I write some certificate Authority that has it's own private/public cert keys . This CA signs public keys of user. If for example i have user that has a public cert that signed by the CA. How I can verify later that the user's certificate as indeed signed by that CA if he has the public cert of the CA ? I'm using cryptography module in Python, and there are some functions that i can use but I'm not sure how: The representation of both certificates is X.509 , which means that one can grab the public key of the user and use verify method, this is how i used it :

caCert.public_key().verify(clientCert.signature,clientCert.tbs_certificate_bytes,padding.PSS(       mgf=padding.MGF1(hashes.SHA256()),salt_length=padding.PSS.MAX_LENGTH),clientCert.signature_hash_algorithm)     

But i still get invalid signature error


closed as off-topic by SEJPM, fgrieu, e-sushi Oct 12 '17 at 15:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm, protocol or side-channel (mitigation) works, you should look into asking on Stack Overflow instead." – SEJPM, fgrieu, e-sushi
If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ You probably want to use a dedicated X.509 validation library for this instead of doing it yourself. $\endgroup$ – SEJPM Oct 12 '17 at 12:39
  • $\begingroup$ Yes, I'm using this library cryptography.io/en/latest/x509/reference/… $\endgroup$ – KaramJaber Oct 12 '17 at 12:59
  • $\begingroup$ Note that most certificates are not signed using PSS but rather using PKCS#1 v1.5 $\endgroup$ – SEJPM Oct 12 '17 at 13:20
  • $\begingroup$ @SEJPM you are right...that was the problem $\endgroup$ – KaramJaber Oct 12 '17 at 13:35

Your code should work.

However you (implicitely?) assume the certificate uses PSS padding for the RSA signature. While this is possible, it is extremely rare in practice, you should try validation using PKCS#1 v1.5 signature padding instead.

Converted my last comment to an answer because it apparently solved the problem.

  • 1
    $\begingroup$ Even better look at the sigAlg field(s) in the cert to determine the correct algorithm+padding, and in the rare case they do specify RSA-PSS look at the parameters there and use them or else the standard-specified defaults (see rfc 3447 or 8017) not arbitrary ones. And of course verifying the issuer's signature on a cert is not nearly enough to establish it should be trusted, for a particular purpose or at all; see rfc 5280. $\endgroup$ – dave_thompson_085 Oct 13 '17 at 2:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.