ECDSA 384 签名验证的不同结果：GO 失败，PHP 失败

在验证智能卡生成的 ECDSA 384 签名时，Go 代码无法验证签名，而 PHP 代码可以。问题源于 Go 中消息哈希的处理。在 Go 代码中，原始消息哈希未显式哈希，导致验证失败。

我面临一个问题，我必须验证智能卡生成的签名。签名采用 ecdsa 384 格式，所使用的消息是 sha-384 哈希字符串的两个字节数组（连接在一起）。我有一个用 php 编写的示例代码来执行签名验证，它按预期工作。然而，当我尝试在 go 中重现相同类型的验证时，无论我如何尝试，都无法验证签名。

我相信 go 中的原始消息哈希有问题，它没有验证它，但我无法弄清楚我做错了什么。也许有人可以指出实际原因是什么？我将 php 和 go 代码示例以及示例数据放在这里进行验证：

这是 php ecdsa 384 签名验证的代码：

<?php

function p1363_to_asn1(string $p1363): string {
    // p1363 format: r followed by s.

    // asn.1 format: 0x30 b1 0x02 b2 r 0x02 b3 s.
    //
    // r and s must be prefixed with 0x00 if their first byte is > 0x7f.
    //
    // b1 = length of contents.
    // b2 = length of r after being prefixed if necessary.
    // b3 = length of s after being prefixed if necessary.

    $asn1  = '';                        // asn.1 contents.
    $len   = 0;                         // length of asn.1 contents.
    $c_len = intdiv(strlen($p1363), 2); // length of each p1363 component.

    // separate p1363 signature into its two equally sized components.
    foreach (str_split($p1363, $c_len) as $c) {
        // 0x02 prefix before each component.
        $asn1 .= "\x02";

        if (unpack('c', $c)[1] > 0x7f) {
            // add 0x00 because first byte of component > 0x7f.
            // length of component = ($c_len + 1).
            $asn1 .= pack('c', $c_len + 1) . "\x00";
            $len += 2 + ($c_len + 1);
        } else {
            $asn1 .= pack('c', $c_len);
            $len += 2 + $c_len;
        }

        // append formatted component to asn.1 contents.
        $asn1 .= $c;
    }

    // 0x30 b1, then contents.
    return "\x30" . pack('c', $len) . $asn1;
}

$public_key_pem = "-----begin public key-----
mhyweayhkozizj0caqyfk4eeacidygaej4dnbrsp2ee8hstj3ubddzjuf5e2+n7j
h36jxjtx568ml7hgyo/u/oouqtczld5ps6klbfklwep58blvxxru+n225wtp0pii
kjudsfwdmhr16+wtbxjsyoaqaoym6xwa
-----end public key-----";
$public_key = openssl_pkey_get_public($public_key_pem);

$signature = "qfxwpqkdtl95mmcta2bkndy32ds6i+ndlprqlbi2+niqolgssjmrvvallq7b50lqxrsripfiyi+m9wxajxce3ao20fetqwcvr1sp+lyxquizkqrijm3vw/ghtgmhjlqv";
$nounce = "mpaeifrl7z/dfpzcaukatwxsz+h4e7jtwskzltx3yujjjuooww8dgzgkfm3a";
$origin = "https://192.168.1.3:8441";

$origin_digest = openssl_digest($origin, "sha384", true);
$nounce_digest = openssl_digest($nounce, "sha384", true);

$result = openssl_verify($origin_digest.$nounce_digest, p1363_to_asn1(base64_decode($signature)), $public_key, openssl_algo_sha384);

if ($result == 1) {
    echo "signature is valid for given data.";
} elseif ($result == 0) {
    echo "signature is invalid for given data.";
} else {
    echo "error: ".openssl_error_string();
}

这是我在 go 中用来尝试验证 ecdsa 384 签名的代码：

package main

import (
    "crypto/ecdsa"
    "crypto/sha512"
    "crypto/x509"
    "encoding/base64"
    "encoding/pem"
    "fmt"
    "math/big"
)

func main() {

    idCardPublicKey := []byte(LoadIDCardPublicPem())
    nonce := "MPAeifrL7Z/dFPZcAukaTWxsZ+h4E7jtWsKzltx3YujjJuOOWw8dgzgKfm3a"
    origin := "https://192.168.1.3:8441"
    webeidSig := "QfXwpqkDtL95mmcTA2BknDY32Ds6i+NdLPRqlbi2+niQOLgsSJMRVVALLQ7b50LQXRsRiPfiYi+m9WXAJxCE3aO20feTQWcVR1SP+LYXQUIZKqrijm3VW/GHtGMhjlqv"
    sigVerified := VerifySignature(idCardPublicKey, nonce, origin, webeidSig)
    fmt.Println("SIG VERIFIED: ", sigVerified)

}

func VerifySignature(publicKeyByte []byte, nounce string, origin string, signatureBase64 string) bool {
    block, _ := pem.Decode(publicKeyByte)
    parseResultPublicKey, err := x509.ParsePKIXPublicKey(block.Bytes)
    fmt.Println("PARSE ERR: ", err)
    publicKey := parseResultPublicKey.(*ecdsa.PublicKey)

    originHash := sha512.New384()
    _, err2 := originHash.Write([]byte(origin))
    if err2 != nil {
        panic(err2)
    }
    originHashSum := originHash.Sum(nil)

    nounceHash := sha512.New384()
    _, err2 = nounceHash.Write([]byte(nounce))
    if err2 != nil {
        panic(err2)
    }
    nounceHashSum := nounceHash.Sum(nil)

    originHashSum = append(originHashSum, nounceHashSum...)

    signature := []byte(Base64Decoding(signatureBase64))
    rByte, sByte := signature[:len(signature)/2], signature[len(signature)/2:]
    r := new(big.Int)
    r.SetBytes(rByte)
    s := new(big.Int)
    s.SetBytes(sByte)

    valid := ecdsa.Verify(publicKey, originHashSum[:], r, s)
    return valid
}

func LoadIDCardPublicPem() []byte {
    return []byte(`-----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJ4dnbrsp2Ee8HstJ3ubDDzJuf5E2+N7J
H36jxJtX568mL7hGYo/U/ooUqtcZLd5pS6kLBFkLWeP58BlVxxru+n225WTp0PiI
kJudSFwdmHR16+WTbxJSyOaQAoyM6xWA
-----END PUBLIC KEY-----`)
}

func Base64Decoding(input string) []byte {
    data, err := base64.StdEncoding.DecodeString(input)
    if err != nil {
        return data
    }
    return data
}

正确答案

openssl_verify() 隐式哈希，ecdsa.verify() 不会。 ie。在 go 代码中，缺少 originhashsum 的哈希值：

...
originHashSum = append(originHashSum, nounceHashSum...)

// Fix: Explicit hashing
finalHash := sha512.New384()
_, err2 = finalHash.Write([]byte(originHashSum))
if err2 != nil {
    panic(err2)
}
finalHashSum := finalHash.Sum(nil)
    
...
    
valid := ecdsa.Verify(publicKey, finalHashSum[:], r, s)
...

以上就是本文的全部内容了，是否有顺利帮助你解决问题？若是能给你带来学习上的帮助，请大家多多支持golang学习网！更多关于Golang的相关知识，也可关注golang学习网公众号。