(Objective-C) ECDSA Sign and Verify

Demonstrates how to create an ECDSA signature on the SHA256 hash of some data, and then verify.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <CkoPrivateKey.h>
#import <CkoBinData.h>
#import <CkoCrypt2.h>
#import <NSString.h>
#import <CkoEcc.h>
#import <CkoPrng.h>
#import <CkoAsn.h>
#import <CkoXml.h>
#import <CkoPublicKey.h>

// This example assumes the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// First load an ECDSA private key to be used for signing.
CkoPrivateKey *privKey = [[CkoPrivateKey alloc] init];
BOOL success = [privKey LoadEncryptedPemFile: @"qa_data/ecc/secp256r1-key-pkcs8-secret.pem" password: @"secret"];
if (success == NO) {
    NSLog(@"%@",privKey.LastErrorText);
    return;
}

// Sign the SHA256 hash of some data.
CkoBinData *bd = [[CkoBinData alloc] init];
success = [bd LoadFile: @"qa_data/hamlet.xml"];
if (success == NO) {
    NSLog(@"%@",@"Failed to load file to be hashed.");
    return;
}

CkoCrypt2 *crypt = [[CkoCrypt2 alloc] init];
crypt.HashAlgorithm = @"sha256";
crypt.EncodingMode = @"base64";
NSString *hashStr = [crypt HashBdENC: bd];

CkoEcc *ecdsa = [[CkoEcc alloc] init];
CkoPrng *prng = [[CkoPrng alloc] init];
// Returns ASN.1 signature as a base64 string.
NSString *sig = [ecdsa SignHashENC: hashStr encoding: @"base64" privkey: privKey prng: prng];
NSLog(@"%@%@",@"sig = ",sig);

// The signature is in ASN.1 format (which may be described as the "encoded DSS signature").
// SEQUENCE (2 elem)
//   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
//   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...

// If you wish, you can get the r and s components of the signature like this:
CkoAsn *asn = [[CkoAsn alloc] init];
[asn LoadEncoded: sig encoding: @"base64"];
CkoXml *xml = [[CkoXml alloc] init];
[xml LoadXml: [asn AsnToXml]];

NSLog(@"%@",[xml GetXml]);

// We now have this:
// <?xml version="1.0" encoding="utf-8"?>
// <sequence>
//     <int>6650D422D86BA4A228B5617604E59052591B9B2C32EF324C44D09EF67E5F0060</int>
//     <int>0CFD9F6AC85042FC70F672C141BA6B2A4CAFBB906C3D907BCCC1BED62B28326F</int>
// </sequence>

// Get the "r" and "s" as hex strings
NSString *r = [xml GetChildContentByIndex: [NSNumber numberWithInt: 0]];
NSString *s = [xml GetChildContentByIndex: [NSNumber numberWithInt: 1]];

NSLog(@"%@%@",@"r = ",r);
NSLog(@"%@%@",@"s = ",s);

// --------------------------------------------------------------------
// Now verify against the hash of the original data.

// Get the corresponding public key.
CkoPublicKey *pubKey = [[CkoPublicKey alloc] init];
success = [pubKey LoadFromFile: @"qa_data/ecc/secp256r1-pub.pem"];
if (success == NO) {
    NSLog(@"%@",pubKey.LastErrorText);
    return;
}

// We already have the SHA256 hash of the original data (hashStr) so no need to re-do it..
CkoEcc *ecc2 = [[CkoEcc alloc] init];
int result = [[ecc2 VerifyHashENC: hashStr encodedSig: sig encoding: @"base64" pubkey: pubKey] intValue];
if (result != 1) {
    NSLog(@"%@",ecc2.LastErrorText);
    return;
}

NSLog(@"%@",@"Verified!");

// Note: If we have only r,s and wish to reconstruct the ASN.1 signature, we do it like this:
CkoXml *xml2 = [[CkoXml alloc] init];
xml2.Tag = @"sequence";
[xml2 NewChild2: @"int" content: r];
[xml2 NewChild2: @"int" content: s];

CkoAsn *asn2 = [[CkoAsn alloc] init];
[asn2 LoadAsnXml: [xml2 GetXml]];
NSString *encodedSig = [asn2 GetEncodedDer: @"base64"];
NSLog(@"%@%@",@"encoded DSS signature: ",encodedSig);

// You can go to https://lapo.it/asn1js/  and copy/paste the base64 encodedSig into the online tool, then press the "decode" button.
// You will see the ASN.1 such as this:

// SEQUENCE (2 elem)
//   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
//   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...