(Tcl) RSA Sign an Encoded Hash

See more RSA Examples

Demonstrates signing a hash (e.g., SHA256) provided as an encoded string (e.g., base64 or hex).

Chilkat Tcl Extension Downloads Chilkat Tcl Extension Downloads

load ./chilkat.dll

# Assuming the smartcard/USB token is installed with the correct drivers from the manufacturer,
# this code can work on multiple platforms including Windows, MacOS, Linux, and iOS.

# Chilkat automatically detects and determines the way in which the HSM is used,
# which can be by PKCS11, Apple Keychain, Microsoft CNG / Crypto API, or ScMinidriver.

set cert [new_CkCert]

# Set the token/smartcard PIN prior to loading.
CkCert_put_SmartCardPin $cert "123456"

# Specify the certificate by its common name.
set success [CkCert_LoadFromSmartcard $cert "cn=chilkat-rsa-2048"]
if {$success == 0} then {
    puts [CkCert_lastErrorText $cert]
    delete_CkCert $cert
    exit
}

puts "Signing with the private key for this cert: [CkCert_subjectCN $cert]"

# Create data to be hashed and signed.
set bd [new_CkBinData]

for {set i 0} {$i <= 100} {incr i} {
    CkBinData_AppendEncoded $bd "000102030405060708090A0B0C0D0E0F" "hex"
}

set rsa [new_CkRsa]

# Use the certificate's private key for signing.
set success [CkRsa_SetX509Cert $rsa $cert 1]
if {$success == 0} then {
    puts [CkRsa_lastErrorText $rsa]
    delete_CkCert $cert
    delete_CkBinData $bd
    delete_CkRsa $rsa
    exit
}

# We'll first compute the hash and then pass the encoded hash to be signed.
set sha256_base64 [CkBinData_getHash $bd "sha256" "base64"]
puts "sha256 hash in base64 format: $sha256_base64"

# Pass in the base64 hash and return a base64 signature.
CkRsa_put_EncodingMode $rsa "base64"
set rsaSig_base64 [CkRsa_signHashENC $rsa $sha256_base64 "sha256"]
if {$success == 0} then {
    puts [CkRsa_lastErrorText $rsa]
    delete_CkCert $cert
    delete_CkBinData $bd
    delete_CkRsa $rsa
    exit
}

puts "RSA signature as base64: $rsaSig_base64"

delete_CkCert $cert
delete_CkBinData $bd
delete_CkRsa $rsa