Problem - Kevin Tafuro

ture is valid. A successful check would demonstrate both that the data was not modified
from the time it was signed (message integrity) and that the entity with the
corresponding public key signed the data (authentication).
Solution
Use the verification algorithm that corresponds to the chosen signing algorithm from
Recipe 7.12. Generally, this should be included with your cryptographic library.
Discussion
Recipe 7.12 explains the basic components of digital signatures with RSA. When verifying,
you will generally need to provide the following inputs:
• The signer’s public key.
• The signature to be verified.
• The message digest corresponding to the message you want to authenticate. If
it’s a high-level API, you might be able to provide only the message.
• An indication of the message digest algorithm used in the signing operation.
Again, this may be assumed in a high-level API.
The API should simply return indication of success or failure.
Some implementations of RSA signature verification are susceptible to timing
attacks. Basically, if RSA private key operations do not happen in a fixed amount of
time, such attacks are possible. A technique called blinding can thwart timing
attacks. The amount of time it takes to decrypt is randomized somewhat by operating
on a random number in the process. To eliminate the possibility of such attacks,
you should always turn blinding on before doing a signature validation operation.
With OpenSSL, blinding can be enabled with by calling RSA_blinding_on( ), which
has the following signature:
int RSA_blinding_on(RSA *r, BN_CTX *x);
This function has the following arguments:
r
RSA object for which blinding should be enabled.
x
BN_CTX object that will be used by the blinding operations as scratch space. (See
Recipe 7.4 for a discussion of BN_CTX objects.) It may be specified as NULL, in
which case a new one will be allocated and used internally.
The OpenSSLanalog to RSA_sign( ) (discussed in Recipe 7.12) is RSA_verify( ),
which has the following signature:
int RSA_verify(int md_type, unsigned char *dgst, unsigned int dlen,
unsigned char *sig, unsigned int siglen, RSA *r);
Verifying Signed Data Using an RSA Public Key | 341
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.