CryptSignHash

This function is used to sign a piece of data. Because all signature algorithms are asymmetric and therefore slow, the CryptoAPI does not let data be signed directly. Instead, you must first hash the data and then use CryptSignHash to sign the hash value.

BOOL WINAPI CryptSignHash( 
HCRYPTHASH hHash, 
DWORD dwKeySpec, 
LPCTSTR sDescription, 
DWORD dwFlags,
BYTE *pbSignature, 
DWORD *pdwSigLen);

Parameters

• hHash
  [in] Handle to the hash object to be signed.

• dwKeySpec
  [in] Specifies the key pair to use to sign the hash. The following keys can be specified.

  Value	Description
  AT_KEYEXCHANGE	Exchange private key
  AT_SIGNATURE	Signature private key

  The signature algorithm used is specified when the key pair was originally created.

  The only signature algorithm that the Microsoft Base Cryptographic Provider supports is the RSA Public-Key algorithm.

• sDescription
  [in] No longer used; set to NULL to prevent security vulnerabilities. However, it is still supported for backward compatibility in the Microsoft Base Cryptographic Provider.

• dwFlags
  [in] Specifies a bitmask of flags. This parameter is reserved for future use and should always be zero.

• pbSignature
  [out] Pointer to a buffer that receives the signature data.

  This parameter can be NULL to set the size of this information for memory allocation purposes.

• pdwSigLen
  [in/out] Pointer to a variable that specifies the size, in bytes, of the buffer pointed to by the pdwSigLen parameter. When the function returns, the variable pointed to by the pdwSigLen parameter contains the number of bytes stored in the buffer.

  Note that when processing the data returned in the buffer, applications need to use the actual size of the data returned. The actual size may be slightly smaller than the size of the buffer specified on input. (On input, buffer sizes are usually specified large enough to ensure that the largest possible output data will fit in the buffer.) On output, the variable pointed to by this parameter is updated to reflect the actual size of the data copied to the buffer.

Return Values

TRUE indicates success. FALSE indicates failure. To get extended error information, call GetLastError. Common values for GetLastError are described in the following table. The error values prefaced by "NTE" are generated by the particular CSP you are using.

Remarks

Before calling this function, the CryptCreateHash function must be called to get a handle to a hash object. The CryptHashData or CryptHashSessionKey function is then used to add the data or session keys to the hash object.

After this function has been completed, the only hash function that can be called using the hHash handle is the CryptDestroyHash function.

Windows CE does not support the ANSI version of this function.

Example

#include <wincrypt.h>

HCRYPTPROV hProv = 0;
#define BUFFER_SIZE 256
BYTE pbBuffer[BUFFER_SIZE];
HCRYPTHASH hHash = 0;
BYTE *pbSignature = NULL;
DWORD dwSigLen;
LPTSTR szDescription = TEXT("Test Data");
DWORD i;

// Get a handle to the default provider.
if(!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, 0)) {
 printf("Error %x during CryptAcquireContext!\n", GetLastError());
 goto done;
}

// Fill the buffer with test data.
for(i = 0 ; i < BUFFER_SIZE ; i++) {
 pbBuffer[i] = (BYTE)i;
}

// Create a hash object.
if(!CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash)) {
 printf("Error %x during CryptCreateHash!\n", GetLastError());
 goto done;
}

// Compute the cryptographic hash of the buffer.
if(!CryptHashData(hHash, pbBuffer, BUFFER_SIZE, 0)) {
 printf("Error %x during CryptHashData!\n", GetLastError());
 goto done;
}

// Determine the size of the signature and allocate memory.
dwSigLen= 0;
if(!CryptSignHash(hHash, AT_SIGNATURE, TEXT(""), 0, NULL, 
 &dwSigLen)) {
 printf("Error %x during CryptSignHash!\n", GetLastError());
 if(GetLastError()!=NTE_BAD_LEN) goto done;
}
if((pbSignature = malloc(dwSigLen)) == NULL) {
 printf("Out of memory!\n");
 goto done;
}

// Sign the hash object.
if(!CryptSignHash(hHash, AT_SIGNATURE, szDescription, 0, pbSignature, 
 &dwSigLen)) {
 printf("Error %x during CryptSignHash!\n", GetLastError());
 goto done;
}

// Store or transmit the signature, test buffer, and description string.
...

done:

// Free memory to be used to store signature.
if(pbSignature != NULL) free(pbSignature);

// Destroy the hash object.
if(hHash != 0) CryptDestroyHash(hHash);

// Release the provider handle.
if(hProv != 0) CryptReleaseContext(hProv, 0);

Requirements

Note   This API is part of the complete Windows CE OS package as provided by Microsoft. The functionality of a particular platform is determined by the original equipment manufacturer (OEM) and some devices may not support this API.

See Also

CryptCreateHash, CryptDestroyHash, CryptHashData, CryptHashSessionKey, CryptVerifySignature

 Last updated on Tuesday, July 13, 2004

© 1992-2000 Microsoft Corporation. All rights reserved.