(Delphi DLL) RSA Sign using a Private Key on a USB Token or Smartcard

See more Apple Keychain Examples

Create an RSA signature using a private key stored on a USB token or smartcard.

Note: On MacOS and iOS, this example requires Chilkat v10.1.2 or later when the Apple Keychain is used as the underlying means to do the signing.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, BinData, Rsa, Cert;

...

procedure TForm1.Button1Click(Sender: TObject);
var
cert: HCkCert;
success: Boolean;
bd: HCkBinData;
i: Integer;
rsa: HCkRsa;
bdSig: HCkBinData;

begin
// Assuming the smartcard/USB token is installed with the correct drivers from the manufacturer,
// this code can work on multiple platforms including Windows, MacOS, Linux, and iOS.

// Chilkat automatically detects and determines the way in which the HSM is used,
// which can be by PKCS11, Apple Keychain, Microsoft CNG / Crypto API, or ScMinidriver.

cert := CkCert_Create();

// Set the token/smartcard PIN prior to loading.
CkCert_putSmartCardPin(cert,'123456');

// Specify the certificate by its common name.
success := CkCert_LoadFromSmartcard(cert,'cn=chilkat-rsa-2048');
if (success = False) then
  begin
    Memo1.Lines.Add(CkCert__lastErrorText(cert));
    Exit;
  end;

Memo1.Lines.Add('Signing with cert: ' + CkCert__subjectCN(cert));

// Create data to be hashed and signed.
bd := CkBinData_Create();

for i := 0 to 100 do
  begin
    CkBinData_AppendEncoded(bd,'000102030405060708090A0B0C0D0E0F','hex');
  end;

rsa := CkRsa_Create();

// Use the certificate's private key for signing.
success := CkRsa_SetX509Cert(rsa,cert,True);
if (success = False) then
  begin
    Memo1.Lines.Add(CkRsa__lastErrorText(rsa));
    Exit;
  end;

// Sign the SHA-256 hash of the contents of bd.
bdSig := CkBinData_Create();
success := CkRsa_SignBd(rsa,bd,'sha256',bdSig);
if (success = False) then
  begin
    Memo1.Lines.Add(CkRsa__lastErrorText(rsa));
    Exit;
  end;

// The RSA signature is equal in length to the size of the RSA key.
Memo1.Lines.Add('Output signature size in bits = ' + IntToStr(CkBinData_getNumBytes(bdSig) * 8));

// We can save the signature for later verification..
CkBinData_WriteFile(bdSig,'rsaSignatures/test1.sig');

// See the example to verify the RSA signature:
// Verfies an RSA Signature

CkCert_Dispose(cert);
CkBinData_Dispose(bd);
CkRsa_Dispose(rsa);
CkBinData_Dispose(bdSig);

end;