Petar Popara wrote:
I have found this example of PK11_PubEncryptRaw usage: http://www.mozilla.org/projects/security/pki/nss/sample-code/sample4.htmlUnfortunately this isn't documented very well.... (something I should work on in my 'copious spare time').
but it doesn't do any padding, because input length is equal to public key length. Any examples of PKCS#1 padding?
_______________________________________________
mozilla-crypto mailing list
[email protected]
http://mail.mozilla.org/listinfo/mozilla-crypto
As a general principle, you should use the highest layer of NSS you can possibly use for whatever function you are trying to accomplish.
For instance, if you want to create a secure connection between two processes, you should use SSL. If you need store and forward encrypted data, you should use S/MIME. The former is very well documented. The latter needs to be.
If you just need signing, you can use the SGN_ functions in cryptohi.h.
If you need to interoperate with a protocol that isn't natively implemented, then you will need to use the PK11_ functions.
This API pretty much consists of what was needed to implement SSL & S/MIME, plus a few enhancements over the years to support JSS. When using the PK11 interfaces, the same principal applies... use the 'highest available function'.
If you are really trying to send a key, you should use PK11_PubWrapSymKey(). For a lowlevel Signature, PK11_Sign().
Both of these functions does the PCKS #1 wrapping of the data, PK11_Sign does not do the BER encoding of the hash (as is done in SGN_ functions).
If you are either trying to just send data, use PK11_PubEncryptPKCS1.
The 'lecture' was triggered because 1) we don't communicate this quite as often as we need to, and 2) PK11_PubEncryptRaw is the lowest level function.
PK11_PubEncryptRaw takes a modulus size data and does a raw RSA operation on the data. It's used to support SSL2 which modifies the key encoding to include the SSL version number.
So one may ask why you didn't see PK11_PubEncryptPKCS1? As we said the API has 'evolved'. SSL and S/MIME always dealt with keys, so they always used PK11_PubWrapSymKey(), so PK11_PubEncryptPKCS1 didn't exist until NSS 3.9.3.
bob
smime.p7s
Description: S/MIME Cryptographic Signature
