OpenSSL RSA_sign() returns zero error code

问题

I am playing with OpenSSL 1.0.2o version. I compiled from OpenSSL only static libcrypto. I used this configuration flags:

no-demos, no-bugs, no-apps, no-ssl, no-test, no-shared, no-zlib, no-zlib-dynamic, no-ssl-trace, no-unit-test, no-ec_nistp_64_gcc_128, no-libunbound, no-ssl1, no-ssl2, no-ssl3, no-asm, no-dtls, no-dtls1, no-threads, no-npn, no-weak-ssl-ciphers, no-rfc3779, no-sctp, no-ui, no-async, no-dgram, no-posix-io, no-sock, no-des, no-dso, no-srp, no-store, no-ts, no-txt_db, no-hw, no-ec, no-gmp, -DOPENSSL_NO_STDIO, -DOPENSSL_NO_FP_API, -DOPENSSL_NO_DYNAMIC_ENGINE,-UOPENSSL_FIPS.

I use OpenSSL into small embedded device. (without file operations, without operating system and without libc).

I import RSA public and private keys from memory from PEM-strings and then I want to use it for sign/verify, but RSA_sign() function returns zero. May be am I do that wrong?

Import keys:

#include <openssl/pem.h>
#include <openssl/rsa.h>
#include <openssl/evp.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/bn.h>

typedef RSA *(*read_bio2rsa_f)(BIO *, RSA **, pem_password_cb *, void *);

static BIO *pub_bio;
static RSA *pub_key;

static BIO *prv_bio;
static RSA *prv_key;

static RSA *openssl_read_key_rsa(int rsa_type, BIO **bio)
{
    RSA *rsa;
    char *pem_str;
    int pem_str_len;
    read_bio2rsa_f read_bio2rsa;

    if (rsa_type == PUB_KEY_TYPE) {
        pem_str = (char *)pem_pub_key;
        pem_str_len = (int)sizeof(pem_pub_key);
        read_bio2rsa = PEM_read_bio_RSA_PUBKEY;
    } else {
        pem_str = (char *)pem_prv_key;
        pem_str_len = (int)sizeof(pem_prv_key);
        read_bio2rsa = PEM_read_bio_RSAPrivateKey;
    }

    if ((*bio = BIO_new_mem_buf((const void *)pem_str,
            pem_str_len)) == NULL) {
        EMSG("BIO_new_mem_buf() FAILED read PEM key");

        return NULL;
    }

    if ((rsa = RSA_new()) == NULL) {
        EMSG("RSA_new() FAILED");

        return NULL;
    }

    read_bio2rsa(*bio, &rsa, NULL, NULL);

    return rsa;
}

static int check_rsa_key_pair(RSA *pub, RSA *priv)
{
    if (BN_cmp(pub->n, priv->n) != 0)
        return CRYPTO_ERR;

    return CRYPTO_OK;
}

/* extrnal function for import RSA-keys */
int openssl_rsa_init_key(void)
{
    ERR_load_crypto_strings();
    OPENSSL_add_all_algorithms_noconf();

    if ((prv_key = openssl_read_key_rsa(PRV_KEY_TYPE, &prv_bio)) == NULL) {
        EMSG("Importing the private key FAILED!");

        return CRYPTO_ERR;
    }

    if ((pub_key = openssl_read_key_rsa(PUB_KEY_TYPE, &pub_bio)) == NULL) {
        EMSG("Importing the public key FAILED!");

        return CRYPTO_ERR;
    }

    if (!check_rsa_key_pair(pub_key, prv_key)) {
        EMSG("Key pair don't match");

        return CRYPTO_ERR;
    }

    EMSG("Import KEYs is successful!");

    return CRYPTO_OK;
}

All code above is executed successfully. After this, in theory, I can free use the rsa keys into any OpenSSL functions that expected RSA-type.

I tried to do signature like this:

int openssl_rsa_sign_hash(uint8_t *hash, unsigned int hash_len,
        uint8_t *sig, int *sig_len)
{
    if (!RSA_sign(NID_sha256, (const unsigned char *)hash, hash_len,
            (unsigned char *)sig, (unsigned int *)sig_len,
            prv_key)) {
        EMSG("RSA signature FAILED with %s",
            ERR_error_string(ERR_get_error(), NULL));

        return CRYPTO_ERR;
    }

    EMSG("RSA signature success!");

    return CRYPTO_OK;
}

But, I got "RSA signature FAILED with error:00000000:lib(0):func(0):reason(0)" this string into my error output.

Could anyone explain me the mistakes, please?

回答1:

But, I got "RSA signature FAILED with error:00000000:lib(0):func(0):reason(0)" this string into my error output.

Could anyone explain me the mistakes, please?

I don't see a main function, so this is just speculation...

Add a call to SSL_library_init and ERR_load_crypto_strings in main. You may also need a call to OpenSSL_add_all_ciphers.

Since you are not getting a good error string, you might try printing the result of ERR_get_error(). Once you get the result of ERR_get_error(), you can run it through the openssl errstr command:

$ openssl errstr 0406506C
error:0406506C:rsa routines:RSA_EAY_PRIVATE_DECRYPT:data greater than mod len

Also see Library Initialization on the OpenSSL wiki.

来源：https://stackoverflow.com/questions/58302636/openssl-rsa-sign-returns-zero-error-code

标签

ssl

OpenSSL

rsa

sign