How to sign a digest generated by signtool /dg

[liammacisaac]

I have a question that is similar to #171 and #176.

I have a REST API that provides a centralised code signing service. I'd like to migrate the server side to JSign rather than signtool to avoid HSM PIN entry. At present, the API can do two things:

1. Accept an uploaded executable file, sign it and send the signed file in the response. This is easily achieved with JSign.
2. Accept a digest generated with signtool /dg (generated on client side), sign the digest using signtool /ds (server side) and then use signtool /di on the client side to ingest the signed digest into the executable.

Is there a way that I can use JSign to achieve the signtool /ds (sign digest) task, specifically with a YubiKey? I'm happy enough to write the Java code myself, but it's not obvious which interface I need to hook into to achieve this.

[ebourg]

Implementing .dig signing shouldn't be difficult, you just have to implement the Signable interface and add a SignableProvider for .dig files. That's a bit a degenerated case because the file doesn't really contain the signature, and the signature isn't a full PKCS7 message, but that could work.

If your REST API is in Java you can also use the Jsign API instead of the command line tool. You can use the JCA provider with the standard Java crypto classes like this:

Provider provider = new JsignJcaProvider();
KeyStore keystore = KeyStore.getInstance(YUBIKEY.name(), provider);
keystore.load(null, accessToken);

PrivateKey key = (PrivateKey) keystore.getKey(alias, null);

Signature signature = Signature.getInstance("SHA256withRSA", provider);
signature.initSign(key);
signature.update(message.getBytes());
signature.sign();

That said, did you consider using Jsign on the client side. By implementing a SigningService Jsign could call directly your REST API.

[liammacisaac]

That solution works perfectly. Thank you for the quick reply. I ultimately didn't create the SignableProvider for the digest files but instead used the Java API. We'll also take the suggestion of using JSign on the client side as well.