{"action":"opened","issue":{"url":"https://api.github.com/repos/PeculiarVentures/graphene/issues/68","repository_url":"https://api.github.com/repos/PeculiarVentures/graphene","labels_url":"https://api.github.com/repos/PeculiarVentures/graphene/issues/68/labels{/name}","comments_url":"https://api.github.com/repos/PeculiarVentures/graphene/issues/68/comments","events_url":"https://api.github.com/repos/PeculiarVentures/graphene/issues/68/events","html_url":"https://github.com/PeculiarVentures/graphene/issues/68","id":197804461,"number":68,"title":"Signing and verifying a message with eToken/Improving error handling","user":{"login":"Hyperiongit","id":24803746,"avatar_url":"https://avatars.githubusercontent.com/u/24803746?v=3","gravatar_id":"","url":"https://api.github.com/users/Hyperiongit","html_url":"https://github.com/Hyperiongit","followers_url":"https://api.github.com/users/Hyperiongit/followers","following_url":"https://api.github.com/users/Hyperiongit/following{/other_user}","gists_url":"https://api.github.com/users/Hyperiongit/gists{/gist_id}","starred_url":"https://api.github.com/users/Hyperiongit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Hyperiongit/subscriptions","organizations_url":"https://api.github.com/users/Hyperiongit/orgs","repos_url":"https://api.github.com/users/Hyperiongit/repos","events_url":"https://api.github.com/users/Hyperiongit/events{/privacy}","received_events_url":"https://api.github.com/users/Hyperiongit/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-28T06:41:06Z","updated_at":"2016-12-28T06:41:06Z","closed_at":null,"body":"So, I have this following piece of code that I came up with, mostly using your provided examples, and I have two questions.\r\n\r\n`var graphene = require(\"graphene-pk11\");\r\nvar Module = graphene.Module;\r\n\r\nvar mod = Module.load(\"H://Windows/System32/etpkcs11.dll\", \"eToken\");\r\n\r\nmod.initialize();\r\n\r\nvar session = mod.getSlots(0).open();\r\nsession.login(\"123\");\r\n\r\n// Get all objects from the eToken\r\nvar arr = session.find();\r\nif(arr.length > 0){\r\n   for(var i=0; i < arr.length;i++){        \r\n      if(arr.items(i).class == graphene.ObjectClass.PRIVATE_KEY){  \r\n\r\n        //Get a PRIVATE_KEY object for signing and initialize a sign object     \r\n        var pkey = arr.items(i).toType(graphene.ObjectClass.PRIVATE_KEY);      \r\n        var sign = session.createSign(\"SHA1_RSA_PKCS\",pkey); \r\n        sign.update(\"simple text 1\");    \r\n        sign.update(\"simple text 2\");\r\n\r\n        //sign the text and print it     \r\n        var signature = sign.final();\r\n        console.log(\"Signature RSA-SHA1:\", signature.toString(\"hex\"));\r\n\r\n        //get the publicExponent and modulus from the PRIVATE_KEY object so we\r\n        //can create a PUBLIC_KEY object for verifying the signature      \r\n        var okey = pkey.getAttribute({modulus: null, publicExponent: null});\r\n\r\n        //PUBLIC_KEY template basis is taken from \r\n        //https://www.cryptsoft.com/pkcs11doc/v230/group__SEC__11__1__2__RSA__PUBLIC__KEY__OBJECTS.html\r\n        var rpkey = session.create({class: graphene.ObjectClass.PUBLIC_KEY, //CKA_CLASS\r\n                                    keyType: graphene.KeyType.RSA, //CKA_KEY_TYPE\r\n                                    token: false, //CKA_TOKEN\r\n                                    label: \"temp\", //CKA_LABEL\r\n                                    wrap: true, //CKA_WRAP\r\n                                    encrypt: true, //CKA_ENCRYPT\r\n                                    modulus: okey.modulus, //CKA_MODULUS\r\n                                    publicExponent: okey.publicExponent}); //CKA_PUBLIC_EXPONENT\r\n        \r\n        //create verification object and initialize it with our PUBLIC_KEY\r\n        var verify = session.createVerify(\"SHA1_RSA_PKCS\", rpkey);\r\n        verify.update(\"simple text 1\");\r\n        verify.update(\"simple text 2\");\r\n\r\n        //finalize verification and print result     \r\n        var verify_result = verify.final(signature);\r\n        console.log(\"Signature RSA-SHA1 verify:\", verify_result);\r\n        \r\n        //destroying our PUBLIC_KEY object      \r\n        rpkey.destroy();\r\n        //do not continue for other private keys on the token\r\n        break;\r\n      }\r\n   }        \r\n}\r\n\r\nsession.logout();\r\nmod.finalize();\r\n`\r\n\r\nQuestions:\r\n1) Function session.find() doesn't find any PUBLIC_KEY objects, therefore in the code above, the PUBLIC_KEY object is created outside of eToken from several attributes of PRIVATE_KEY, using function session.create(). \r\nI'm not sure WHERE it is created though, and if it's purely a temporary object on the heap that would be cleaned up by the OS after the process exit if it's not destroyed by destroy() function. \r\nThe question is: does this code implement the correct way of signing and verifying a message with a token, using graphene?\r\n\r\n2)This is the output for correct message signature:\r\n_Signature RSA-SHA1: 9b3bdd9eeecf4fe1e8dff162b4bd4b090e1948ad7362a2e1de4479e69f11\r\nfc9500a1dbcfb2bd1208ff2d987afa6a8226f5a3e54e3ab4fcfb6d97b979fba8857b33dfde47485a\r\n417659d8a8f36c6fdf75f347b67b0d23e6020749b2ddc63d547bfae027976584fb68ad630fdfc11f\r\n81141c8704c8525504e0f264a65a921151d40488ef59f9f0739c1c8a3ac606d57ce4672a758d77ae\r\n228b092cabc9fca2423065304c92c530dd189eb640212017e52d7ef7f0a55b297c473492bf65821c\r\n5357f98101470a9371e5aaa2bd069356a4490033dc059c68489804b8c5ffee82ed4a9bc6245dd98c\r\n4ab95ccf62b81f9ad31d53bfbfcb3026a2a112f63a3f65b44b28\r\nSignature RSA-SHA1 verify: true_\r\n\r\nHowever, if we change the text from \"simple text 2\" to, say, \"simple text 3\"  for verification, we get this:\r\n\r\n_H:\\Users\\R\\node_modules\\graphene-pk11\\build\\crypto\\verify.js:35\r\n        var res = this.lib.C_VerifyFinal(this.session.handle, signature);\r\n                           ^\r\n\r\nError: CKR_SIGNATURE_INVALID:192\r\n    at Error (native) PKCS11::C_VerifyFinal:837\r\n    at Error (native)\r\n    at Verify.final (H:\\Users\\R\\node_modules\\graphene-pk11\\build\\crypto\\verify.j\r\ns:35:28)\r\n    at Object.<anonymous> (H:\\Users\\R\\nsfg.js:48:36)\r\n    at Module._compile (module.js:570:32)\r\n    at Object.Module._extensions..js (module.js:579:10)\r\n    at Module.load (module.js:487:32)\r\n    at tryModuleLoad (module.js:446:12)\r\n    at Function.Module._load (module.js:438:3)\r\n    at Module.runMain (module.js:604:10)\r\n    at run (bootstrap_node.js:394:7)_\r\n\r\nSo basically, verification function returns true if the signature is correct and throws an exception if it's not. Which seems to be a weird way of implementing it (Shouldn't it just return false? Does user need this exception?). The question is, can this be improved?\r\n\r\nThanks in advance. "}}
{"actor":{"display_login":"Hyperiongit"}}