Testing Digital Signature Verification

Question

I'm testing a system which involves updating a database using files sent from external parties. These files sent from external parties are basically just large flat files to update a database. The requirement is that these files must be signed used a File Signing Key in accordance with the FIPS 186-4 Digital Signature Standard using SHA-256 hashing algorithm and encrypting the derived hash using an RSA Digital Signing Algorithm of 2048-bit modulus in accordance with PKCS #1. The SHA-256 hashing algorithm will be applied to the entire data file. This will result in a digital signature of 2048 bits in Octet form, which will be appended within the file.

To test that the system verifies the signature correctly, I need to firstly sign the file. Information Security is not really my forte and I would appreciate guidance in the right direction. Is there a tool that I can use to perform this? Apart from the certificates, what would the pre-requisites be?

Many thanks.

Answer 1

The text you quote basically means: the file is signed with RSA, and the signature is appended "as is" to the file. There is nothing about certificates here; signatures use keys. Certificates are ways to bind public keys to identities. The passage you quote, though atrocious in many ways, is still relatively clear about the certificates: there are none here.

Signatures make sense only relatively to verification:

• The signature is produced with, as inputs, the data to sign (the entire file) and the private key.
• The verification takes as input the signed data (the entire file, again), the signature, and the public key, and tells you whether the signature is good or not.

As you describe the problem, the database expects input files to be signed with a specific private key, corresponding to the public key that the database will use for the verification. If you do not have that private key at hand, then you will not be able to generate signatures. You need that key if you want to sign a file of your own. Otherwise, that's an absolute no-way.

If you have the private key in some format or another, you will still need to write a little piece of code to compute the signature and append it to the file (this simple "appending" process is not a standard signature format, so you won't get a standalone off-the-shelf tool to do it). This can be done in many programming frameworks, e.g. with Java (using java.security.Signature) or C (with some library like OpenSSL).

Anyway, in cryptography, you can do no decent testing "from the outside". The best you can do is to take an existing signed update file, that the database accepts; then modify the signature (change the value of one of the bytes of the signature, which should be the last 256 bytes of the signed file, from your description), and see that the file with the modified signature is no longer accepted by the database. This would demonstrate that the database "verifies something", not that it does it correctly. Knowing whether a cryptographic system does its job adequately is not done by testing but by auditing the code.