Generating a certification signing request

Question

Hi all,
I am currently writting a Java Card application and I would like to create a CSR but my private key shouldn't leave the card. However, for signing a CSR I need a private key. In Java Card API I found no suport for something like this. Any idea how to solve this problem? Btw. I am using a JCOP 41 card for development.
Thanks,
erno
Edited by: sect0r1 on Mar 27, 2010 6:11 AM

Answer 1

Hi Shane,
thank you for your reply!
I think is the fifth step which I do not understand:
safarmer wrote:
5. Build a DigestInfo structure (BER encoded TLV that you can get from the PKCS#1 standard) that contains the message digest generated in the previous step What I do is create the message digest and send it to the card to be signed. But when I try to sign the csr with openssl, the following error appears: "Signature did not match the certificate request"
As you told me the applet only encrypt the hashcode:
RSACipher.init(PrivateKey,Cipher.MODE_ENCRYPT); 
RSACipher.doFinal(CSR,(short)0,(short)CSR.length,CSRSigned,(short)0);And the off-card code for preparing the CSR after getting the public key is the following:
        private static void prepareEncCSR (CadT1Client cad){
         byte [] encCSR = null;
         Signature signature = null;
     // signature is not initialized because CSR is not going to be signed here; if not on the card.
     signature = Signature.getInstance("SHA1withRSA");
     // Build the info.
     String info = "CN=cn, OU=ou, O=o, C=cn, ST=city";
         X500Principal x500 = new X500Principal(info);
         X500Name x500name = null;
     x500name = new X500Name(x500.getEncoded());
     X500Signer x500signer = new X500Signer(signature, x500name);
         // Build an instance of pkcs10 with the public key from the card.
         PKCS10 pkcs10 = new PKCS10(PubKey);
     // Encode and sign the certificate request.
     encCSR = encodeAndSign(x500signer, pkcs10, cad);
     FileOutputStream certfos = null;
     // Create the file where the certification request will be stored.
     certfos = new FileOutputStream("CertReq.pem");
         PrintStream ps = new PrintStream(certfos);
         // Encode the CSR properly using base 64 code.
         BASE64Encoder   encoder = new BASE64Encoder();
         ps.println("-----BEGIN NEW CERTIFICATE REQUEST-----");
     encoder.encodeBuffer(encCSR, ps);
     ps.println("-----END NEW CERTIFICATE REQUEST-----");
         ps.close();
     certfos.close();
    public static byte [] encodeAndSign(X500Signer requester, PKCS10 pkcs10, CadT1Client cad)
    throws CertificateException, IOException, SignatureException
            DerOutputStream out, scratch;
            byte [] certificateRequestInfo;
            byte [] sig;
            byte [] encCSR;
            X500Name subject = requester.getSigner();
            // Encode CSR info, wrap in a sequence for being signed.           
            scratch = new DerOutputStream();
            // PKCS #10 v1.0.
            scratch.putInteger(BigInteger.ZERO);
            // X.500 name.
            subject.encode(scratch);
            // Public key.
            Key subjectPublicKeyInfo = pkcs10.getSubjectPublicKeyInfo();
               scratch.write(subjectPublicKeyInfo.getEncoded());
            PKCS10Attributes attributeSet = new PKCS10Attributes();
               attributeSet.encode(scratch);
            out = new DerOutputStream();
            // Wrap it.
            out.write(DerValue.tag_Sequence, scratch);
            certificateRequestInfo = out.toByteArray();
            scratch = out;
            // Send certificateRequestInfo to the card in order to be signed by the private key.
            // Create a SHA1 hash of the CSR
            MessageDigest csrMD = null;
            csrMD = MessageDigest.getInstance("SHA");
            csrMD.update(certificateRequestInfo);
            byte[] hashCodeCSR = csrMD.digest();
            // Send APDU command to the smart card to ask it for signing the request.
             Apdu apdu = new Apdu();
             prepareAPDU (apdu, PROCESS_SIGN_CERT_REQUEST_INS);
            // Add hash code to be signed to the APDU data.
             apdu.setDataIn(hashCodeCSR);
             exchangeAPDUs (apdu, cad);
             checkAPDUStatus (apdu, "Error asking for signing CSR");
             // Get the data sent in the APDU response.
             sig = apdu.getDataOut();
             // Add signature algorithm.
            requester.getAlgorithmId().encode(scratch);
            // Add signature and marshals DER bit string.
            scratch.putBitString(sig);
            // Wrap those guts in a sequence.
            out = new DerOutputStream();
            out.write(DerValue.tag_Sequence, scratch);
            encCSR = out.toByteArray();
            return encCSR;
    }The encodeAndSign is similar to this encodeAndSign , but modified to be adapted to what I need.
I do not understand which is the problem at all, could you help me? Taking in account the openssl's reply, I think the problem is in the way to sign.
Thank you in advance,
E_L