view Side-By-Side changes
Date: Tue, 09 Apr 2002 06:21:05 GMT Server: Apache/1.3.20 (Unix) Last-Modified: Tue, 05 Oct 1999 07:33:00 GMT ETag: "304bfb-ade2-37f9a9ac" Accept-Ranges: bytes Content-Length: 44514 Connection: close Content-Type: text/plain Internet Draft Hemma Prafullchandra (XETI) Expires in 6 months Jim Schaad (Microsoft)August 12,October 1, 1999 Diffie-Hellman Proof-of-Possession Algorithms<draft-ietf-pkix-dhpop-01.txt><draft-ietf-pkix-dhpop-02.txt> Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups MAY also distribute working documents as Internet-Drafts. Internet-Drafts are draft documents valid for a maximum of six months and MAY be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. To learn the current status of any Internet-Draft, please check the "1id-abstracts.txt" listing contained in the Internet-Drafts Shadow Directories on ftp.is.co.za (Africa), nic.nordu.net (Europe), munari.oz.au Pacific Rim), ds.internic.net (US East Coast), or ftp.isi.edu (US West Coast). Abstract This document describes two methods for producing a signature from a Diffie-Hellman key pair. This behavior is needed for such operations as creating a signature of a PKCS #10 certification request. These algorithms are designed to provide a proof-of- possession rather than general purpose signing. 1. Introduction PKCS #10 [RFC2314] defines a syntax for certification requests. It assumes that the public key being requested for certification corresponds to an algorithm that is capable of signing/encrypting. Diffie-Hellman (DH) is a key agreement algorithm and as such cannot be directly used for signing or encryption. This document describes two new signing algorithms using the Diffie- Hellman key agreement process to provide a shared secret as the basis of the signature. In the first signature algorithm, the signature is constructed for a specific recipient/verifier by using a public key of that verifier. In the second signature algorithm, the signature is constructed for arbitrary verifiers. This is done by creating an appropriate D-H key pair and encoding them as part of the signature value. Prafullchandra, Schaad 1 Internet Draft August 1999 2. Terminology The following definitions will be used in this document DH certificate = a certificate whose SubjectPublicKey is a DH public value and is signed with any signature algorithm (e.g. rsa or dsa). 3. DH Signature Process The steps for creating a DH signature are: 1. An entity (E) chooses the group parameters for a DH key agreement. In many cases this is done simply by selecting the group parameters from a certificate for the recipient of the signature process (static DH signatures) but they may be computed for other methods (ephemeral DH signatures). In the ephemeral DH signature scheme, a temporary DH key-pair is generated using the group parameters, which may be computed or acquired by some out-of-band means. In the static DH signature scheme, a certificate with the correct group parameters has to be available. Let these common DH parameters be g and p; and let this DH key-pair be known as the Recipient key pair (Rpub and Rpriv). Rpub = g^x mod p (where x=Rpriv, the private DH value and ^ denotes exponentiation) 2. The entity generates a DH public/private key-pair using the parameters from step 1. For an entity E: Epriv = DH private value = y Epub = DH public value = g^y mod p 3. The signature computation process will then consist of: a) The value to be signed is obtained. (For a RFC2314 object, the value is the DER encoded certificationRequestInfo field represented as an octet string.) This will be the `text' referred to in [RFC2104], the data to which HMAC-SHA1 is applied. b) A shared DH secret is computed, as follows, shared secret = ZZ = g^xy mod p [This is done by the entity E as g^(y.Rpub) and by the Recipient as g^(x.Epub), where Rpub is retrieved from the Recipient's DH certificate (or is the one that was locally Prafullchandra, Schaad 2 Internet Draft August 1999 generated by the Entity) and Epub is retrieved from the actual certification request. ] c) A temporary key K is derived from the shared secret ZZ as follows: K = SHA1(LeadingInfo | ZZ | TrailingInfo), where "|" means concatenation. d) Compute HMAC-SHA1 over the data `text' as per [RFC2104] as: SHA1(K XOR opad, SHA1(K XOR ipad, text)) where, opad (outer pad) = the byte 0x36 repeated 64 times and ipad (inner pad) = the byte 0x5C repeated 64 times. Namely, (1) Append zeros to the end of K to create a 64 byte string (e.g., if K is of length 16 bytes it will be appended with 48 zero bytes 0x00). (2) XOR (bitwise exclusive-OR) the 64 byte string computed in step (1) with ipad. (3) Append the data stream `text' to the 64 byte string resulting from step (2). (4) Apply SHA1 to the stream generated in step (3). (5) XOR (bitwise exclusive-OR) the 64 byte string computed in step (1) with opad. (6) Append the SHA1 result from step (4) to the 64 byte string resulting from step (5). (7) Apply SHA1 to the stream generated in step (6) and output the result. Sample code is also provided in [RFC2104]. e) The output of (d) is encoded as a BIT STRING (the Signature value). The signature verification process requires the Recipient to carry out steps (a) through (d) and then simply compare the result of step (d) with what it received as the signature component. If they match then the following can be concluded: a) The Entity possesses the private key corresponding to the public key in the certification request because it needed the private key to calculate the shared secret; and b) For the static signature scheme, that only the Recipient that the entity sent the request to could actually verify the request because they would require their own private key to compute the same shared secret. In the case where the recipient is a Certification Authority, this protects the Entity from rogue CAs. 4. Static DH Signature Prafullchandra, Schaad 3 Internet Draft August 1999 In the static DH Signature scheme, the public key used in the key agreement process of step 2 is obtained from the entity that will be verifying the signature (i.e. the recipient). In the case of a certification request, the public key would normally be extracted from a certificate issued to the CA with the appropriate key parameters. The values used in step 3c for "LeadingInfo" and the "TrailingInfo" are: LeadingInfo ::= Subject Distinguished Name from certificate TrailingInfo ::= Issuer Distinguished Name from certificate The ASN.1 structures associated with the static Diffie-Hellman signature algorithms are: id-dhPop-static-HMAC-SHA1 OBJECT IDENTIFIER ::= { id-pkix id-alg(6) 3} DhPopStatic ::= SEQUENCE { issuerAndSerial IssuerAndSerialNumber OPTIONAL, hashValue MessageDigest } issuerAndSerial is the issuer name and serial number of the certificate from which the public key was obtained. The issuerAndSerial field is omitted if the public key did not come from a certificate. hashValue contains the result of the SHA-1 HMAC operation in step 3d. DhPopStatic is encoded as a BIT STRING and is the signature value (i.e. encodes the above sequence instead of the raw output from 3d). 5. Discrete Logarithm Signature The use of a single set of parameters for an entire public key infrastructure allows all keys in the group to be attacked together. For this reason we need to create a proof of possession for Diffie- Hellman keys that does not require the use of a common set of parameters. The method outlined in this document is the same as used by the Digital Signature Algorithm, but we have removed the restrictions imposed by the [FIPS-186] standard. The use of this method does impose some additional restrictions on the set of keys that may be used, however if the key generation algorithm documented in [DH- X9.42] is used the required restrictions are met. The additional restrictions are the requirement for the existence of a q parameter. Adding the q parameter is generally accepted as a good practice as it allows for checking of small group attacks. Prafullchandra, Schaad 4 Internet Draft August 1999 The following definitions are used in the rest of this section: p is a large prime g = h(p-1)/q mod p , where h is any integer 1 < h < p-1 such that h(p-1) mod q > 1 (g has order q mod p) q is a large prime j is a large integer such that p = qj + 1 x is a randomly or pseudo-randomly generated integer with 1 < x < q y = g^x mod p Note: These definitions match the ones in [DH-X9.42]. 5.1 Expanding the Digest Value Besides the addition of a q parameter, [FIPS-186] also imposes size restrictions on the parameters. The length of q must be 160-bits (matching output of the SHA-1 digest algorithm) and length of p must be 1024-bits. The size restriction on p is eliminated in this document, but the size restriction on q is replaced with the requirement that q must be at least 160-bits. (The size restriction on q is identical with that in [DH-X9.42].) Given that there is not a random length-hashing algorithm, a hash value of the message will need to be derived such that the hash is in the range from 0 to q-1. If the length of q is greater than 160- bits then a method must be provided to expand the hash length. The method for expanding the digest value used in this section does not add any additional security beyond the 160-bits provided by SHA. The value being signed is increased mainly to enhance the difficulty of reversing the signature process. This algorithm produces m the value to be signed. Let L = the size of q (i.e. 2^L <= q < 2^(L+1)). Let M be the original message to be signed. 1. Compute d = SHA-1(M), the SHA-1 digest of the original message. 2. If L == 160 then m = d. 3. If L @ 160 then follow steps (a) through (d) below. a) Set n = L / 160, where / represents integer division, consequently, if L = 200, n = 1. b) Set m = d, the initial computed digest value. c) For i = 0 to n - 1 m = m | SHA(m), where "|" means concatenation. d) m = LEFTMOST(m, L-1), where LEFTMOST returns the L-1 left most bits of m. Prafullchandra, Schaad 5 Internet Draft August 1999 Thus the final result of the process meets the criteria that 0 <= m < q. 5.2 Signature Computation Algorithm The signature algorithm produces the pair of values (r, s), which is the signature. The signature is computed as follows: Given m, the value to be signed, as well as the parameters defined earlier in section 5. 1. Generate a random or pseudorandom integer k, such that 0 < k^-1 < q. 2. Compute r = (g^k mod p) mod q. 3. If r is zero, repeat from step 1. 4. Compute s = (k^-1 (m + xr)) mod q. 5. If s is zero, repeat from step 1. 5.3 Signature Verification Algorithm The signature verification process is far more complicated than is normal for the Digital Signature Algorithm, as some assumptions about the validity of parameters cannot be taken for granted. Given a message m to be validated, the signature value pair (r, s) and the parameters for the key. 1. Perform a strong verification that p is a prime number. 2. Perform a strong verification that q is a prime number. 3. Verify that q is a factor of p-1, if any of the above checks fail then the signature cannot be verified and must be considered a failure. 4. Verify that r and s are in the range [1, q-1]. 5. Compute w = (s^-1) mod q. 6. Compute u1 = m*w mod q. 7. Compute u2 = r*w mod q. 8. Compute v = ((g^u1 * y^u2) mod p) mod q. 9. Compare v and r, if they are the same then the signature verified correctly. 5.4 ASN Encoding Prafullchandra, Schaad 6 Internet Draft August 1999 The signature is encoded using id-alg-dhPOP OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4} The parameters for id-alg-dhPOP are encoded as DomainParameters (imported from [PROFILE]). The parameters may be omitted in the signature, as they must exist in the associated key request. The signature value pair r and s are encoded using Dss-Sig-Value (imported from [PROFILE]). 5. Security Considerations All the security in this system is provided by the secrecy of the private keying material. If either sender or recipient private keys are disclosed, all messages sent or received using that key are compromised. Similarly, loss of the private key results in an inability to read messages sent using that key. Selection of parameters can be of paramount importance. In the selection of parameters one must take into account the community/ group of entities that one wishes to be able to communicate with. In choosing a set of parameters one must also be sure to avoid small groups. [FIPS-186] Appendixes 2 and 3 contain information on the selection of parameters. The practices outlined in this document will lead to better selection of parameters. 6. References [FIPS-186] Federal Information Processing Standards Publication (FIPS PUB) 186, "Digital Signature Standard", 1994 May 19. [RFC2314] B. Kaliski, "PKCS #10: Certification Request Syntax v1.5", RFC 2314, October 1997 [RFC2104] H. Krawczyk, M. Bellare, R. Canetti, "HMAC: Keyed- Hashing for Message Authentication", RFC 2104, February 1997. [PROFILE] R. Housley, W. Ford, W. Polk, D. Solo, "Internet X.509 Public Key Infrastructure: Certificate and CRL Profile", RFC 2459, January 1999. [DH-X9.42] E. Rescorla, "Diffie-Hellman Key Agreement Method". RFC 2631, June 1999. 7. Author's Addresses Hemma Prafullchandra XETI Inc. 5150 El Camino Real, #A-32 Los Altos, CA 94022 Prafullchandra, Schaad 7 Internet Draft August 1999 (640) 694-6812 hemma@xeti.com Jim Schaad Microsoft Corporation One Microsoft Way Redmond, WA 98052-6399 (425) 936-3101 jimsch@microsoft.com Prafullchandra, Schaad 8 Internet Draft August 1999 Appendix A. ASN.1 Module DH-Sign DEFINITIONS IMPLICIT TAGS ::= BEGIN --EXPORTS ALL -- The types and values defined in this module are exported for use in -- the other ASN.1 modules. Other applications may use them for their -- own purposes. IMPORTS IssuerAndSerialNumber, MessageDigest FROM CryptographicMessageSyntax { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) modules(0) cms(1) } Dss-Sig-Value, DomainParameters FROM PKIX1Explicit88 {iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-88(1)}; id-dh-sig-hmac-sha1 OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 3} DhSigStatic ::= SEQUENCE { IssuerAndSerial IssuerAndSerialNumber OPTIONAL, hashValue MessageDigest } id-alg-dh-pop OBJECT IDENTIFIER ::= {id-pkix id-alg(6) 4} END Prafullchandra, Schaad 9 Internet Draft August 1999 Appendix B. Example of Static DH Signature The following example follows the steps described earlier in section 3. Step 1: Establishing common Diffie-Hellman parameters. Assume the parameters are as in the DER encoded certificate. The certificate contains a DH public key signed by a CA with a DSA signing key. 0 30792:939: SEQUENCE { 4 30725:872: SEQUENCE { 8 A0 3:[CONTEXT-SPECIFIC 0][0] { 10202 1: INTEGER 2 : } 13202 6: INTEGER : 00D9 AD EE 9C FCDA 39 B6 E2 CB 21 30 11: SEQUENCE { 23606 7: OBJECT IDENTIFIER'1dsaWithSha1 (1 2 840 10040 43'3) 32505 0: NULL : } 34 30 72: SEQUENCE { 36 31 11: SET { 38 30 9: SEQUENCE { 40606 3: OBJECT IDENTIFIER countryName (2 5 4 6) 45 13 2: PrintableString 'US' : } : } 49 31 17: SET { 51 30 15: SEQUENCE { 53606 3: OBJECT IDENTIFIER organizationName (2 5 4 10) 58 13 8: PrintableString 'XETI Inc' : } : } 68 3112:16: SET { 70 3010:14: SEQUENCE { 72606 3: OBJECT IDENTIFIER organizationalUnitName (2 5 4 11) 77 133:7: PrintableString'JSD''Testing' : } : }8286 3124:20: SET {8488 3022:18: SEQUENCE {86 690 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)9195 1315:11: PrintableString 'Root DSATestCA'CA' : } : } : }Prafullchandra, Schaad 10 Internet Draft August 1999108 30 30: SEQUENCE { 110 17 13: UTCTime'990817213959Z''990914010557Z' 125 17 13: UTCTime'000816213959Z''991113010557Z' : } 140 3082:70: SEQUENCE { 142 31 11: SET { Prafullchandra, Schaad 10 Internet Draft August 1999 144 30 9: SEQUENCE { 146606 3: OBJECT IDENTIFIER countryName (2 5 4 6) 151 13 2: PrintableString 'US' : } : } 155 31 17: SET { 157 30 15: SEQUENCE { 159606 3: OBJECT IDENTIFIER organizationName (2 5 4 10) 164 13 8: PrintableString 'XETI Inc' : } : } 174 3112:16: SET { 176 3010:14: SEQUENCE { 178606 3: OBJECT IDENTIFIER organizationalUnitName (2 5 4 11) 183 133:7: PrintableString'JSD''Testing' : } : }188192 3134:18: SET {190194 3032:16: SEQUENCE {192 6196 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)197201 1325:9: PrintableString'JKIX DiffieHellman'DH TestCA' : } : } : }224212 30421:577: SEQUENCE {228216 30282:438: SEQUENCE {232 6 9:220 06 7: OBJECT IDENTIFIERdhKeyAgreementdhPublicKey (1 2 840113549 1 310046 2 1)243229 30267:425: SEQUENCE {247 2233 02 129: INTEGER : 0088 E1 F2 64 6D 5D F2 97 5E 86 00 DF BD 1F B894 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 :E1 07 B5 27 42 C1 6A 02C526A9 9E 9E 74F0 A6 53 BF74 94 ED 90 8C 1D C4 E1 4A 14 82 :58 1C B6 77 C0 59 6B 3EF5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5E8 7C 64 25 0E B3 FCFB 8E 21 :29 EE C4 1A 93 F3 48 76 7B C5 DA F7 E551 63 0229 11 : E8 83 AD A6 A0 AE A4 EA 0F 3A EB 3A 35 67 62 30 :86 AA 06 B8 21 36 B6 7FEE 22 55 18 41 1F 28 25 8D 87 1536 DF D1 D6 684B C4 BC:B7 15 1C 4E 78 11 D8 30 2B 0B 54 47 18 1F AA 4E : DC 65 FE FB 21 A6 2F 94 03 EA B6 13 82 A5 22 07 : C9 379 2 128: INTEGER Prafullchandra, Schaad 11 Internet Draft August 1999 : 38 7B DB FC 78 24 71 C9 2E 04 BA 71 67 07 8B 29 : BA5B 79 7CE0 2E 66 C9 CB1D 5A20 51 01 17 0B D3 E8 4A14 75 1F 6A 93 75 93 CE BB 97 72 :2B 00 DA 8D8A F0 0F 23 9D 47 F6 D4 B3 C7A1 E3 90 A4 86 3CF0 F4 E6 F6E5 5E 0B 6C : 49 6A2B C29B A5 A8 21 4E 08 01 21 3C B2 70 FD C1:0E 94 0D 66 83 0C 7732 E1 89 67 BE 7E62 29 16 82 C7 77 F5 6D : 2E 0B 70 D5 52 E5 3A 66 B706 AE F8 D06A AA 2101 6B 8B 2AC4 23F5 02 :A5D7 B6 A8 63 94 83 B0 1B 31 7D 525D D9 D4 D3 EC 9B FE C1 36 90 E7 35 11 0E1A DE E5 03 85 :A7 02 ED CC B4 F2 98 3D 3B BC 30 4427BF D8 52 510 2 2:365 02 128: INTEGER256 : } : } 514 3 132: BIT STRING 0 unused bits:02 81 80 51 7C DA 1D AB 7826 A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 533A 0E E9 D3 D2 8F3F 90 :50 1F 13 B0 C7 14 DA 5C E3 46 7F 3C 67 D5 BA 52 : 1D 11 91 26 9B 8D 5A06 61 50 38 3E D2 B9 7D 81 1C 1282 B1 9A 09 C9 14 4B 9B : 03 EE A010A2 5B 74 FC C6 51 43 77C5 0CF6 6D 21 : 67 72 5D 37 BD 3B 69 FB 1F 80 B0 E3 10 AB 8B 1953 D4 :7B 62 C664 D1 8E 30 07 0820 FD 978C DD 3F 0A 2F9A2C D616 CC 29 D4 391B 7F 57 : 86 D0 DA BB 6E 36 2A 18 E8 D3 BC 70 31 7A 48 B6 :E3 B5 5B C1 8F 4D F3 CE 47 2E A1 43 A1 39 6D E74E 18 6E DD 1F 22 06 EB 3F EA D4 41 69 D9 9B DE : 47 95 7A 72B791 D2 09 7F 49 5C 3B 03 33 51 C8 F1 : 39 9A FF 04 D5 6E 7EB5 9D 32 78 F4 2694 3DC2 E1 C8 B3 5603 B8 F6 31 15 26 48 : 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD 496 02 33: INTEGER :7900 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 : B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60D130 :} 649FB 531 02 97: INTEGER : 00 A382: [CONTEXT-SPECIFIC 3] { 651 30 80: SEQUENCE { 653 30 29: SEQUENCE { 655 6 3: OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29 14) 660 4 22: OCTET STRING91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7 Prafullchandra, Schaad 11 Internet Draft August 1999 :04 14 81 B3 74 2E F3 40 F4 71 A9 7A FA FF 5A 99B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D :E8 6A 70AB 83 CD 80 0B 35 67 7F 0C 8E02 D6A7 31 98 32 85 39 :} 684 30 31: SEQUENCE { 686 6 3: OBJECT IDENTIFIER authorityKeyIdentifier (2 5 29 35) 691 4 24: OCTET STRING40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 :30 16 80 14 62 D9B4 61 2F 21FE E9 78 ED CA 33 06 A0 52E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 :A368 477B 8C D1DC F7 20 63 4B 3C 5F 78E9 3571 83 E6 70 9E E2 :} 71792 630 3014:26: SEQUENCE {719 6 3: OBJECT IDENTIFIER keyUsage (2 5 29 15) 724 1 1: BOOLEAN TRUE 727 4 4: OCTET632 03 21: BIT STRING 0 unused bits :031C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB : 09 E4 98 34 655 0201 061: INTEGER 55 : } : } : } 658 03 132: BIT STRING 0 unused bits :} Prafullchandra, Schaad 12 Internet Draft August 1999 733 30 11: SEQUENCE { 735 6 7: OBJECT IDENTIFIER '1 2 840 10040 4 3' 744 502 81 80 5F CF 39 AD 62 CF 49 8E D1 CE 66 E2 B1 : E6 A7 01 4D 05 C2 77 C8 92 52 42 A9 05 A4 DB E0 : 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69 : B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22 : 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF : D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21 : E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 : 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 : 8F C5 1A : } 793 A3 85: [3] { 795 30 83: SEQUENCE { 797 30 29: SEQUENCE { 799 06 3: OBJECT IDENTIFIER subjectKeyIdentifier (2 5 29 14) 804 04 22: OCTET STRING : 04 14 80 DF 59 88 BF EB 17 E1 AD 5E C6 40 A3 42 : E5 AC D3 B4 88 78 : } 828 30 34: SEQUENCE { 830 06 3: OBJECT IDENTIFIER authorityKeyIdentifier (2 5 29 35) 835 01 1: BOOLEAN TRUE 838 04 24: OCTET STRING : 30 16 80 14 6A 23 37 55 B9 FD 81 EA E8 4E D3 C9 : B7 09 E5 7B 06 E3 68 AA : } 864 30 14: SEQUENCE { 866 06 3: OBJECT IDENTIFIER keyUsage (2 5 29 15) 871 01 1: BOOLEAN TRUE 874 04 4: OCTET STRING : 03 02 03 08 : } : } : } : } 880 30 11: SEQUENCE { 882 06 7: OBJECT IDENTIFIER dsaWithSha1 (1 2 840 10040 4 3) 891 05 0: NULL Prafullchandra, Schaad 12 Internet Draft August 1999 : }746 3893 03 48: BIT STRING 0 unused bits : 30 2D 0215 00 85 21 8B 45 F0 EC 4A 5F 45 5A 0C : C0 C5 A7 1A 2B B8 AB 5C 7814 7C 6D D2 CA 1E 32 D1 30 2E 29 66 BC : 06 8B 60 C7 61 16 3B CA 0214 4015 00 8A 18 DD C1E9 A5 8683 :6E 61 51 0E FB 5D E0 9C 75 66 CD CF AE FD B258 29 A2 8A 67 64 03 92 AB 02 CE 00 B5 94 6A : } Step 2. End Entity/User generates a Diffie-Hellman key-pair using the parameters from the CA certificate. EE DH public key: SunJCE Diffie-Hellman Public Key:y: 07a52fbf b2e5d03a e60b0de4 6f60b9c0 123d4572 7752c36e e498652a b39b0923 f5332495 8b5b007d 79b6690c 93625288 d92d9db0 f60f2325 659a5d58 945c9757 da92af59 794514b4 a03b5cda 8c288b18 0447c7aa 3724cffd 3f51f2a8 abe3453a c64ca006 8194f868 4be5d008 06b34bbc 8dd6afe6 89ec5735 821ff9ed 4eccd34a p: 88e1f264 6d5df297 5e8600df bd1fb8e1 07b52742 c16a02c5 2674f0a6 53bf8c58 1cb677c0 596b3ea5 e87c6425 0eb3fc29 eec41a93 f348767b c5daf7e5 022911e8 83ada6a0 aea4ea0f 3aeb3a35 6762307f ee225518 411f2825 8d871568 4bc4bcb7 151c4e78 11d8302b 0b544718 1faa4edc 65fefb21 a62f9403 eab61382 a52207c9 g: 387bdbfc 782471c9 2e04ba71 67078b29 ba7ce02e 66c9cb5a 20510117 0bd3e84a 2b00da8d c7a1e390 a4863cf6 e55e0b6c 496ac29b a5a8214e 0801213c b270fdc1 0e940d66 830c777e 62291682 c777f56d 2e0b70d5 52e53a66 b7d06aaa 212ac423 a5525dd9 d4d3ec9b fec13690 e735110e a702edcc b4f2983d 3bbc3044 27bfd852 l: 256Y: 13 63 A1 85 04 8C 46 A8 88 EB F4 5E A8 93 74 AE FD AE 9E 96 27 12 65 C4 4C 07 06 3E 18 FE 94 B8 A8 79 48 BD 2E 34 B6 47 CA 04 30 A1 EC 33 FD 1A 0B 2D 9E 50 C9 78 0F AE 6A EC B5 6B 6A BE B2 5C DA B2 9F 78 2C B9 77 E2 79 2B 25 BF 2E 0B 59 4A 93 4B F8 B3 EC 81 34 AE 97 47 52 E0 A8 29 98 EC D1 B0 CA 2B 6F 7A 8B DB 4E 8D A5 15 7E 7E AF 33 62 09 9E 0F 11 44 8C C1 8D A2 11 9E 53 EF B2 E8 EE DH private key:SunJCE Diffie-Hellman Private Key: Prafullchandra, Schaad 13 Internet Draft August 1999 x: a41aa1b0 a8b60012 b296d9e4 fa280942 b20b226f 29140796 ffb095e1 bfd6e269 p: 88e1f264 6d5df297 5e8600df bd1fb8e1 07b52742 c16a02c5 2674f0a6 53bf8c58 1cb677c0 596b3ea5 e87c6425 0eb3fc29 eec41a93 f348767b c5daf7e5 022911e8 83ada6a0 aea4ea0f 3aeb3a35 6762307f ee225518 411f2825 8d871568 4bc4bcb7 151c4e78 11d8302b 0b544718 1faa4edc 65fefb21 a62f9403 eab61382 a52207c9 g: 387bdbfc 782471c9 2e04ba71 67078b29 ba7ce02e 66c9cb5a 20510117 0bd3e84a 2b00da8d c7a1e390 a4863cf6 e55e0b6c 496ac29b a5a8214e 0801213c b270fdc1 0e940d66 830c777e 62291682 c777f56d 2e0b70d5 52e53a66 b7d06aaa 212ac423 a5525dd9 d4d3ec9b fec13690 e735110e a702edcc b4f2983d 3bbc3044 27bfd852 l: 256X: 32 CC BD B4 B7 7C 44 26 BB 3C 83 42 6E 7D 1B 00 86 35 09 71 07 A0 A4 76 B8 DB 5F EC 00 CE 6F C3 Step 3. Compute K and the signature. LeadingInfo: DER encoded Subject/Requestor DN (as in the generated Certificate Signing Request) 304A4E 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49 6E 63 310C10 300A0E 06 03 55 04 0B 1303 4A 53 4407 54 65 73 74 69 6E 67 31 1A 30 18 06 03 55 04 03 13 11 50 4B 49 58 20 45 78 61 6D 70 6C 65 20 55 73 65 72 TrailingInfo: DER encoded Issuer/Recipient DN (from the certificate described in step 1) 305246 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49 6E 63 310C10 300A0E 06 03 55 040B 13 03 4A 53 440B 13 07 54 65 73 74 69 6E 67 312212 302010 06 03 55 04 03 1319 4A 4B 49 58 2009 4469 66 66 69 654865 6C 6C 6D 61 6E20 54 65 73 74 43 41Prafullchandra, Schaad 14 Internet Draft August 1999K:B4 4CF4 D7 BB 6C C7 2D 21 7F 1C 38 F7 DA 74 2D 51FF 73 00 FF 6D 7A 88 EB 45 82 42 05 34 11 F9 BE 73AD 14 40 66 75 TBS: the "text" for computing the SHA-1 HMAC. Prafullchandra, Schaad 13 Internet Draft August 1999 30 8201 F802 98 02 01 00 304A4E 31 0B 30 09 06 03 55 04 06 13 02 55 53 31 11 30 0F 06 03 55 04 0A 13 08 58 45 54 49 20 49 6E 63 310C10 300A0E 06 03 55 04 0B 1303 4A 53 4407 54 65 73 74 69 6E 67 31 1A 30 18 06 03 55 04 03 13 11 50 4B 49 58 20 45 78 61 6D 70 6C 65 20 55 73 65 72 30 8201 A502 41 30 82 011AB6 060907 2A 86 4886 F7 0D 01 03CE 3E 02 01 30 82 010BA9 02 81 81 008894 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1F2 64 6D 5D F2 97 5E4A 14 82 F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 51 63 02 8600AA 06 B8 21 36 B6 7F 36 DFBDD1 D6 68 5B 79 7C 1D 5A 14 75 1FB86A 93 75 93 CE BB 97 72 8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2 32 E107 B589 67 BE 7E 06 AE F8 D0 01 6B 8B 2A F5 02 D7 B6 A8 63 94 83 B0 1B 31 7D 52 1A DE E5 03 85 2742 C1 6A02C581 80 2674 F0A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 53BF 8C 58 1C B6 77 C0 59 6B3F 90 06 61 50 38 3EA5 E8 7C 64 25 0E B3 FC 29 EE C4 1A 93 F3 48 76 7BD2 B9 7D 81 1C 12 10 C5DA F7 E5 02 29 11 E8 83 AD A6 A0 AE A4 EA 0F 3A EB 3A 35 67 620C 53 D4 64 D1 8E 30 07 08 8C DD 3F 0A 2F 2C D6 1B 7FEE 22 5557 86 D0 DA BB 6E 36 2A 1841 1F 28 25 8D 87 15 68 4B C4E8 D3 BCB7 15 1C70 31 7A 48 B6 4E78 11 D8 30 2B 0B 54 4718 6E DD 1FAA 4E DC 65 FE FB 21 A6 2F22 06 EB 3F EA D4 41 69 D9 9B DE 47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1 39 9A FF 04 D5 6E 7E 94 3D 03EA B6 13 82 A5 22 07 C9B8 F6 31 15 26 48 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD 0281 80 38 7B DB FC 78 24 71 C9 2E 04 BA 71 67 07 8B 29 BA 7C E0 2E 66 C9 CB 5A 20 5121 00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 B1 85 0117 0B D3 E8E5 69 37 21 F7 25 B9 BA 71 4A2BFC 60 30 FB 02 61 00DA 8D C7 A1 E3 90A3 91 01 C0 A8 6E A486 3C F6 E5 5E 0B4D A0 56 FC 6C49 6A C2 9B A5 A8 21 4E 08 01 21 3C B2 70 FD C1 0EFE 1F A7 B0 CD 0F 940D 66 8387 0C77 7E 62 29 16 82 C7 77 F5 6D 2E 0B 70 D5 5225 BE 97 76 8D EB E53A 66 B7 D0 6A AA 21 2A C4 23 A5 52A4 09 5DD9 D4 D3 EC 9B FE C1 36 90 E7AB 83 CD 80 0B 3511 0E67 7F 0C 8E A702 ED CC B4 F231 98 32 85 39 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D3B BC 30 44 27 BFB6 76 B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D852 0271 56 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 92 30 1A 03 15 00 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB 09 E4 98 34 02 010037 03 81 84 00 02 81 8007 A5 2F BF B2 E5 D0 3A E6 0B 0D E4 6F 60 B9 C013 63 A1 85 04 8C 46 A8 88 EB F4 5E A8 93 74 AE FD AE 9E 96 27 123D 45 72 77 52 C3 6E E4 98652A B3 9B 09 23 F5 33 24 95 8B 5B 00 7DC4 4C 07 06 3E 18 FE 94 B8 A8 79 48 BD 2E 34 B669 0C 93 62 52 88 D947 CA 04 30 A1 EC 33 FD 1A 0B 2D9D B0 F69E 50 C9 78 0F23 25 65 9A 5D 58 94AE 6A EC B5 6B 6A BE B2 5C97 57DA92 AF 59B2 9F 78 2C B9 77 E2 7945 14 B4 A0 3B 5C DA 8C 28 8B 18 04 47 C7 AA 37 24 CF FD 3F 51 F2 A8 AB E3 45 3A C6 4C A0 06 81 94 F8 682B 25 BF 2E 0B 59 4A 93 4BE5 D0 08 06F8 B34B BC 8D D6 AF E6 89EC57 35 82 1F F9 ED81 34 AE 97 47 52 E0 A8 29 98 EC D1 B0 CA 2B 6F 7A 8B DB 4ECC D3 4A8D A5 15 7E 7E AF 33 62 09 9E 0F 11 44 8C C1 8D A2 11 9E 53 EF B2 E8 Certification Request: 0 30633:793: SEQUENCE { 4 30504:664: SEQUENCE { 8202 1: INTEGER 0 11 3074:78: SEQUENCE {Prafullchandra, Schaad 15 Internet Draft August 199913 31 11: SET { 15 30 9: SEQUENCE { 17606 3: OBJECT IDENTIFIER countryName (2 5 4 6) 22 13 2: PrintableString 'US' Prafullchandra, Schaad 14 Internet Draft August 1999 : } : } 26 31 17: SET { 28 30 15: SEQUENCE { 30606 3: OBJECT IDENTIFIER organizationName (2 5 4 10) 35 13 8: PrintableString 'XETI Inc' : } : } 45 3112:16: SET { 47 3010:14: SEQUENCE { 49606 3: OBJECT IDENTIFIER organizationalUnitName (2 5 4 11) 54 133:7: PrintableString'JSD''Testing' : } : }5963 31 26: SET {6165 30 24: SEQUENCE {63 667 06 3: OBJECT IDENTIFIER commonName (2 5 4 3)6872 13 17: PrintableString 'PKIX Example User' : } : } : }8791 30421:577: SEQUENCE {9195 30282:438: SEQUENCE {95 6 9:99 06 7: OBJECT IDENTIFIERdhKeyAgreementdhPublicKey (1 2 840113549 1 310046 2 1)106108 30267:425: SEQUENCE {110 2112 02 129: INTEGER :00 8800 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 : C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1F2 64 6D 5D F2 97 5E4A 14 82 : F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 : 51 63 02 8600AA 06 B8 21 36 B6 7F 36 DFBDD1 D6 68 : 5B 79 7C 1D 5A 14 75 1FB86A 93 75 93 CE BB 97 72 : 8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2 : 32 E107 B589 67 BE 7E 06 AE F8 D0 01 6B 8B 2A F5 02 : D7 B6 A8 63 94 83 B0 1B 31 7D 52 1A DE E5 03 85 : 2742 C1 6A244 02C5128: INTEGER : 2674 F0A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 53BF 8C3F 90 :58 1C B6 77 C0 59 6B06 61 50 38 3EA5 E8 7C 64 25 0E B3 FC : 29 EE C4 1A 93 F3 48 76 7BD2 B9 7D 81 1C 12 10 C5DA F7 E5 02 29 110C 53 D4 :E8 83 AD A6 A0 AE A4 EA 0F 3A EB 3A 35 67 6264 D1 8E 30:07 08 8C DD 3F 0A 2F 2C D6 1B 7FEE 22 55 18 41 1F 28 25 8D 87 15 68 4B C457 : 86 D0 DA BB 6E 36 2A 18 E8 D3 BC 70 31 7A 48 B6 :B7 15 1C4E78 11 D8 30 2B 0B 54 4718 6E DD 1FAA 4E22 06 EB 3F EA D4 41 69 D9 9B DE :DC 65 FE FB 21 A6 2F47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1 : 39 9A FF 04 D5 6E 7E 94 3D 03EA B6 13 82 A5 22 07B8 F6 31 15 26 48 :C9 242 2 128:95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD 375 02 33: INTEGER :38 7B DB FC00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 7824 71 C9 2E 04 BA 71 67 07 8B 2994 :BA 7C E0 2E 66 C9 CB 5A 20 51B1 85 0117 0B D3 E8E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30 : FB 410 02 97: INTEGER :2B00DA 8D C7 A1 E3 90A3 91 01 C0 A8 6E A486 3C F6 E5 5E 0B4D A0 56 FC 6C FE 1F A7 :49 6A C2 9B A5 A8 21 4E 08 01 21 3C B2 70 FD C1 : 0EB0 CD 0F 940D 6687 0C 25 BE 97 76 8D EB E5 A4 09 5D : AB 83 CD 80 0B 35 67 7F 0C77 7E 62 29 16 82 C7 77 F5 6D8E A7 31 98 32 85 39 : 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 Prafullchandra, Schaad1615 Internet Draft August 1999 :2E 0BB4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 : 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 : 92 509 30 26: SEQUENCE { 511 03 21: BIT STRING 0 unused bits : 1C D552 E53A66 B7 D0 6A AA 21 2A C4 23 : A5 52 5D D9 D4 D3 EC 9B FE C1 36 90 E7 35 11 0E0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB :A7 02 ED CC B4 F209 E4 983D 3B BC 30 44 27 BF D8 52 373 2 2:34 534 02 1: INTEGER25655 : } : }377 3: } 537 03 132: BIT STRING 0 unused bits : 02 81 8007 A5 2F BF B2 E5 D0 3A E6 0B 0D E4 6F13 63 A1 85 04 8C 46 A8 88 EB F4 5E A8 :60 B9 C093 74 AE FD AE 9E 96 27 123D 45 72 77 52 C3 6E E4 98652A B3C4 4C 07 06 3E 18 :9B 09 23 F5 33 24 95 8B 5B 00 7DFE 94 B8 A8 79 48 BD 2E 34 B669 0C 9347 CA 04 30 A1 EC :62 52 88 D933 FD 1A 0B 2D9D B0 F69E 50 C9 78 0F23 25 65 9A 5D 58 94 : 5C 97 57 DA 92 AF 59 79 45 14 B4 A0 3BAE 6A EC B5 6B 6A : BE B2 5C DA8CB2 9F 78 2C B9 77 E2 79 2B 25 BF 2E :28 8B 18 040B 59 4A 93 4B F8 B3 EC 81 34 AE 97 47C7 AA 37 24 CF FD 3F 51 F252 E0 A8AB : E3 45 3A C6 4C A0 06 81 94 F8 68 4B E5 D0 08 06:B3 4B BC 8D D6 AF E6 8929 98 EC57 35 82 1F F9 EDD1 B0 CA 2B 6F 7A 8B DB 4E 8D A5 15 7E :CC D3 4A7E AF 33 62 09 9E 0F 11 44 8C C1 8D A2 11 9E 53 : EF B2 E8 : } : }512672 30 12: SEQUENCE {514 6674 06 8: OBJECT IDENTIFIER'1dh-sig-hmac-sha1 (1 3 6 1 5 5 7 63' 524 53) 684 05 0: NULL : }526 3686 03 109: BIT STRING 0 unused bits : 30 6A 30 52 30 48 31 0B 30 09 06 03 55 04 06 13 : 02 55 53 31 11 30 0F 06 03 55 04 0A 13 08 58 45 : 54 49 20 49 6E 63 310C10 300A0E 06 03 55 04 0B 13 :03 4A 53 4407 54 65 73 74 69 6E 67 311814 301612 06 03 55 04 : 03 130F0B 52:6F 6F 74 20 44 53 41 2054 65 73 7443 41 02 06 : 00D9 AD EE 9C FCDA 39 B6 E2 CB 04 145F B4 B7 DA 2E 00 80 301B 17 AD 4E 65 86 1A 6C :C8 30 9B 5D AA 81 C3 83 6B 30 87 6B7C 85 FA F7 95 DE 48 93 C5 9D C5 24 : } Signature verification requires CA's private key, the CA certificate and the generated Certification Request. CA DH private key:SunJCE Diffie-Hellman Private Key:x:ed182221 639fce64 484ccd8b bfda23b1 b75185b9 83aba49e f43b63e8 7abecfe0 p: 88e1f264 6d5df297 5e8600df bd1fb8e1 07b52742 c16a02c5 2674f0a6 53bf8c58 1cb677c0 596b3ea5 e87c6425 0eb3fc29 eec41a93 f348767b c5daf7e5 022911e8 Prafullchandra, Schaad 17 Internet Draft August 1999 83ada6a0 aea4ea0f 3aeb3a35 6762307f ee225518 411f2825 8d871568 4bc4bcb7 151c4e78 11d8302b 0b544718 1faa4edc 65fefb21 a62f9403 eab61382 a52207c9 g: 387bdbfc 782471c9 2e04ba71 67078b29 ba7ce02e 66c9cb5a 20510117 0bd3e84a 2b00da8d c7a1e390 a4863cf6 e55e0b6c 496ac29b a5a8214e 0801213c b270fdc1 0e940d66 830c777e 62291682 c777f56d 2e0b70d5 52e53a66 b7d06aaa 212ac423 a5525dd9 d4d3ec9b fec13690 e735110e a702edcc b4f2983d 3bbc3044 27bfd852 l: 2563E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7 52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D Prafullchandra, Schaad1816 Internet Draft August 1999 Appendix C. Example of Discrete Log Signature Step 1. Generate a Diffie-Hellman Key with length of q being 256- bits. p: 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 51 63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68 5B 79 7C 1D 5A 14 75 1F 6A 93 75 93 CE BB 97 72 8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2 32 E1 89 67 BE 7E 06 AE F8 D0 01 6B 8B 2A F5 02 D7 B6 A8 63 94 83 B0 1B 31 7D 52 1A DE E5 03 85 27 q: E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30 FB g: 26 A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 53 3F 90 06 61 50 38 3E D2 B9 7D 81 1C 12 10 C5 0C 53 D4 64 D1 8E 30 07 08 8C DD 3F 0A 2F 2C D6 1B 7F 57 86 D0 DA BB 6E 36 2A 18 E8 D3 BC 70 31 7A 48 B6 4E 18 6E DD 1F 22 06 EB 3F EA D4 41 69 D9 9B DE 47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1 39 9A FF 04 D5 6E 7E 94 3D 03 B8 F6 31 15 26 48 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD j: A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7 B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 92 y: 5F CF 39 AD 62 CF 49 8E D1 CE 66 E2 B1 E6 A7 01 4D 05 C2 77 C8 92 52 42 A9 05 A4 DB E0 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69 B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21 E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 8F C5 1A seed: 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB 09 E4 98 34 C: 00000037 Prafullchandra, Schaad1917 Internet Draft August 1999 x: 3E 5D AD FD E5 F4 6B 1B 61 5E 18 F9 0B 84 74 a7 52 1E D6 92 BC 34 94 56 F3 0C BE DA 67 7A DD 7D Step 2. Form the value to be signed and hash with SHA1. The result of the hash for this example is: 5f a2 69 b6 4b 22 91 22 6f 4c fe 68 ec 2b d1 c6 d4 21 e5 2c Step 3. The hash value needs to be expanded since |q| = 256. This is done by hashing the hash with SHA1 and appending it to the original hash. The value after this step is: 5f a2 69 b6 4b 22 91 22 6f 4c fe 68 ec 2b d1 c6 d4 21 e5 2c 64 92 8b c9 5e 34 59 70 bd 62 40 ad 6f 26 3b f7 1c a3 b2 cb Next the first 255 bits of this value are taken to be the resulting "hash" value. Note in this case a shift of one bit right is done since the result is to be treated as an integer: 2f d1 34 db 25 91 48 91 37 a6 7f 34 76 15 e8 e3 6a 10 f2 96 32 49 45 e4 af 1a 2c b8 5e b1 20 56 Step 4. The signature value is computed. In this case you get the values R: A1 B5 B4 90 01 34 6B A0 31 6A 73 F5 7D F6 5C 14 43 52 D2 10 BF 86 58 87 F7 BC 6E 5A 77 FF C3 4B S: 59 40 45 BC 6F 0D DC FF 9D 55 40 1E C4 9E 51 3D 66 EF B2 FF 06 40 9A 39 68 75 81 F7 EC 9E BE A1 The encoded signature values is then: 30 45 02 21 00 A1 B5 B4 90 01 34 6B A0 31 6A 73 F5 7D F6 5C 14 43 52 D2 10 BF 86 58 87 F7 BC 6E 5A 77 FF C3 4B 02 20 59 40 45 BC 6F 0D DC FF 9D 55 40 1E C4 9E 51 3D 66 EF B2 FF 06 40 9A 39 68 75 81 F7 EC 9E BE A1 Result: 30 82 02 c2 30 82 02 67 02 01 00 30 1b 31 19 30 17 06 03 55 04 03 13 10 49 45 54 46 20 50 4b 49 58 20 53 41 4d 50 4c 45 30 82 02 41 30 82 01 b6 06 07 2a 86 48 ce 3e 02 01 30 82 01 a9 02 81 81 00 94 84 e0 45 6c 7f 69 51 62 3e 56 80 7c 68 e7 c5 a9 9e 9e 74 74 94 ed 90 8c 1d c4 e1 4a 14 82 f5 d2 94 0c 19 e3 b9 10 bb 11 b9 e5 a5 fb 8e 21 51 63 02 86 aa 06 b8 21 36 b6 7f 36 df d1 d6 68 5b 79 7c 1d 5a 14 75 1f 6a 93 75 93 ce bb 97 72 Prafullchandra, Schaad2018 Internet Draft August 1999 8a f0 0f 23 9d 47 f6 d4 b3 c7 f0 f4 e6 f6 2b c2 32 e1 89 67 be 7e 06 ae f8 d0 01 6b 8b 2a f5 02 d7 b6 a8 63 94 83 b0 1b 31 7d 52 1a de e5 03 85 27 02 81 80 26 a6 32 2c 5a 2b d4 33 2b 5c dc 06 87 53 3f 90 06 61 50 38 3e d2 b9 7d 81 1c 12 10 c5 0c 53 d4 64 d1 8e 30 07 08 8c dd 3f 0a 2f 2c d6 1b 7f 57 86 d0 da bb 6e 36 2a 18 e8 d3 bc 70 31 7a 48 b6 4e 18 6e dd 1f 22 06 eb 3f ea d4 41 69 d9 9b de 47 95 7a 72 91 d2 09 7f 49 5c 3b 03 33 51 c8 f1 39 9a ff 04 d5 6e 7e 94 3d 03 b8 f6 31 15 26 48 95 a8 5c de 47 88 b4 69 3a 00 a7 86 9e da d1 cd 02 21 00 e8 72 fa 96 f0 11 40 f5 f2 dc fd 3b 5d 78 94 b1 85 01 e5 69 37 21 f7 25 b9 ba 71 4a fc 60 30 fb 02 61 00 a3 91 01 c0 a8 6e a4 4d a0 56 fc 6c fe 1f a7 b0 cd 0f 94 87 0c 25 be 97 76 8d eb e5 a4 09 5d ab 83 cd 80 0b 35 67 7f 0c 8e a7 31 98 32 85 39 40 9d 11 98 d8 de b8 7f 86 9b af 8d 67 3d b6 76 b4 61 2f 21 e1 4b 0e 68 ff 53 3e 87 dd d8 71 56 68 47 dc f7 20 63 4b 3c 5f 78 71 83 e6 70 9e e2 92 30 1a 03 15 00 1c d5 3a 0d 17 82 6d 0a 81 75 81 46 10 8e 3e db 09 e4 98 34 02 01 37 03 81 84 00 02 81 80 5f cf 39 ad 62 cf 49 8e d1 ce 66 e2 b1 e6 a7 01 4d 05 c2 77 c8 92 52 42 a9 05 a4 db e0 46 79 50 a3 fc 99 3d 3d a6 9b a9 ad bc 62 1c 69 b7 11 a1 c0 2a f1 85 28 f7 68 fe d6 8f 31 56 22 4d 0a 11 6e 72 3a 02 af 0e 27 aa f9 ed ce 05 ef d8 59 92 c0 18 d7 69 6e bd 70 b6 21 d1 77 39 21 e1 af 7a 3a cf 20 0a b4 2c 69 5f cf 79 67 20 31 4d f2 c6 ed 23 bf c4 bb 1e d1 71 40 2c 07 d6 f0 8f c5 1a a0 00 30 0c 06 08 2b 06 01 05 05 07 06 04 05 00 03 47 00 30 44 02 20 54 d9 43 8d 0f 9d 42 03 d6 09 aa a1 9a 3c 17 09 ae bd ee b3 d1 a0 00 db 7d 8c b8 e4 56 e6 57 7b 02 20 44 89 b1 04 f5 40 2b 5f e7 9c f9 a4 97 50 0d ad c3 7a a4 2b b2 2d 5d 79 fb 38 8a b4 df bb 88 bc Decoded Version of result: 0 30 707: SEQUENCE { 4 30 615: SEQUENCE { 8 02 1: INTEGER 0 11 30 27: SEQUENCE { 13 31 25: SET { 15 30 23: SEQUENCE { 17 06 3: OBJECT IDENTIFIER commonName (2 5 4 3) 22 13 16: PrintableString 'IETF PKIX SAMPLE' : } : } : } 40 30 577: SEQUENCE { 44 30 438: SEQUENCE { Prafullchandra, Schaad2119 Internet Draft August 1999 48 06 7: OBJECT IDENTIFIER dhPublicNumber (1 2 840 10046 2 1) 57 30 425: SEQUENCE { 61 02 129: INTEGER : 00 94 84 E0 45 6C 7F 69 51 62 3E 56 80 7C 68 E7 : C5 A9 9E 9E 74 74 94 ED 90 8C 1D C4 E1 4A 14 82 : F5 D2 94 0C 19 E3 B9 10 BB 11 B9 E5 A5 FB 8E 21 : 51 63 02 86 AA 06 B8 21 36 B6 7F 36 DF D1 D6 68 : 5B 79 7C 1D 5A 14 75 1F 6A 93 75 93 CE BB 97 72 : 8A F0 0F 23 9D 47 F6 D4 B3 C7 F0 F4 E6 F6 2B C2 : 32 E1 89 67 BE 7E 06 AE F8 D0 01 6B 8B 2A F5 02 : D7 B6 A8 63 94 83 B0 1B 31 7D 52 1A DE E5 03 85 : 27 193 02 128: INTEGER : 26 A6 32 2C 5A 2B D4 33 2B 5C DC 06 87 53 3F 90 : 06 61 50 38 3E D2 B9 7D 81 1C 12 10 C5 0C 53 D4 : 64 D1 8E 30 07 08 8C DD 3F 0A 2F 2C D6 1B 7F 57 : 86 D0 DA BB 6E 36 2A 18 E8 D3 BC 70 31 7A 48 B6 : 4E 18 6E DD 1F 22 06 EB 3F EA D4 41 69 D9 9B DE : 47 95 7A 72 91 D2 09 7F 49 5C 3B 03 33 51 C8 F1 : 39 9A FF 04 D5 6E 7E 94 3D 03 B8 F6 31 15 26 48 : 95 A8 5C DE 47 88 B4 69 3A 00 A7 86 9E DA D1 CD 324 02 33: INTEGER : 00 E8 72 FA 96 F0 11 40 F5 F2 DC FD 3B 5D 78 94 : B1 85 01 E5 69 37 21 F7 25 B9 BA 71 4A FC 60 30 : FB 359 02 97: INTEGER : 00 A3 91 01 C0 A8 6E A4 4D A0 56 FC 6C FE 1F A7 : B0 CD 0F 94 87 0C 25 BE 97 76 8D EB E5 A4 09 5D : AB 83 CD 80 0B 35 67 7F 0C 8E A7 31 98 32 85 39 : 40 9D 11 98 D8 DE B8 7F 86 9B AF 8D 67 3D B6 76 : B4 61 2F 21 E1 4B 0E 68 FF 53 3E 87 DD D8 71 56 : 68 47 DC F7 20 63 4B 3C 5F 78 71 83 E6 70 9E E2 : 92 458 30 26: SEQUENCE { 460 03 21: BIT STRING 0 unused bits : 1C D5 3A 0D 17 82 6D 0A 81 75 81 46 10 8E 3E DB : 09 E4 98 34 483 02 1: INTEGER 55 : } : } : } 486 03 132: BIT STRING 0 unused bits : 02 81 80 5F CF 39 AD 62 CF 49 8E D1 CE 66 E2 B1 : E6 A7 01 4D 05 C2 77 C8 92 52 42 A9 05 A4 DB E0 : 46 79 50 A3 FC 99 3D 3D A6 9B A9 AD BC 62 1C 69 : B7 11 A1 C0 2A F1 85 28 F7 68 FE D6 8F 31 56 22 : 4D 0A 11 6E 72 3A 02 AF 0E 27 AA F9 ED CE 05 EF : D8 59 92 C0 18 D7 69 6E BD 70 B6 21 D1 77 39 21 : E1 AF 7A 3A CF 20 0A B4 2C 69 5F CF 79 67 20 31 : 4D F2 C6 ED 23 BF C4 BB 1E D1 71 40 2C 07 D6 F0 : 8F C5 1A : } 621 A0 0: [0] Prafullchandra, Schaad2220 Internet Draft August 1999 : } 623 30 12: SEQUENCE { 625 06 8: OBJECT IDENTIFIER '1 3 6 1 5 5 7 6 4' 635 05 0: NULL : } 637 03 72: BIT STRING 0 unused bits : 30 45 02 21 00 A1 B5 B4 90 01 34 6B A0 31 6A 73 : F5 7D F6 5C 14 43 52 D2 10 BF 86 58 87 F7 BC 6E : 5A 77 FF C3 4B 02 20 59 40 45 BC 6F 0D DC FF 9D : 55 40 1E C4 9E 51 3D 66 EF B2 FF 06 40 9A 39 68 : 75 81 F7 EC 9E BE A1 : } Prafullchandra, Schaad2321 ----