AutoIt

ECDSA Sign and Verify

See more ECC Examples

Demonstrates how to create an ECDSA signature on the SHA256 hash of some data, and then verify. AutoIt

Local $bSuccess = False

; This example assumes the Chilkat API to have been previously unlocked.
; See Global Unlock Sample for sample code.

; First load an ECDSA private key to be used for signing.
$oPrivKey = ObjCreate("Chilkat.PrivateKey")
$bSuccess = $oPrivKey.LoadEncryptedPemFile("qa_data/ecc/secp256r1-key-pkcs8-secret.pem","secret")
If ($bSuccess = False) Then
    ConsoleWrite($oPrivKey.LastErrorText & @CRLF)
    Exit
EndIf

; Sign the SHA256 hash of some data.
$oBd = ObjCreate("Chilkat.BinData")
$bSuccess = $oBd.LoadFile("qa_data/hamlet.xml")
If ($bSuccess = False) Then
    ConsoleWrite("Failed to load file to be hashed." & @CRLF)
    Exit
EndIf

$oCrypt = ObjCreate("Chilkat.Crypt2")
$oCrypt.HashAlgorithm = "sha256"
$oCrypt.EncodingMode = "base64"
Local $sHashStr = $oCrypt.HashBdENC($oBd)

$oEcdsa = ObjCreate("Chilkat.Ecc")
$oPrng = ObjCreate("Chilkat.Prng")
; Returns ASN.1 signature as a base64 string.
Local $sig = $oEcdsa.SignHashENC($sHashStr,"base64",$oPrivKey,$oPrng)
ConsoleWrite("sig = " & $sig & @CRLF)

; The signature is in ASN.1 format (which may be described as the "encoded DSS signature").
; SEQUENCE (2 elem)
;   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
;   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...

; If you wish, you can get the r and s components of the signature like this:
$oAsn = ObjCreate("Chilkat.Asn")
$oAsn.LoadEncoded($sig,"base64")
$oXml = ObjCreate("Chilkat.Xml")
$oXml.LoadXml($oAsn.AsnToXml())

ConsoleWrite($oXml.GetXml() & @CRLF)

; We now have this:
; <?xml version="1.0" encoding="utf-8"?>
; <sequence>
;     <int>6650D422D86BA4A228B5617604E59052591B9B2C32EF324C44D09EF67E5F0060</int>
;     <int>0CFD9F6AC85042FC70F672C141BA6B2A4CAFBB906C3D907BCCC1BED62B28326F</int>
; </sequence>

; Get the "r" and "s" as hex strings
Local $sR = $oXml.GetChildContentByIndex(0)
Local $s = $oXml.GetChildContentByIndex(1)

ConsoleWrite("r = " & $sR & @CRLF)
ConsoleWrite("s = " & $s & @CRLF)

; --------------------------------------------------------------------
; Now verify against the hash of the original data.

; Get the corresponding public key.
$oPubKey = ObjCreate("Chilkat.PublicKey")
$bSuccess = $oPubKey.LoadFromFile("qa_data/ecc/secp256r1-pub.pem")
If ($bSuccess = False) Then
    ConsoleWrite($oPubKey.LastErrorText & @CRLF)
    Exit
EndIf

; We already have the SHA256 hash of the original data (hashStr) so no need to re-do it..
$oEcc2 = ObjCreate("Chilkat.Ecc")
Local $iResult = $oEcc2.VerifyHashENC($sHashStr,$sig,"base64",$oPubKey)
If ($iResult <> 1) Then
    ConsoleWrite($oEcc2.LastErrorText & @CRLF)
    Exit
EndIf

ConsoleWrite("Verified!" & @CRLF)

; Note: If we have only r,s and wish to reconstruct the ASN.1 signature, we do it like this:
$oXml2 = ObjCreate("Chilkat.Xml")
$oXml2.Tag = "sequence"
$oXml2.NewChild2 "int",$sR
$oXml2.NewChild2 "int",$s

$oAsn2 = ObjCreate("Chilkat.Asn")
$oAsn2.LoadAsnXml($oXml2.GetXml())
Local $sEncodedSig = $oAsn2.GetEncodedDer("base64")
ConsoleWrite("encoded DSS signature: " & $sEncodedSig & @CRLF)

; You can go to https://lapo.it/asn1js/  and copy/paste the base64 encodedSig into the online tool, then press the "decode" button.
; You will see the ASN.1 such as this:

; SEQUENCE (2 elem)
;   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
;   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...