How can we use the RSA-PSS Algo to create a Signature in ABAP?
Currently we use the following function: SSFW_KRN_SIGN with the str_format = 'PKCS1-V1.5'.
In the future we will need 'SHA256withRSA/PSS' Algo.
Please provide a code example. Thank you!
There is 3 different technical information given with "SHA256withRSA/PSS". SHA256 is hashing algorithm for your data. RSA is a public/private key couple and PSS is a padding algorithm. SSFW_KRN_SIGN using sapcryptolib. You need to update this library (basis can do this) to get new padding and hashing algorithms. Check the note 1848999 for which version supports your minimum requirements. I see that you need to use at least v8.4.15.
You can check your current version with SSF01/SSF02.
Related
I just need a confirmation if AION uses a combination of Blake2b and Keccak or just Blake2b? As I was reading the HastUtil.java - https://github.com/aionnetwork/aion/blob/3dbe9316249271d1b0f845acabcde6eff37211fa/modCrypto/src/main/java/org/aion/crypto/HashUtil.java I can see that they are using Blake2b and Keccak.
I am solving hybrid control problems using Drake with Gurobi solver. I want to get the final root relaxed solution (after presolve and auto cut generation). I tried writing log files, but the log file doesn't print out every iteration and I couldn't get the best relaxed objective bound after presolve and cut generation.
Get root node relaxation solution
This post shows how to retrieve the value I want, but I am not sure how to change the code to use it in Drake.
Thanks in advance.
In GurobiSolver, we provide adding callback functions for mixed-integer program, you can check AddMipNodeCallback or AddMipSolCallback
I am working on a library which follows PKCS#11 standard.
https://www.cryptsoft.com/pkcs11doc/v220/
The library can generate RSA Keypair in token by the function C_GenerateKeyPair and returns appropriate object handles with return value CKR_OK.
The token(applet) not supports load of private/public key except generate key pair. What will be the appropriate return value of create RSA private/public key using C_CreateObject?
Now I am returning CKR_GENERAL_ERROR, is it okay?
Allowed return values are
CKR_ARGUMENTS_BAD, CKR_ATTRIBUTE_READ_ONLY,
CKR_ATTRIBUTE_TYPE_INVALID, CKR_ATTRIBUTE_VALUE_INVALID,
CKR_CRYPTOKI_NOT_INITIALIZED, CKR_DEVICE_ERROR, CKR_DEVICE_MEMORY,
CKR_DEVICE_REMOVED, CKR_DOMAIN_PARAMS_INVALID, CKR_FUNCTION_FAILED,
CKR_GENERAL_ERROR, CKR_HOST_MEMORY, CKR_OK, CKR_PIN_EXPIRED,
CKR_SESSION_CLOSED, CKR_SESSION_HANDLE_INVALID, CKR_SESSION_READ_ONLY,
CKR_TEMPLATE_INCOMPLETE, CKR_TEMPLATE_INCONSISTENT,
CKR_TOKEN_WRITE_PROTECTED, CKR_USER_NOT_LOGGED_IN.
Thanks for your help
Update
I have two types of applet, one supports load of RSA private/public key to token and another not supports. It can only possible to identify if the token supports load of key is the response of transmitted APDU. So I can't take decision only to check the class attribute of C_CreateObject.
If your library does not support C_CreateObject at all then the best choice IMO is CKR_FUNCTION_NOT_SUPPORTED.
Chapter 11 in PKCS#11 v2.20 states:
A Cryptoki library need not support every function in the Cryptoki API. However, even an unsupported function must have a "stub" in the library which simply returns the value CKR_FUNCTION_NOT_SUPPORTED.
If your library does support C_CreateObject for creation of other object types (e.g. certificates, data objects etc.) then the best choice IMO is CKR_ATTRIBUTE_VALUE_INVALID.
Chapter 10.1.1 in PKCS#11 v2.20 states:
If the supplied template specifies an invalid value for a valid attribute, then the attempt should fail with the error code CKR_ATTRIBUTE_VALUE_INVALID.
UPDATE
Now that you have shared more details about your library in the comments I can add more detailed explanation:
It seems I can call your implementation of C_CreateObject with template containing CKA_CLASS=CKO_CERTIFICATE and it will create certificate object on this particular token and return CKR_OK. If I call it with template containing CKA_CLASS=CKO_PRIVATE_KEY then your code will decide to return an error right after the evaluation of the supplied value of this attribute. IMO there is no doubt that chapter 10.1.1 of PKCS#11 v2.20 recommends you to return CKR_ATTRIBUTE_VALUE_INVALID in this case.
However if are not willing to follow behavior recommended by the specification and there is no predefined error code you like, you can introduce your own vendor defined code (see my older answer for more details):
#define CKR_TOKEN_OPERATION_NOT_SUPPORTED (CKR_VENDOR_DEFINED|0x0000001)
IMO confusion level for inexperienced developer will be the same regardless of error code you return. In the end he/she will need to consult your documentation or logs produced by your library to find out the real reason why he/she received the error.
I have searched alot regarding my task which is like ,
i am getting data through XML which is encrypted using RSA/ECB/PKCS1Padding from backend and they have given me a file name "publickey.der". According to them this is public key and you need to use this key for decryption.
Seriously i dont have any idea about using this public key for decryption on Objective C.
Please guide me which framework or library or sdk i need to use or any one has any sample code for this. I am counting on you guys only.
Looking forward for your responses
Thank you once again
Public keys are used for encryption, private keys are used for decryption. You will have to rectify this issue first.
Also RSA/ECB/PKCS1Padding is not common, when you want to rsa encrypt a large amount of data, usually you encrypt an aes key with rsa and encrypt your data with aes instead.
Basically, to do this RSA/ECB decrypt outside of java, it will be manually, and you are going to have to break your cipher text up by your block size (key size), and then decrypt each block without padding, until the final block with padding, that's how you get the ECB.
This is not ideal, that combined with them providing you with a public key and telling you to decrypt, suggests that whoever is giving you the data needs to fix their encryption issues.
An existing coldfusion website is to be converted to dot net.
In the coldfusion code, the password is hashed using its hash() function with no algorithm:
SomePassword = '#hash(fldPassword)#'
I found this document, saying the default encryption is
CFMX_COMPAT: Generates a hash string identical to that generated by
ColdFusion MX and ColdFusion MX 6.1 (default).
There are some articles actually telling me how to decrypt.
According to Macromedia, The ColdFusion Encrypt function uses an
XOR-based algorithm that utilizes a pseudo random 32-bit key based on
a seed passed by the user as a parameter to the function. The
resulting data is UUencoded.
You'll need to uudecode the encoded value first
http://www.eggheadcafe.com/printsear...asp?linkid=351
and then XOR it using the key it was encrypted with.
http://www.java2s.com/Code/CSharp/La...deamessage.htm
If you dont have the key - your wasting yuor time.
But, how to make it work? I don't think there is any key. All I can see is '#hash(fldPassword)#'. Please help. Thanks.
There are some articles actually telling me how to decrypt.
Hashing and encryption are not the same thing. Encryption can be reversed. You can recover the original value if you have the right key, etectera. Whereas hashing is a one way trip. Once hashed, the original value cannot be recovered. (Well .. in theory. Some of the weaker hashing algorithms have been broken.) So you cannot "decrypt" a hashed value. But you can duplicate the obfuscated result string.
I found this document, saying the default encryption is CFMX_COMPAT
Actually it refers to the default algorithm. However, I am not so sure that description is correct. (Edit: As Rasmus correctly points out, it does say the default is MD5) However, CF9/7 default to MD5 anyway. Even when the algorithm is CFMX_COMPAT. So in either case, a simple MD5 hash in C# would give you the same result.
ie These all produce identical results ie 098F6BCD4621D373CADE4E832627B4F6.
#hash("test")#
#hash("test", "cfmx_compat")#
#hash("test", "md5")#
If I read the documentation correctly, CFMX_COMPAT hashing is just MD5.
So:
byte[] hash = MD5.Create().ComputeHash(fldPassword);
It should be easy to verify if you have access to a ColdFusion installation.