签名验签

1. 生成公私钥对

以下算法只支持生成RSA和ECDSA的公私钥对：

import (
    "crypto/ecdsa"
    "crypto/elliptic"
    "crypto/rand"
    "crypto/rsa"
    "crypto/x509"
    "errors"
    "fmt"
)

// the size of ecdsa algorithm
const (
    curveP256 = 256
    curveP384 = 384
    curveP521 = 521
)

type AlgoType uint8

const (
    RSA AlgoType = iota + 1 // rsa
    ECC                     // ecdsa
)

// GenerateKeyPairs generates a key pairs as specified in the request. Currently,
// only ECDSA and RSA are supported.
//
// GenerateKeyPairs returns DER encoding private key and public key.
func GenerateKeyPairs(algo AlgoType, size int) ([]byte, []byte, error) {
    switch algo {
    case RSA:
        if size < 2048 {
            return nil, nil, errors.New("RSA key is too weak")
        }
        if size > 8192 {
            return nil, nil, errors.New("RSA key size too large")
        }
        priv, err := rsa.GenerateKey(rand.Reader, size)
        if err != nil {
            return nil, nil, fmt.Errorf("generate rsa key: %v", err.Error())
        }
        pub := priv.Public()
        pubBytes := x509.MarshalPKCS1PublicKey(pub.(*rsa.PublicKey))
        privBytes := x509.MarshalPKCS1PrivateKey(priv)
        return privBytes, pubBytes, nil
    case ECC:
        var curve elliptic.Curve
        switch size {
        case curveP256:
            curve = elliptic.P256()
        case curveP384:
            curve = elliptic.P384()
        case curveP521:
            curve = elliptic.P521()
        default:
            return nil, nil, errors.New("invalid ecdsa curve")
        }
        priv, err := ecdsa.GenerateKey(curve, rand.Reader)
        if err != nil {
            return nil, nil, fmt.Errorf("generate ecdsa key: %v", err.Error())
        }
        pubBytes, err := x509.MarshalPKIXPublicKey(priv.Public())
        if err != nil {
            return nil, nil, fmt.Errorf("marshal ecdsa public key: %v", err.Error())
        }
        privBytes, err := x509.MarshalECPrivateKey(priv)
        if err != nil {
            return nil, nil, fmt.Errorf("marshal ecdsa private key: %v", err.Error())
        }
        return privBytes, pubBytes, nil
    default:
        return nil, nil, errors.New("invalid algorithm")
    }
}

2. 签名

签名的步骤如下：

① 基于待签名的数据生成摘要；

② 使用私钥对摘要生成签名。

代码如下：

// Sign signs a message using a specific private key. Private key passed must
// be DER encoding. Note that using sha256 hash function to create digest.
//
// Sign returns a signature.
func Sign(privKey, msg []byte) ([]byte, error) {
    priv, err := ParsePrivateKeyDER(privKey)
    if err != nil {
        return nil, fmt.Errorf("parse private key: %v", err.Error())
    }
    // create digest
    h := sha256.New()
    h.Write(msg)
    digest := h.Sum(nil)
    // sign
    sign, err := priv.Sign(rand.Reader, digest, crypto.SHA256)
    if err != nil {
        return nil, fmt.Errorf("sign: %v", err.Error())
    }
    return sign, nil
}

由上面代码可以看出，我们使用的是sha256算法计算摘要，也可以使用其它散列算法。

由于前面生成的私钥是ASN.1 DER编码的，所以需要将其解析成crypto.Signer才能调用签名的接口，解析的代码如下：

// ParsePrivateKeyDER parses a PKCS #1, PKCS #8, ECDSA, or Ed25519 DER-encoded
// private key. The key must not be in PEM format.
func ParsePrivateKeyDER(keyDER []byte) (key crypto.Signer, err error) {
    generalKey, err := x509.ParsePKCS8PrivateKey(keyDER)
    if err != nil {
        generalKey, err = x509.ParsePKCS1PrivateKey(keyDER)
        if err != nil {
            generalKey, err = x509.ParseECPrivateKey(keyDER)
            if err != nil {
                return nil, errors.New("parse private key field.")
            }
        }
    }

    switch generalKey.(type) {
    case *rsa.PrivateKey:
        return generalKey.(*rsa.PrivateKey), nil
    case *ecdsa.PrivateKey:
        return generalKey.(*ecdsa.PrivateKey), nil
    }

    // should never reach here
    return nil, errors.New("parse private key field.")
}

3. 验签

验签的过程是将源数据再次使用上述的散列算法计算摘要，然后使用公钥将签名解签，最后将解签的结果与摘要进行对比，相同则说明验签通过，代码如下：

// VerifySignature verifies signature. Currently, only ECDSA and RSA are supported.
// Note that signature(including R and S) must be marshaled using ASN.1 standard
// when using ecdsa algorithm.
func VerifySignature(pubKey, sign, msg []byte) error {
    //Create digest
    hash := sha256.New()
    hash.Write(msg)
    digest := hash.Sum(nil)

    pub, err := x509.ParsePKIXPublicKey(pubKey)
    if err != nil {
        pub, err = x509.ParsePKCS1PublicKey(pubKey)
        if err != nil {
            return fmt.Errorf("public key of unknown type: %v", err.Error())
        }
    }
    switch pub.(type) {
    case *rsa.PublicKey:
        publickey := pub.(*rsa.PublicKey)
        err = rsa.VerifyPKCS1v15(publickey, crypto.SHA256, digest, sign)
        if err != nil {
            return fmt.Errorf("verify signature: %v", err.Error())
        }
    case *ecdsa.PublicKey:
        publickey := pub.(*ecdsa.PublicKey)
        parsedSign := struct {
            R *big.Int
            S *big.Int
        }{}
        rest, err := asn1.Unmarshal(sign, &parsedSign)
        if err != nil {
            return fmt.Errorf("parse ecc signature using ASN.1 standard: %v", err.Error())
        }
        if len(rest) > 0 {
            return errors.New("extra data in marshaled sign data.")
        }
        isValid := ecdsa.Verify(publickey, digest, parsedSign.R, parsedSign.S)
        if !isValid {
            return errors.New("verify signature failed.")
        }
    }

    return nil
}