(Delphi DLL) ECDSA Sign and Verify

Demonstrates how to create an ECDSA signature on the SHA256 hash of some data, and then verify.

Chilkat for Delphi Downloads Chilkat non-ActiveX DLL for Delphi Chilkat ActiveX DLL for Delphi * The examples here use the non-ActiveX DLL.

uses
    Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
    Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Asn, Prng, BinData, PrivateKey, PublicKey, Xml, Crypt2, Ecc;

...

procedure TForm1.Button1Click(Sender: TObject);
var
privKey: HCkPrivateKey;
success: Boolean;
bd: HCkBinData;
crypt: HCkCrypt2;
hashStr: PWideChar;
ecdsa: HCkEcc;
prng: HCkPrng;
sig: PWideChar;
asn: HCkAsn;
xml: HCkXml;
r: PWideChar;
s: PWideChar;
pubKey: HCkPublicKey;
ecc2: HCkEcc;
result: Integer;
xml2: HCkXml;
asn2: HCkAsn;
encodedSig: PWideChar;

begin
// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// First load an ECDSA private key to be used for signing.
privKey := CkPrivateKey_Create();
success := CkPrivateKey_LoadEncryptedPemFile(privKey,'qa_data/ecc/secp256r1-key-pkcs8-secret.pem','secret');
if (success = False) then
  begin
    Memo1.Lines.Add(CkPrivateKey__lastErrorText(privKey));
    Exit;
  end;

// Sign the SHA256 hash of some data.
bd := CkBinData_Create();
success := CkBinData_LoadFile(bd,'qa_data/hamlet.xml');
if (success = False) then
  begin
    Memo1.Lines.Add('Failed to load file to be hashed.');
    Exit;
  end;

crypt := CkCrypt2_Create();
CkCrypt2_putHashAlgorithm(crypt,'sha256');
CkCrypt2_putEncodingMode(crypt,'base64');
hashStr := CkCrypt2__hashBdENC(crypt,bd);

ecdsa := CkEcc_Create();
prng := CkPrng_Create();
// Returns ASN.1 signature as a base64 string.
sig := CkEcc__signHashENC(ecdsa,hashStr,'base64',privKey,prng);
Memo1.Lines.Add('sig = ' + sig);

// The signature is in ASN.1 format (which may be described as the "encoded DSS signature").
// SEQUENCE (2 elem)
//   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
//   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...

// If you wish, you can get the r and s components of the signature like this:
asn := CkAsn_Create();
CkAsn_LoadEncoded(asn,sig,'base64');
xml := CkXml_Create();
CkXml_LoadXml(xml,CkAsn__asnToXml(asn));

Memo1.Lines.Add(CkXml__getXml(xml));

// We now have this:
// <?xml version="1.0" encoding="utf-8"?>
// <sequence>
//     <int>6650D422D86BA4A228B5617604E59052591B9B2C32EF324C44D09EF67E5F0060</int>
//     <int>0CFD9F6AC85042FC70F672C141BA6B2A4CAFBB906C3D907BCCC1BED62B28326F</int>
// </sequence>

// Get the "r" and "s" as hex strings
r := CkXml__getChildContentByIndex(xml,0);
s := CkXml__getChildContentByIndex(xml,1);

Memo1.Lines.Add('r = ' + r);
Memo1.Lines.Add('s = ' + s);

// --------------------------------------------------------------------
// Now verify against the hash of the original data.

// Get the corresponding public key.
pubKey := CkPublicKey_Create();
success := CkPublicKey_LoadFromFile(pubKey,'qa_data/ecc/secp256r1-pub.pem');
if (success = False) then
  begin
    Memo1.Lines.Add(CkPublicKey__lastErrorText(pubKey));
    Exit;
  end;

// We already have the SHA256 hash of the original data (hashStr) so no need to re-do it..
ecc2 := CkEcc_Create();
result := CkEcc_VerifyHashENC(ecc2,hashStr,sig,'base64',pubKey);
if (result <> 1) then
  begin
    Memo1.Lines.Add(CkEcc__lastErrorText(ecc2));
    Exit;
  end;

Memo1.Lines.Add('Verified!');

// Note: If we have only r,s and wish to reconstruct the ASN.1 signature, we do it like this:
xml2 := CkXml_Create();
CkXml_putTag(xml2,'sequence');
CkXml_NewChild2(xml2,'int',r);
CkXml_NewChild2(xml2,'int',s);

asn2 := CkAsn_Create();
CkAsn_LoadAsnXml(asn2,CkXml__getXml(xml2));
encodedSig := CkAsn__getEncodedDer(asn2,'base64');
Memo1.Lines.Add('encoded DSS signature: ' + encodedSig);

// You can go to https://lapo.it/asn1js/  and copy/paste the base64 encodedSig into the online tool, then press the "decode" button.
// You will see the ASN.1 such as this:

// SEQUENCE (2 elem)
//   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
//   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...

CkPrivateKey_Dispose(privKey);
CkBinData_Dispose(bd);
CkCrypt2_Dispose(crypt);
CkEcc_Dispose(ecdsa);
CkPrng_Dispose(prng);
CkAsn_Dispose(asn);
CkXml_Dispose(xml);
CkPublicKey_Dispose(pubKey);
CkEcc_Dispose(ecc2);
CkXml_Dispose(xml2);
CkAsn_Dispose(asn2);

end;