ASN.1 签名结构

最新推荐文章于 2024-06-14 09:32:35 发布

VFSSoft

最新推荐文章于 2024-06-14 09:32:35 发布

阅读量259

点赞数 5

分类专栏：证书示例 # tls 文章标签：安全网络安全

本文链接：https://blog.csdn.net/m0_64218465/article/details/138709818

版权

tls 同时被 2 个专栏收录

8 篇文章 0 订阅

订阅专栏

证书示例

2 篇文章 0 订阅

订阅专栏

ASN.1 签名主要涉及两个两个 ASN.1 结构：

AlgorithmIdentifier
SignatureValue

AlgorithmIdentifier 结构如下：

AlgorithmIdentifier  ::=  SEQUENCE  {
    algorithm   OBJECT IDENTIFIER,
    parameters  ANY DEFINED BY algorithm OPTIONAL
}

SignatureValue 结构如下:

SignatureValue ::= BitString

ref: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.1.2

RSA

Algorithm Identifier

AlgorithmIdentifier  ::=  SEQUENCE  {
    algorithm   OBJECT IDENTIFIER,
    parameters  NULL // required
}

对于 algorithm，常见的算法有这些：

1.2.840.113549.1.1.2 md2WithRSAEncryption
1.2.840.113549.1.1.4 md5WithRSAEncryption
1.2.840.113549.1.1.5 sha1WithRSAEncryption
…

Example

ASN.1 (BASE64): MA0GCSqGSIb3DQEBCwUA

SEQUENCE
    algorithm OBJECT IDENTIFIER 1.2.840.113549.1.1.11 sha256WithRSAEncryption
    paramters ANY NULL

Signature

对于 RSA 类型来说， SignatureValue 结构的内容就是 RSA 签名的内容，编码为 BitString 即可。

Example

ASN.1 (BASE64): A4IBAQBeeymPAzRcjSipAQOQ4aGsEs3STxudsZqiT6LjH4xAvaTeEz-2ZHu4Uhe7rLUReljQM76yCIu3zzX9sz7iDDimesJvVS_UB2ZW1Gnecz7NBXm2nALFKlq5Tsx4oboP9DM6mleDE1odyW131_ZXbJckgTEgK9oGVy7XcHr7G1YvvhCubDTKAKLpbpie6AvJLh3EEoIURPF6ZoEd_y4GGwG3NFm-fP9EXYpQwyhxA0XLRBVL_JJzEbxQC1bu3nstfkXelQcYfk0z1VeSttEAnvxD6jHFFfyJ3HkjXXKMkdfb8wqW31rnzE4t0AER5R-SVHNNXxOs9P0FDw7AgjTdWtgu

BIT STRING (2048 bit) 0101111001111011001010011000111100000011001…

Example Certificate

ref: https://datatracker.ietf.org/doc/html/rfc3279#section-2.2.1

RSASSA-PSS

Algorithm Identifier

当使用 RSASSA-PSS 作为 Algorithmidentifier 时， parameter 字段的结构应该为 RSASSA-PSS-Params.

RSASSA-PSS-params  ::=  SEQUENCE  {
         hashAlgorithm      [0] HashAlgorithm DEFAULT
                                   sha1Identifier,
         maskGenAlgorithm   [1] MaskGenAlgorithm DEFAULT
                                   mgf1SHA1Identifier,
         saltLength         [2] INTEGER DEFAULT 20,
         trailerField       [3] INTEGER DEFAULT 1  
}

Example

ASN.1 (BASE64):MD0GCSqGSIb3DQEBCjAwoA0wCwYJYIZIAWUDBAIDoRowGAYJKoZIhvcNAQEIMAsGCWCGSAFlAwQCA6IDAgFA

SEQUENCE (2 elem)
  OBJECT IDENTIFIER 1.2.840.113549.1.1.10 rsaPSS (PKCS #1)
  SEQUENCE (3 elem)
    [0] (1 elem)
      SEQUENCE (1 elem)
        OBJECT IDENTIFIER 2.16.840.1.101.3.4.2.3 sha-512 (NIST Algorithm)
    [1] (1 elem)
      SEQUENCE (2 elem)
        OBJECT IDENTIFIER 1.2.840.113549.1.1.8 pkcs1-MGF (PKCS #1)
        SEQUENCE (1 elem)
          OBJECT IDENTIFIER 2.16.840.1.101.3.4.2.3 sha-512 (NIST Algorithm)
    [2] (1 elem)
      INTEGER 64

Signature

它的结构和普通的 RSA 签名结构相同。

Example

ASN.1 (BASE64): A4ICAQBtN9GtaVt2XuYNpXNsTXA8m0VDXAgnurc8wWC2dnuIjOTJsE421Cn5i6ycLByzjecws3DamUL_b7m0xCfgYXj-J_Cktob4UmLMXqskAp_jQsKLp4b7B8PR_HRfslrEjfJbTBd932DUXSOWWJztqAhnKkW-9TJytpZFTl8kmGDC4tD-vtDaLQr5S7DNLbh-dGobg2ZP9QPnVXAE8C1geC1bx95T-hQAwozCe0atpYBsyetAQBP1bgIthZktVxTiTlx8VLBPWrsDrZYNJFISOdqIa0OiqCbJQdGXv79ooTI7tsGPvOVc-XCgLfK2UWXLyYPCDewBTsKA75adv3oxewl7iAH-ga2nCv4VbFTFVWnnn-BcLVwa7SJWT0KDI9-vWVQZz6dG-c8ImHlQY5EMmYwV0zcBEC2UHPHzTePRkVSVfxRo53eV0erps_hgYylz3LqTylV9qqFObb4jq_dMWB2EwKN5hSfvR63lVtlEZfxkif8DdiLJPUSZQ8Fak6aPDaET77rTH0clJMP8tve4hnUbM5j3zIzUFfbujYb_uws13ERyrESvyzTdRfI7TJBaO2AlC2COVCvbLWhPxfiCntOHgXaOA-2yCIG_s0O0YYE70HVrTbuHKdTqcfsiQx2P-5PMl7V-QOV3FrmkC5-L3Me5UrPWLMGOPffJDJYj7Vn6QA

BIT STRING (4096 bit) 0110110100110111110100011010101111011100…

Example Certificate

ref: https://datatracker.ietf.org/doc/html/rfc4055#section-3.1

DSA

Algorithm Identifier

AlgorithmIdentifier  ::=  SEQUENCE  {
    algorithm   OBJECT IDENTIFIER
}

省略掉 parameters 字段

常见算法有： 1.2.840.10040.4.3 dsaWithSha1

Example

ASN.1 (BASE64): MAkGByqGSM44BAM

SEQUENCE
    algorithm OBJECT IDENTIFIER  1.2.840.10040.4.3  dsaWithSha1

Signature

Dss-Sig-Value  ::=  SEQUENCE  {
    r       INTEGER,
    s       INTEGER  
}

Example

ASN.1 (BASE64): AzAAMC0CFGgHwZmv-fAEoI1dhPH4ovDYY434AhUA1bz0wEtsVLpcHuh5M-A-pYTHQzA

BIT STRING (1 elem)
  SEQUENCE (2 elem)
    INTEGER (159 bit) 593908010350368642838466899667916731408548335096
    INTEGER (160 bit) 1220228895115037960364580494953750520568947884848

Example Certificate

ref: https://datatracker.ietf.org/doc/html/rfc3279#section-2.2.2

ECDSA

Algorithm Identifier

AlgorithmIdentifier  ::=  SEQUENCE  {
    algorithm   OBJECT IDENTIFIER
}

省略掉 parameters 字段

常见算法有：

1.2.840.10040.4.1 ecdsaWithSha1
1.2.840.10045.4.3.3 ecdsaWithSHA384

Example

ASN.1 (BASE64): MAoGCCqGSM49BAMD

SEQUENCE
    algorithm OBJECT IDENTIFIER 1.2.840.10045.4.3.3 ecdsaWithSHA384

Signature

 Ecdsa-Sig-Value  ::=  SEQUENCE  {
           r     INTEGER,
           s     INTEGER 
 }

Example

ASN.1 (BASE64): 
A2cAMGQCMCaTuLznCDlujR0XoRtMHMQriKsU_WoipGZEXz47DRQYuLA3E5giRdP7hjazg2Fw9wIwM87d54YtOQz9KtQMlDfoB0sRBRmm_Gq_R5XLNUV9qzo5ADn9JQ7L9lo9nie3-4DS

BIT STRING (1 elem)
  SEQUENCE (2 elem)
    INTEGER (382 bit) 59375495140776878538713805206…
    INTEGER (382 bit) 797399231549498092203024…

ref: https://datatracker.ietf.org/doc/html/rfc3279#section-2.2.3

Example Certificate

VFSSoft

关注

5
点赞
踩
9

收藏

觉得还不错? 一键收藏
打赏
0
评论
ASN.1 签名结构

当使用 RSASSA-PSS 作为 Algorithmidentifier 时， parameter 字段的结构应该为 RSASSA-PSS-Params.对于 RSA 类型来说， SignatureValue 结构的内容就是 RSA 签名的内容，编码为 BitString 即可。常见算法有： 1.2.840.10040.4.3 dsaWithSha1。它的结构和普通的 RSA 签名结构相同。省略掉 parameters 字段。省略掉 parameters 字段。
复制链接

扫一扫