December 16, 2011 at 14:29We connect Rutoken EDS to OpenSSL
UPDATE A ready-made solution for electronic signature in the browser is Rutoken Plugin.
As you know, OpenSSL version 1.0.0 and older supports Russian GOST cryptographic algorithms, and support for these algorithms is fully functional: signature and encryption are implemented in PKCS # 7, CMS, S / MIME formats in accordance with Russian standards and RFC; TLS protocol with support for Russian encryptions, etc.
Thus, OpenSSL is fully compatible with proprietary cryptographic protection tools of Russian manufacturers.
To support GOSTs, a special “plug-in” is added to it - engine gost. At the same time, there are cryptographic USB tokens with the hardware implementation of Russian cryptographic algorithms on board. An example of such a token is the Rutoken EDS, which, incidentally, is certified as a cryptocurrency protection certificate in class KC2. Rootoken EDS can be connected to OpenSSL in such a way that cryptographic operations will be done on the “board” of the token.
There is a special cross-platform plug-in for OpenSSL for the Rutoken EDS - the engine pkcs11_gost, which allows you to use hardware release of GOSTs through the standard OpenSSL interface.
Here I will describe how this is done on win32.
1. OpenSSL can be taken from here www.slproweb.com/products/Win32OpenSSL.html. When installing in the “Select Additional Tasks” dialog, select “The OpenSSL binaries (/ bin) directory”.
2. The plugin and the libraries it needs can be downloaded at www.rutoken.ru/download/software/forum/pkcs11-gost-win32-4.2.0.zip .
3. The contents of the archive should be copied to the OpenSSL / bin installation folder. In this case, the openssl config. cfg needs to be replaced, since the archive contains a configuration for engine pkcs11_gost.
4. Then run cmd.exe (or whatever you like) and specify our config in the environment variables SET OPENSSL_CONF = full path to the openssl.cfg configuration file.
5. Now you need to install the Rutoken driver, connect the EDS to the Rutoken computer and format it through the Control Panel-> Rutoken Control Panel.
Using the openssl.exe utility, we will go through a path that will allow us to sign the file. At the same time, cryptographic operations (and here key generation and electronic signature are used) will be performed “on board” the Rutoken EDS.
1. Generate a signature key GOST R 34.10-2001:
2. Create an application for a certificate in PKCS # 10 format for the generated key:
3. Create a self-signed root certificate in order to issue a user certificate for the application. First, we will generate a CA key inside the token:
Then we ourselves will issue a root certificate for this key:
4. Issue the certificate for the application received in step 2. To do this, in the OpenSSL / bin installation folder, create the demoCA folder in which we will create the newcerts folder. In the demoCA folder, create an empty index.txt file and a serial file in which we write 01. This will allow us to keep track of issued certificates. Certificate issuing team:
5. We will sign an arbitrary file with an “attached” signature in S / MIME
format : in PKCS # 7
format : in CMS format:
A more detailed description of using OpenSSL with Rutoken EDS can be found on forum.rutoken.ru/topic/1639 .
As you know, OpenSSL version 1.0.0 and older supports Russian GOST cryptographic algorithms, and support for these algorithms is fully functional: signature and encryption are implemented in PKCS # 7, CMS, S / MIME formats in accordance with Russian standards and RFC; TLS protocol with support for Russian encryptions, etc.
Thus, OpenSSL is fully compatible with proprietary cryptographic protection tools of Russian manufacturers.
To support GOSTs, a special “plug-in” is added to it - engine gost. At the same time, there are cryptographic USB tokens with the hardware implementation of Russian cryptographic algorithms on board. An example of such a token is the Rutoken EDS, which, incidentally, is certified as a cryptocurrency protection certificate in class KC2. Rootoken EDS can be connected to OpenSSL in such a way that cryptographic operations will be done on the “board” of the token.
There is a special cross-platform plug-in for OpenSSL for the Rutoken EDS - the engine pkcs11_gost, which allows you to use hardware release of GOSTs through the standard OpenSSL interface.
Here I will describe how this is done on win32.
1. OpenSSL can be taken from here www.slproweb.com/products/Win32OpenSSL.html. When installing in the “Select Additional Tasks” dialog, select “The OpenSSL binaries (/ bin) directory”.
2. The plugin and the libraries it needs can be downloaded at www.rutoken.ru/download/software/forum/pkcs11-gost-win32-4.2.0.zip .
3. The contents of the archive should be copied to the OpenSSL / bin installation folder. In this case, the openssl config. cfg needs to be replaced, since the archive contains a configuration for engine pkcs11_gost.
4. Then run cmd.exe (or whatever you like) and specify our config in the environment variables SET OPENSSL_CONF = full path to the openssl.cfg configuration file.
5. Now you need to install the Rutoken driver, connect the EDS to the Rutoken computer and format it through the Control Panel-> Rutoken Control Panel.
Using the openssl.exe utility, we will go through a path that will allow us to sign the file. At the same time, cryptographic operations (and here key generation and electronic signature are used) will be performed “on board” the Rutoken EDS.
1. Generate a signature key GOST R 34.10-2001:
openssl genpkey -engine pkcs11_gost -algorithm GOST2001 -pkeyopt slot_key_id:50 -pkeyopt paramset:A -pkeyopt pin:123456782. Create an application for a certificate in PKCS # 10 format for the generated key:
openssl req -engine pkcs11_gost -new -key 50 -keyform engine -out req.csr3. Create a self-signed root certificate in order to issue a user certificate for the application. First, we will generate a CA key inside the token:
openssl genpkey -engine pkcs11_gost -algorithm GOST2001 -pkeyopt slot_key_id:100 -pkeyopt paramset:A -pkeyopt pin:12345678Then we ourselves will issue a root certificate for this key:
openssl req -engine pkcs11_gost -x509 -new -key 100 -keyform engine -out ca.crt4. Issue the certificate for the application received in step 2. To do this, in the OpenSSL / bin installation folder, create the demoCA folder in which we will create the newcerts folder. In the demoCA folder, create an empty index.txt file and a serial file in which we write 01. This will allow us to keep track of issued certificates. Certificate issuing team:
openssl ca -engine pkcs11_gost -keyfile 100 -keyform engine -cert ca.crt -in req.csr -out tester.crt5. We will sign an arbitrary file with an “attached” signature in S / MIME
openssl smime -engine pkcs11_gost -sign -in [имя файла] -out [подписанный файл] -nodetach -binary -signer tester.crt -inkey 50 -keyform engineformat : in PKCS # 7
openssl smime -engine pkcs11_gost -sign -in [имя файла] -out [подписанный файл] -nodetach -binary -signer tester.crt -inkey 50 -keyform engine -outform PEMformat : in CMS format:
openssl cms -engine pkcs11_gost -sign -in [имя файла] -out [подписанный файл] -nodetach -binary -signer tester.crt -inkey 50 -keyform engine -outform PEMA more detailed description of using OpenSSL with Rutoken EDS can be found on forum.rutoken.ru/topic/1639 .
