Ruby

ECDSA Sign and Verify

See more ECC Examples

Demonstrates how to create an ECDSA signature on the SHA256 hash of some data, and then verify. Ruby

require 'chilkat'

success = false

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

# First load an ECDSA private key to be used for signing.
privKey = Chilkat::CkPrivateKey.new()
success = privKey.LoadEncryptedPemFile("qa_data/ecc/secp256r1-key-pkcs8-secret.pem","secret")
if (success == false)
    print privKey.lastErrorText() + "\n";
    exit
end

# Sign the SHA256 hash of some data.
bd = Chilkat::CkBinData.new()
success = bd.LoadFile("qa_data/hamlet.xml")
if (success == false)
    print "Failed to load file to be hashed." + "\n";
    exit
end

crypt = Chilkat::CkCrypt2.new()
crypt.put_HashAlgorithm("sha256")
crypt.put_EncodingMode("base64")
hashStr = crypt.hashBdENC(bd)

ecdsa = Chilkat::CkEcc.new()
prng = Chilkat::CkPrng.new()
# Returns ASN.1 signature as a base64 string.
sig = ecdsa.signHashENC(hashStr,"base64",privKey,prng)
print "sig = " + sig + "\n";

# The signature is in ASN.1 format (which may be described as the "encoded DSS signature").
# SEQUENCE (2 elem)
#   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
#   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...

# If you wish, you can get the r and s components of the signature like this:
asn = Chilkat::CkAsn.new()
asn.LoadEncoded(sig,"base64")
xml = Chilkat::CkXml.new()
xml.LoadXml(asn.asnToXml())

print xml.getXml() + "\n";

# We now have this:
# <?xml version="1.0" encoding="utf-8"?>
# <sequence>
#     <int>6650D422D86BA4A228B5617604E59052591B9B2C32EF324C44D09EF67E5F0060</int>
#     <int>0CFD9F6AC85042FC70F672C141BA6B2A4CAFBB906C3D907BCCC1BED62B28326F</int>
# </sequence>

# Get the "r" and "s" as hex strings
r = xml.getChildContentByIndex(0)
s = xml.getChildContentByIndex(1)

print "r = " + r + "\n";
print "s = " + s + "\n";

# --------------------------------------------------------------------
# Now verify against the hash of the original data.

# Get the corresponding public key.
pubKey = Chilkat::CkPublicKey.new()
success = pubKey.LoadFromFile("qa_data/ecc/secp256r1-pub.pem")
if (success == false)
    print pubKey.lastErrorText() + "\n";
    exit
end

# We already have the SHA256 hash of the original data (hashStr) so no need to re-do it..
ecc2 = Chilkat::CkEcc.new()
result = ecc2.VerifyHashENC(hashStr,sig,"base64",pubKey)
if (result != 1)
    print ecc2.lastErrorText() + "\n";
    exit
end

print "Verified!" + "\n";

# Note: If we have only r,s and wish to reconstruct the ASN.1 signature, we do it like this:
xml2 = Chilkat::CkXml.new()
xml2.put_Tag("sequence")
xml2.NewChild2("int",r)
xml2.NewChild2("int",s)

asn2 = Chilkat::CkAsn.new()
asn2.LoadAsnXml(xml2.getXml())
encodedSig = asn2.getEncodedDer("base64")
print "encoded DSS signature: " + encodedSig + "\n";

# You can go to https://lapo.it/asn1js/  and copy/paste the base64 encodedSig into the online tool, then press the "decode" button.
# You will see the ASN.1 such as this:

# SEQUENCE (2 elem)
#   INTEGER (255 bit) 4849395540832462044300553275435608522154141569743642905628579547100940...
#   INTEGER (255 bit) 3680701124244788134409868118208591399799457104230118295614152238560005...