helpGnuTLS - Support: sr #107785, gnutls_sign_func called with hash...


sr #107785: gnutls_sign_func called with hash size of 20 bytes

Submitted by:  Bjørn Christensen <cybear>
Submitted on:  Mon 29 Aug 2011 01:33:16 PM UTC  
Category:  Core library Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Nikos Mavrogiannopoulos <nmav>
Open/Closed:  Closed Operating System:  Microsoft Windows

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


( Jump to the original submission)

Fri 23 Sep 2011 12:18:28 PM UTC, comment #7: 

gnutls_sign_callback_set() isn't going to be removed anytime soon. Your solution would work fine if you stick to SSL 3.0 up to TLS 1.1. In TLS 1.2 you'll have issues so make sure you disable it.

Unrelated to that, making a small generic pkcs#11 interface for the MS cert store would actually be a great service.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Fri 23 Sep 2011 12:13:14 PM UTC, comment #6: 

I have solve the problem by determine the HASH algorithm from the HASH size. That is not optimal but it works.

But I would be very sorrow if you depreciated the gnutls_sign_callback_set, that would force me to write a pkcs#11 interface for MS Cert Store so I can get access to the certificates.

Bjørn Christensen <cybear>
Mon 29 Aug 2011 08:31:43 PM UTC, comment #5: 

For information on PKCS #11 with GnuTLS check the example of a TLS client using the PKCS #11 API,

and more elaborate discussion at

I don't know about your requirements, but sticking on TLS 1.0 might be the easier solution to do.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Mon 29 Aug 2011 08:26:25 PM UTC, comment #4: 

1. Unfortunately the sign callback doesn't pass the hash algorithm and seems to be relied on, only if you fix your protocol to be SSL 3.0 or TLS 1.0 (maybe TLS 1.1 too, but I don't remember).

2. You would need a PKCS #11 front-end to the microsoft certificate store. I don't know if such thing exists.

PKCS #11 is an API to access cryptographic keys without exposing them. I suppose the MCS does the same thing.

Nikos Mavrogiannopoulos <nmav>
Project AdministratorIn charge of this item.
Mon 29 Aug 2011 06:53:59 PM UTC, comment #3: 

I can see from that it have changed, now I have two questions:
1) how do I determin which hash are being used? from the hash size? or is there a call to give me the hash algorithm.
2) you say that the gnutls_sign_callback_set is depreciated, but how do I use the PKCS 11 interface, I am right now using gnutls on windows and the reason I use the gnutls_sign_callback_set is to be able to also use certificates from the Microsoft Certificate Store. I can not see how the PKCS 11 interface would help me there. Do you have any samples show how that would work?

Bjørn Christensen <cybear>
Mon 29 Aug 2011 02:24:40 PM UTC, comment #2: 

TLS 1.0 with RSA signatures uses 36 bytes. Other protocol version (TLS 1.2 for example) might use different sizes. If possible we suggest against using the sign_callback but use the gnutls pkcs11 API instead.

Mon 29 Aug 2011 01:41:09 PM UTC, comment #1: 

I will attach logfile from server and client.

(file #23892, file #23893)

Bjørn Christensen <cybear>
Mon 29 Aug 2011 01:33:16 PM UTC, original submission:  

I have used gnutls_sign_callback_set to set a sign function, and my function get called during the signing process, but the hash have a size of 20 bytes.

I expect the hash to be 36 bytes accoring to the definition in SSL/TLS the hash to be signed by the client is by definition a concatenation of a SHA1 (20 bytes) and an MD5 (16 bytes)

I am using GNUTLS 2.10.1.

Bjørn Christensen <cybear>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #23892:  client2.log added by cybear (63KiB - application/octet-stream)
file #23893:  server2.log added by cybear (62KiB - application/octet-stream)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by cybear (Submitted the item)
  • -email is unavailable- added by cybear

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-10-23 nmav StatusConfirmed => Done
        Assigned toNone => nmav
        Open/ClosedOpen => Closed
    2011-08-29 nmav StatusNone => Confirmed
    2011-08-29 cybear Attached File- => Added client2.log, #23892
        Attached File- => Added server2.log, #23893
    2011-08-29 cybear Carbon-Copy- => Added cybear

    Back to the top

    Powered by Savane 3.7