Subject: [Ipsec] how to calculate authentication payload in case of digital signature in IKEv2.

From: jeet <[email-masked]>
Date: Fri, 25 Feb 2005 19:37:07 +0530

Hi All,

Can anybody plz tell me, how to calculate authentication payload in case 
of digital signature in IKEv2..
I am calculating the signature with following procedure.

1. For the responder, the buffer to be signed is calculated as
buffer = (complete message buffer |  Ni | prf(SK_pr,IDr') )

where Ni is initiator Nonce.
 and  IDr' is the responder's ID payload excluding the fixed header

2. Get the signed buffer by calling openssl function.

RSA_private_encrypt(bufferLength, buffer,
    signed_output, privateKey, padding);

where bufferLength is the length of the buffer to be signed.
      buffer is the buffer to be signed.
      signed_output is the buffer to get the signed data.
      privateKey is the RSA private key.
      padding used is RSA_PKCS1_PADDING.

Routine RSA_private_encrypt() is giving error.
Error string is as follows:
eay_rsa_sign(): error:0406C06E:rsa routines:RSA_padding_add_PKCS1_type_1:data too large for key size

Plz see if my procedure is wrong or I need to use some other openssl routine to calculate the sign.

Thanks in advance.
Jatinder

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked]
Date: Mon, 28 Feb 2005 14:47:53 +0200

Hi,

IKEv2 uses RSA signatures, not RSA encryption, so 
use OpenSSL's RSA_sign() function instead. 

See the documentation in openssl-*/doc/crypto/RSA_sign.pod
for details (in particular, you have to calculate the SHA-1 
of the buffer before calling RSA_sign).

Best regards,
Pasi

> -----Original Message-----
> From: [email-masked]
> Sent: Friday, February 25, 2005 4:07 PM
> To: [email-masked]
> Subject: [Ipsec] how to calculate authentication payload in case of
> digital signature in IKEv2.
> 
> 
> Hi All,
> 
> Can anybody plz tell me, how to calculate authentication
> payload in case of digital signature in IKEv2..  I am
> calculating the signature with following procedure.
> 
> eay_rsa_sign(): error:0406C06E:rsa 
> routines:RSA_padding_add_PKCS1_type_1:data too large for key size
>