcl.a(ecp_mont.o) has no symbols
ranlib: file: libcl.a(ecp_smpl.o) has no symbols
ranlib: file: libcl.a(ec_mult.o) has no symbols
ranlib: file: libcl.a(ec_rand.o) has no symbols
ranlib: file: libcl.a(ec_kron.o) has no symbols
ranlib: file: libcl.a(ec_sqrt.o) has no symbols
ranlib: file: libcl.a(ctx_ecdh.o) has no symbols
ranlib: file: libcl.a(ctx_ecdsa.o) has no symbols
ranlib: file: libcl.a(ctx_md2.o) has no symbols
ranlib: file: libcl.a(ctx_md4.o) has no symbols
ranlib: file: libcl.a(ctx_rc2.o) has no symbols
ranlib: file: libcl.a(ctx_rc4.o) has no symbols
ranlib: file: libcl.a(ctx_skip.o) has no symbols
ranlib: file: libcl.a(kg_ecc.o) has no symbols
ranlib: file: libcl.a(fortezza.o) has no symbols
ranlib: file: libcl.a(hardware.o) has no symbols
ranlib: file: libcl.a(hw_dummy.o) has no symbols
ranlib: file: libcl.a(pkcs11.o) has no symbols
ranlib: file: libcl.a(pkcs11_init.o) has no symbols
ranlib: file: libcl.a(pkcs11_pkc.o) has no symbols
ranlib: file: libcl.a(pkcs11_rw.o) has no symbols
ranlib: file: libcl.a(cmp_tcp.o) has no symbols
ranlib: file: libcl.a(ldap.o) has no symbols
ranlib: file: libcl.a(pkcs12.o) has no symbols
ranlib: file: libcl.a(int_debug.o) has no symbols
ranlib: file: libcl.a(java_jni.o) has no symbols
ranlib: file: libcl.a(ssh1.o) has no symbols

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (3K) Download Attachment

Re: Compiling on Leopard & Snow Leopard

2009-09-14T06:30:01Z

On Sep 14, 2009, at 12:37 AM, Peter Gutmann wrote:

> I build it on... hmm, I can't get to the machine at the moment so I
> can't
> check the version but I'm pretty sure it's 10.5. If someone can
> give me SSH
> access to a 10.6 box I'll get it running on that.

> (There was an incorrect define in the last release in osconfig.h for
> B_ENDIAN,
> but apart from that it should build OK, at least on non-10.6).

I can't give you access, but here's what I get:

stovetop:cryptlib-3.3.3 tmiller$ make testlib
Undefined symbols:
"_res_9_dn_skipname", referenced from:
_findHostInfo in libcl.a(dns_srv.o)
_findHostInfo in libcl.a(dns_srv.o)
_findHostInfo in libcl.a(dns_srv.o)
"_res_9_query", referenced from:
_findHostInfo in libcl.a(dns_srv.o)
"_res_9_dn_expand", referenced from:
_findHostInfo in libcl.a(dns_srv.o)
ld: symbol(s) not found
collect2: ld returned 1 exit status
make: *** [testlib] Error 1

Adding a Darwin stanza to getlibs.sh with -lresolv didn't seem to
work, but I could be mistaken on how your build system hangs together.

-- Tim

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (3K) Download Attachment

Re: Compiling on Leopard & Snow Leopard

2009-09-14T05:58:30Z

On Sep 13, 2009, at 9:45 AM, Scott F. Comstock wrote:

> Has anyone had luck compiling Cryptlib (static or dynamic) on
> Leopard or
> Snow Leopard?

Not yet. I toyed with this for an hour or so over the weekend, but
don't have a working version yet (though it's compiling now, so that's
progress :). So far:

crypt/osconfig.h has a second "#define B_ENDIAN" after the #if/#else
for __ppc__ which kind of moots the point of the attempted detection.

Also, it appears that SL needs a Darwin linking rule in getlibs.sh to
link to libresolv.

That's as far as I got before real life intervened (read: I went to
the art museum).

-- Tim

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

smime.p7s (3K) Download Attachment

Re: Compiling on Leopard & Snow Leopard

2009-09-14T03:17:48Z

Am 13.09.2009 um 16:45 schrieb Scott F. Comstock:

> Has anyone had luck compiling Cryptlib (static or dynamic) on
> Leopard or Snow Leopard?
3.3.2 compiled out of the box last April on 10.5 i386 (recent version
of 10.5 at that time).
Build log available on request.
Test completed with:
---
All tests concluded successfully.
___

Axel

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Re: Compiling on Leopard & Snow Leopard

2009-09-13T22:37:51Z

"Scott F. Comstock" <scott@...> writes:

>Has anyone had luck compiling Cryptlib (static or dynamic) on Leopard or Snow
>Leopard?

I build it on... hmm, I can't get to the machine at the moment so I can't
check the version but I'm pretty sure it's 10.5. If someone can give me SSH
access to a 10.6 box I'll get it running on that.

(There was an incorrect define in the last release in osconfig.h for B_ENDIAN,
but apart from that it should build OK, at least on non-10.6).

Peter.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Fwd: Compiling on Leopard & Snow Leopard

2009-09-13T11:39:54Z

I can make it compile, however I get a trap during the tests. I can post the fixes for debugging (there's at least one define that needs to be changed), but I think some more in depth work will have to be done to fix it for snow leopard. Static compilation doesn't work on leopard, but dynamic does.

Andy Gocke

On Sep 13, 2009, at 9:45 AM, Scott F. Comstock wrote:

Has anyone had luck compiling Cryptlib (static or dynamic) on Leopard or Snow Leopard?

-Scott

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.

Compiling on Leopard & Snow Leopard

2009-09-13T07:45:14Z

Has anyone had luck compiling Cryptlib (static or dynamic) on Leopard or
Snow Leopard?

-Scott

_______________________________________________
Cryptlib mailing list
Cryptlib@... via Mail: cryptlib-request@...
Archive: ftp://ftp.franken.de/pub/crypt/cryptlib/archives/
http://news.gmane.org/gmane.comp.encryption.cryptlib
Posts from non-subscribed addresses are blocked to prevent spam, please
subscribe in order to post messages.