Signature seems invalid in csr because of conflicting key types(PKCS#1 and PKCS#8)

I have created public key and private key in my smartcard(Dongle) using safenet sdk's own library. I realized that Both are in PKCS#8 format. Both Private key and Public Key starts with "BEGIN PUBLIC KEY" and "BEGIN PRIVATE KEY" instead of "BEGIN RSA PUBLIC KEY" and "BEGIN RSA PRIVATE KEY".

I also signed CertificationInfo's(ex: Distinguished Names such as common name, postal code etc.). Then I am sending PubLic Key and the signed Data to my swift application to generate csr.

In csr generation step, I converted the public key to rsa format by removing first 32 characters, then convert it to SecKey to generate csr. I found that, after extracting seckey to Data, it is same before and after the SecKey conversion.

But, when i validate the signature with public key, It says that "Signature is invalid". Is it because the public key is in PKCS#1 format and the private key by whom the CertificationInfo is signed is in PKCS#8 format?

If this is the reason, what will be the probable fix to resolve the issue? Do i need to convert the Key format in native end(using C code)? What is the mechanism of generating PKCS#1 format key in C? Or, Is there any way to generate PKCS#8 SecKey using swift?

In csr generation step, I converted the public key to rsa format by removing first 32 characters

You don’t need to do that. For RSA public keys, SecKeyCreateWithData supports both RSAPublicKey data and that data within a SubjectPublicKeyInfo wrapper. See On Cryptographic Key Formats and Importing Cryptographic Keys.

But, when i validate the signature with public key, It says that "Signature is invalid". Is it because the public key is in PKCS#1 format and the private key by whom the CertificationInfo is signed is in PKCS#8 format?

No. If the RSA public key was imported correctly, it shouldn’t matter what specific format the private key was in when the signer signed it. I suspect that you have some other issue, like mismatch in the exact signing algorithm.

Does your third-party vendor’s SDK come with any test vectors?

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Signature seems invalid in csr because of conflicting key types(PKCS#1 and PKCS#8)
 
 
Q