0

I have been trying to do signature generation to send the encrypted message to server. But server is not able to verify the signature. Similarly, I am not able to verify the signature sent by server.

My code is in python2.7 and I am using PyCrypto library. Server-side code is in .NET.

I feel something is wrong with PyCrypto. .NET's RSACryptoServiceProvider module in unable to verify the signature. I also used JSEncrypt of JavaScript but it was also unable to verify the signature created by PyCrypto.

Following is my code:

from Crypto.PublicKey import RSA
from Crypto.Signature import PKCS1_v1_5 as SignaturePKCS1_v1_5
from Crypto.Hash import SHA256
from base64 import b64encode, b64decode


def signEncryptedDataWithSHA256(Encrypted_Data, privateKey):
  h = SHA256.new(Encrypted_Data)
  signer = SignaturePKCS1_v1_5.new(privateKey)
  signature = signer.sign(h)
  return signature

def verifySignatureWithSHA256(Encrypted_Data, signature, publicKey):
  h = SHA256.new(Encrypted_Data)
  verifier = SignaturePKCS1_v1_5.new(publicKey)
  if verifier.verify(h, signature):
    return True
  else:
    return False

#private-public keypair has been generated using following OpenSSL command:
#openssl req -newkey rsa:4096 -nodes -keyout PrivateKey.pem -x509 -days 1095 -out certificate.pem
#openssl x509 -pubkey -noout -in certificate.pem  > PublicKey.pem
rsa_private_key = RSA.importKey(open("files/PrivateKey.pem", "rb").read())
rsa_public_key = RSA.importKey(open("files/PublicKey.pem", "rb").read())


# to send message to server:
data = <some-string> #for e.g., data = 'Q\xd4#\xc8\x1a\xf1)\x1cUq\xe5\x06\xae\xdcW\x93' (it is output of AES encryption)
signedData = signEncryptedDataWithSHA256(data, rsa_private_key)
body = {            #this body is sent to server
  "Data": b64encode(data),
  "Sign": b64encode(signedData)
}

# after receiving response from server
'''
server_data = data received from server
server_sign = sign received from server
server_pub_key = server's public key
'''
verfied = verifySignatureWithSHA256(b64decode(server_data),b64decode(server_sign),server_pub_key)

Please help me solve this issue. I am stuck with it since last 20 days.

UPDATE: [Adding the .NET code which is running at the server side]

Function used to generate the Signature:

public byte[] SignData(byte[] input, string private_key)
{
    byte[] encryptedSignedBytes;
    using (RSACryptoServiceProvider provider = new RSACryptoServiceProvider(2048))
    {
        provider.FromXmlString(private_key);
        encryptedSignedBytes = provider.SignData(input, new SHA256CryptoServiceProvider());
    }
    return encryptedSignedBytes;
}

The above function is called in the signature is sent in the following way: Convert.ToBase64String(<claa-obj-name>.SignData(Encoding.UTF8.GetBytes(Data), PrivateKey))

Function used to verify the Signature:

public bool VerifySignData(byte[] input, byte[] signInput, string partnerPublic_key)
{
    bool retunValue = false;
    using (RSACryptoServiceProvider provider = new RSACryptoServiceProvider())
    {
        provider.FromXmlString(partnerPublic_key);
        retunValue = provider.VerifyData(input, new SHA256CryptoServiceProvider(), signInput);
    }
    return retunValue;
}

The above function is called in the following way: VerifySignData(Encoding.UTF8.GetBytes(cninfo.Request.Data),Convert.FromBase64String(Sign), PublicKey)

Jay Modi
  • 13
  • 4
  • You can do an awful lot wrong with crypto. A single bit can lead to no verification of an otherwise valid signature. Without code we cannot help you. It is valid PKCS#1 v1.5 padding in all likelyhood. – Maarten Bodewes Feb 20 '19 at 14:35
  • @MaartenBodewes I have added the .NET code. Please have a look at it and tell me if you need something more to solve the issue. Thanks in advance :) – Jay Modi Feb 27 '19 at 06:57
  • Did you check if the data you've passed in (the actual byte values) are identical? And if the public key is indeed part of the same key pair? Note that signature generation *is not encryption* so the `encryptedSignedBytes` variable has a bad name. – Maarten Bodewes Feb 27 '19 at 13:04

0 Answers0