Signing with SecKeyCreateSignature and verification with OpenSSL

1. It's supported only from OSXApplicationExtension 10.15, what can I use for earlier version?

2. I already have the SecKey - how can I use it as an argument for one of the signing functions?

Can I open a DTS for a little help on this one?

what can I use for earlier version?

• -runUsingUnified, using the modern API that works on all platforms

• -runUsingTransforms, using the SecTransform API for older versions of macOS

• -runUsingRaw, using the old SecKey ‘raw’ API for older versions of iOS

I already have the SecKey

• how can I use it as an argument for one

of the signing functions?

it is true that I confront the similar issue when using the API SecKeyCreateSignature to sign the raw data based on Apple Security framework.

signedDataRef = SecKeyCreateSignature(privKeyRef, kSecKeyAlgorithmRSASignatureRaw, signDataRef, &error);

When I choose the algorithm kSecKeyAlgorithmRSASignatureRaw with the same certificate, on iOS platform it works OK. But on MAC platform, this method return "algorithm not support" error.

It looks like CTK on mac not support this algorithm. What's about the way to sign the 'raw' data by using the SecTransform API if the algorithm not support on mac?

But on Mac platform, this method return "algorithm not support" error.

macOS supports .rsaSignatureRaw. For example, this code runs just fine:

import Foundation

func main() throws {
    let privateKey = try secCall { SecKeyCreateRandomKey([
        kSecAttrKeyType: kSecAttrKeyTypeRSA,
        kSecAttrKeySizeInBits: 2048,
    ] as NSDictionary, $0) }
    let dataToSign = Data(repeatElement("Hello Cruel World!".utf8, count: 16).joined().prefix(256))
    let signature = try secCall { SecKeyCreateSignature(privateKey, .rsaSignatureRaw, dataToSign as NSData, $0) }
    print(signature)
    // prints: {length = 256, bytes = 0x7d12905d … 1ebadc0a }
}

try main()

Note It’s using the helper routines from here.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

The private key ref I got from my physical smart card with below method:

SecIdentityRef identity = xxxx;
status = SecIdentityCopyPrivateKey(identity, &privKeyRef);

and I also check the algorithm with below lines and result is fail also:

if (!SecKeyIsAlgorithmSupported(privKeyRef, kSecKeyOperationTypeSign, kSecKeyAlgorithmRSASignatureRaw)) {
      NSLog(@"Cannot support RSA Signature Algorithm kSecKeyAlgorithmRSASignatureRaw");
}

Looks like the CTK on MAC platform not support this algorithm? for I can use the similar code to sign same data on iOS platform.