(DataFlex) RSASSA-PSS Sign String to Create Base64 PCKS7 Signature

Signs a string to create a PKCS7 signature in the base64 encoding. The signature algorithm is RSASSA-PSS with SHA256.

Note: This example requires Chilkat v11.0.0 or greater.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoCrypt
    Handle hoPfx
    Variant vCert
    Handle hoCert
    String sOriginalText
    String sPkcs7sig
    String sOpaqueSig
    String sOrigTxt
    String sTemp1
    Boolean bTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    Get Create (RefClass(cComChilkatCrypt2)) To hoCrypt
    If (Not(IsComObjectCreated(hoCrypt))) Begin
        Send CreateComObject of hoCrypt
    End

    // Get a digital certificate with private key from a .pfx
    // (Chilkat has many different ways to provide a cert + private key for siging.
    // Using a PFX is just one possible option.)
    Get Create (RefClass(cComChilkatPfx)) To hoPfx
    If (Not(IsComObjectCreated(hoPfx))) Begin
        Send CreateComObject of hoPfx
    End
    Get ComLoadPfxFile Of hoPfx "qa_data/rsassa-pss/privatekey.pfx" "PFX_PASSWORD" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPfx To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Get the certificate to be used for signing.
    // (The typical case for a PFX is that it contains a cert with an associated private key,
    // as well as other certificates in the chain of authentication.  The cert with the private
    // key should be in the first position at index 0.)

    Get Create (RefClass(cComChilkatCert)) To hoCert
    If (Not(IsComObjectCreated(hoCert))) Begin
        Send CreateComObject of hoCert
    End
    Get pvComObject of hoCert to vCert
    Get ComCertAt Of hoPfx 0 vCert To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPfx To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get pvComObject of hoCert to vCert
    Get ComSetSigningCert Of hoCrypt vCert To iSuccess

    // Indicate that RSASSA-PSS with SHA256 should be used.
    Set ComSigningAlg Of hoCrypt To "pss"
    Set ComHashAlgorithm Of hoCrypt To "sha256"

    Set ComEncodingMode Of hoCrypt To "base64"

    // Sign a string and return the base64 PKCS7 detached signature
    Move "This is a test" To sOriginalText
    Get ComSignStringENC Of hoCrypt sOriginalText To sPkcs7sig
    Showln "Detached Signature:"
    Showln sPkcs7sig

    // This signature looks like this:
    // MIIG5wYJKoZIhvcNAQcCoIIG2DCCBtQCAQExDzANBgl .. YToLqEwTdU87ox5g7rvw==

    // The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
    // then copy-and-paste the Base64 signature into the form and decode..

    // The signature can be verified against the original data like this:
    Get ComVerifyStringENC Of hoCrypt sOriginalText sPkcs7sig To iSuccess
    Showln "Signature verified: " iSuccess
    Get ComVerifyStringENC Of hoCrypt "Not the original text" sPkcs7sig To iSuccess
    Showln "Signature verified: " iSuccess

    // Now we'll create an opaque signature (the opposite of a detached signature). 
    // An opaque signature is a PKCS7 message that contains both the original data and
    // the signature.  The verification process extracts the original data.
    Get ComOpaqueSignStringENC Of hoCrypt sOriginalText To sOpaqueSig
    Showln "Opaque Signature:"
    Showln sOpaqueSig

    // The ASN.1 of the signature can be examined by browsing to https://lapo.it/asn1js/ ,
    // then copy-and-paste the Base64 signature into the form and decode..

    // We can verify and extract the original data:
    Get ComOpaqueVerifyStringENC Of hoCrypt sOpaqueSig To sOrigTxt
    Get ComLastMethodSuccess Of hoCrypt To bTemp1
    If (bTemp1 <> True) Begin
        Showln "Signature verification failed."
        Get ComLastErrorText Of hoCrypt To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Signature verified."
    Showln "Extracted text:" sOrigTxt


End_Procedure