Paying to get RSA signing working in Javascript - page 2.

mikegogulski

sr. member

Activity: 360

Merit: 250

I succeeded in getting "shitassfuck" as output from your test script! Cheesy

weweritz

newbie

Activity: 2

Merit: 0

The hex that the stringSign function returns should be 512 characters long. If it is any shorter, prepend the number of zeroes that are missing;

something along the lines

Code:

while ( String( hSig ).length < 512 ) hSig = "0" + String( hSig );

should work.

de4l

member

Activity: 82

Merit: 10

you could also just un-comment the base-64 output built into rsa.js and use that instead of the additional (lossy) conversion steps

Nefario

hero member

Activity: 602

Merit: 513

GLBSE Support [email protected]

Quote from: weweritz on May 23, 2011, 04:23:52 AM

Funny thing, this.
The problem is in the rsa.signString function that returns the hex value of the signature. Javascript incorrectly discards the leading zero (1922282fceed0... instead of 01922282fceed0...) and when you convert this to binary and then base64encode it, naturally, everything goes wrong. With the extra zero, the output is as specified.

Nice, you found a bug(not my code). Do you know if a leading 0 needs to be added with all output or just this instance?

weweritz

newbie

Activity: 2

Merit: 0

Funny thing, this.
The problem is in the rsa.signString function that returns the hex value of the signature. Javascript incorrectly discards the leading zero (1922282fceed0... instead of 01922282fceed0...) and when you convert this to binary and then base64encode it, naturally, everything goes wrong. With the extra zero, the output is as specified.

Nefario

hero member

Activity: 602

Merit: 513

GLBSE Support [email protected]

You can actually just use the source from the page linked(it's a static page), if it works with that then it should just plain old work, so a link to a html page with all the js source in it would be fine(essentially a copy of the one I linked to).

Nefario

hero member

Activity: 602

Merit: 513

GLBSE Support [email protected]

Quote from: Jere.Jones on May 23, 2011, 03:47:45 AM

What is your source for the expected output?

Jere

I've been using ruby's interface to openssl

If you've got ruby installed launch irb.

Code:

require 'openssl'
require 'base64'

privkey="privatekeytext"
data="my data string"
private_key = OpenSSL::PKey::RSA.new(privkey)
b64sig=Base64.encode64(private_key.sign( OpenSSL::Digest::SHA512.new, data))

I know it works as I've been using it on glbse since before we launched.

Jere.Jones

full member

Activity: 121

Merit: 100

What is your source for the expected output?

Jere

Nefario

hero member

Activity: 602

Merit: 513

GLBSE Support [email protected]

Sorry, that seems to be including linebreaks, here it is without the linebreaks(\n).

Code:

AZIigvzu0G2BG/RpDz05qZZctQvzTGNOiOJzziL1+eQEU42cwp/LPOv+6DwMgDIIf2/DAHD+pe7bsxIWftlr65z1bRTYdQ+K+VA0fC6m36muny3NLsKl4hrqIVVWQsTZwbUqJcOvYaNcYMaXr05hTMKC4XAkqKNSqLBOc41k7vU8V6duYwndal7rZiWvso+cH0HxffJszLREUbamMtNBapmhXJCsn2PafQ+RyFj5VnJPYe5MIp/d86yco2q1PC2jLyySxH2kma6d1dq/yxgFiTiABT80w7/9GPlE+cNFIuclEeeYZyo+3r1R7Lgqhnr98MGC7dGjrW5BK5zSRHjgBw==

de4l

member

Activity: 82

Merit: 10

Quote from: Nefario on May 23, 2011, 02:46:20 AM

Signature(base64 encoded) should be:

Code:

AZIigvzu0G2BG/RpDz05qZZctQvzTGNOiOJzziL1+eQEU42cwp/LPOv+6DwM\ngDIIf2/DAHD+pe7bsxIWftlr65z1bRTYdQ+K+VA0fC6m36muny3NLsKl4hrq\nIVVWQsTZwbUqJcOvYaNcYMaXr05hTMKC4XAkqKNSqLBOc41k7vU8V6duYwnd\nal7rZiWvso+cH0HxffJszLREUbamMtNBapmhXJCsn2PafQ+RyFj5VnJPYe5M\nIp/d86yco2q1PC2jLyySxH2kma6d1dq/yxgFiTiABT80w7/9GPlE+cNFIucl\nEeeYZyo+3r1R7Lgqhnr98MGC7dGjrW5BK5zSRHjgBw==

I'm looking through everything but so far, this does not appear to be a valid base-64 string for me at least

ps. or is the implication that this was the (RSA encoded (base-64 encoded(data)) and not (base64(rsa(base64(data))))

Nefario

hero member

Activity: 602

Merit: 513

GLBSE Support [email protected]

I hate Javascript, hate it with a passion

The person that solves this will get 70Bitcoins, and can (for another 120Bitcoins) continue on and develope this into an interface for GLBSE. As well as the bitcoin itself there will be major credit for this, and your name will be added to GLBSE's (soon to be created) contributors page.

I am attempting to use some Javascript libraries to sign base64 encoded data with an RSA prvate key, the signature is then also encoded base64 which is sent to a server, the server verifies it with the public key, and then I do some stuff.

The problem is the JavaScript lib's seem to be signing but the output is not correct.

Private key is:

Code:

The test data being signed is(already base64 encoded):

Code:

eyJ1c2VyaWQiOiJcdTAwMGFkOTQ2ZWQ2MDFmMTNhNDZmNjU1YjUwODM4N2FmZTc2OWYzNTNiMzk1MmY3YTMzOWE4Mjc3ZTdmMTlkYTU4NGQ4XHUwMDBhIiwibm9uY2UiOjg2MTU2NjE5NTE2NX0=

We're using SHA512 as the padding digest.

Signature(base64 encoded) should be:

Code:

AZIigvzu0G2BG/RpDz05qZZctQvzTGNOiOJzziL1+eQEU42cwp/LPOv+6DwMgDIIf2/DAHD+pe7bsxIWftlr65z1bRTYdQ+K+VA0fC6m36muny3NLsKl4hrqIVVWQsTZwbUqJcOvYaNcYMaXr05hTMKC4XAkqKNSqLBOc41k7vU8V6duYwndal7rZiWvso+cH0HxffJszLREUbamMtNBapmhXJCsn2PafQ+RyFj5VnJPYe5MIp/d86yco2q1PC2jLyySxH2kma6d1dq/yxgFiTiABT80w7/9GPlE+cNFIuclEeeYZyo+3r1R7Lgqhnr98MGC7dGjrW5BK5zSRHjgBw==

What I keep getting is:

Code:

GSIoL87tBtgRv0aQ89OamWXLUL80xjTojic84i9fnkBFONnMKfyzzr/ug8DIAyCH9vwwBw/qXu27 MSFn7Za+uc9W0U2HUPivlQNHwupt+prp8tzS7CpeIa6iFVVkLE2cG1KiXDr2GjXGDGl69OYUzCgu FwJKijUqiwTnONZO71PFenbmMJ3Wpe62Ylr7KPnB9B8X3ybMy0RFG2pjLTQWqZoVyQrJ9j2n0Pkc hY+VZyT2HuTCKf3fOsnKNqtTwtoy8sksR9pJmundXav8sYBYk4gAU/NMO//Rj5RPnDRSLnJRHnmG cqPt69Uey4KoZ6/fDBgu3Ro61uQSuc0kR44A

Get the function sign_and_encode(data,private_key) to return the correct output, the fuction (and all it's dependencies) can be found here http://dev.glbse.com:4567/rsa.html just view source. Time is very important, we need to move on ASAP.

If needs be you can use another Javscript RSA library if the one being used is simply broken.

Note:updated to remove linebreaks from the base64 endoded signature

Topic: Paying to get RSA signing working in Javascript - page 2. (Read 4870 times)