<div dir="ltr"><div>I apologize before hand for the long e-mail, but I just wanted to be thorough in what I was doing.</div><div><br></div>I am trying to use the PyCrypto library to achieve two similar things. The first use is to verify that a piece of data has been signed by the private key of a certain certificate. The other use is to verify a certificate chain (verify that certificate A has signed B, and then that B has signed C).<div>
<br></div><div>The process is as follows:</div><div>Client generates certificate / key-pairs A, B, C and D. A signs B, and B signs C and D. Then the certificates for A, signed B, signed C and signed D are pushed to a server. The server responds with a randomly generated bit of binary data for each certificate. The client uses each certificate / key-pair to sign the respective binary data, and then pushes the (base64 encoded) signed responses back to the server. The server then takes the responses, decodes them and tries to verify the signatures on the </div>
<div><br></div><div>Code / Attempts:</div><div>My first attempt -</div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>###</div><div>#Function - verifying the signed challenges</div><div>###</div><div>
Astr = storedcertificates["acert"]</div>
<div>Achallenge = storedchallenges["achallenge"]</div><div>Signedchallenge = (read in from http post request)</div><div>Acert = load_certificate(FILETYPE_PEM, Astr)</div><div><br></div><div>try:</div><div> verify (Acert, Signedchallenge, Achallenge, "sha256")</div>
<div>except Exception e:</div><div> print "failed to verify for reason:"</div><div> print e</div><div><br></div><div>#Repeat above for B, C and D</div><div>###</div><div><br></div><div>With this code I got the following error response from the verify function: "must be string without null bytes, not str".</div>
</blockquote><div><br></div><div>My second attempt - </div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div>Having the above code fail, I then found and tried adapting the code <a href="http://www.v13.gr/blog/?p=303">here</a>, but I first received that the function "get_signature_algorithm()" does not exists for X509 certificates, and then received the same error response back for the verify function if I commented out the signature algorithm and just manually provided the digest.</div>
<div>###</div><div>#Function - verify the signed challenges modified example</div><div>###</div><div><div>Acert = load_certificate(FILETYPE_PEM, storedcerts["root"])</div></div><div><div>challenge = (original binary challenge sent to client)</div>
</div><div><div>algorithm = Acert.get_signature_algorithm()</div></div><div><div>dersigin = asn1.DerObject()</div></div><div><div>dersigin.decode(rootchal)</div></div><div><div>sig0 = dersigin.payload</div></div><div><div>
if sig0[0] != '\x00':</div></div><div><div><span class="" style="white-space:pre"> </span>print "sig0 error"</div></div><div><div><span class="" style="white-space:pre"> </span>print sig0</div></div><div>
<div><span class="" style="white-space:pre"> </span>return False</div></div><div><div><br></div></div><div><div>signature = sig0[1:]</div></div><div><div>try:</div></div><div><div><span class="" style="white-space:pre"> </span>verify(Acert, signature, challenge, algorithm)</div>
</div><div><div><span style="white-space:pre"> #</span>verify(Acert, signature, challenge, "sha256") #Alternate without the get_sig_alg()</div></div><div><div>except:</div></div><div><div><span class="" style="white-space:pre"> </span>print "verifcation failed"</div>
</div><div><div><span class="" style="white-space:pre"> </span>return False</div></div><div><div>print "THE VERIFICATION WORKED?!?!?!?!?!?!??!"</div></div><div><div>return True</div></div></blockquote><div><br>
</div>
<div><br></div><div>For the chain verification stuff, I followed the example code from the above link exactly, but received the same errors as the second example code (algorithm and string / str).</div><div><br></div><div>
What am I doing wrong / How am I using the library incorrectly?</div><div><br></div><div><br></div><div>Thanks,</div><div>Kyle Cummings</div></div>