@@ -158,140 +158,6 @@ public byte[] Sign(byte slotNumber, ReadOnlyMemory<byte> dataToSign)
158158 ExceptionMessages . IncorrectDigestLength ) ) ;
159159 }
160160
161- /// <summary>
162- /// Create a digital signature using the key in the given slot.
163- /// </summary>
164- /// <remarks>
165- /// The caller supplies the data to sign in the form of a formatted
166- /// message digest.
167- /// <para>
168- /// This method returns the digital signature created, if it can build
169- /// one. Otherwise it will throw an exception.
170- /// </para>
171- /// <para>
172- /// If the slot specified is not one that can sign, or it does not
173- /// contain a key, this method will throw an exception. If the input data
174- /// is not the correct length, the method will throw an exception.
175- /// </para>
176- /// <para>
177- /// If the key is ECC P-256, then the formatted digest is simply the
178- /// message digest itself, but it must be exactly 32 bytes. If the input
179- /// is not exactly 32 bytes, the method will throw an exception. If the
180- /// input data is shorter than 32 bytes, prepend pad bytes of 00 until
181- /// the length is exactly 32 bytes. You will almost certainly want to use
182- /// SHA-256 as the digest algorithm. The signature will be the BER
183- /// encoding of
184- /// <code>
185- /// SEQUENCE {
186- /// r INTEGER,
187- /// s INTEGER }
188- /// </code>
189- /// </para>
190- /// <para>
191- /// If the key is ECC P-384, then the formatted digest is simply the
192- /// message digest itself, but it must be exactly 48 bytes. If the input
193- /// is not exactly 48 bytes, the method will throw an exception. If the
194- /// input data is shorter than 48 bytes, prepend pad bytes of 00 until
195- /// the length is exactly 48 bytes. You will almost certainly want to use
196- /// SHA-384 as the digest algorithm. The signature will be the BER
197- /// encoding of
198- /// <code>
199- /// SEQUENCE {
200- /// r INTEGER,
201- /// s INTEGER }
202- /// </code>
203- /// </para>
204- /// <para>
205- /// If the key is RSA 1024/2048/3072/4096, then the input must be exactly 128/256/384/512 bytes,
206- /// otherwise the method will throw an exception. You can use the
207- /// <see cref="Cryptography.RsaFormat"/> class to format the data. That
208- /// class will be able to format the digest into either PKCS #1 v1.5 or a
209- /// subset of PKCS #1 PSS. However, if that class does not support the
210- /// exact format you want, you will have to write your own formatting
211- /// code and guarantee the input to this method is exactly 128/256/384/512 bytes
212- /// (prepend pad bytes of 00 until the length is exactly 128/256/384/512 if needed).
213- /// The signature will be a 128/256/384/512-byte block.
214- /// </para>
215- /// <para>
216- /// Signing might require the PIN and/or touch, depending on the PIN and
217- /// touch policies specified at the time the key was generated or
218- /// imported.
219- /// </para>
220- /// <para>
221- /// If a PIN is required, this method will call the necessary
222- /// routines to verify the PIN. See <see cref="VerifyPin()"/> for more
223- /// information on PIN verification. If the user cancels, this method
224- /// will throw an exception.
225- /// </para>
226- /// <para>
227- /// If touch is required, the YubiKey itself will flash its touch signal
228- /// and wait. If the YubiKey is not touched before the touch timeout, the
229- /// YubiKey will return with an error, and this method will throw an
230- /// exception (<c>OperationCanceledException</c>). Note that this method
231- /// will not make another effort to sign if the YubiKey is not touched,
232- /// it will simply throw the exception.
233- /// </para>
234- /// <para>
235- /// Note that on YubiKeys prior to version 5.3, it is not possible to know
236- /// programmatically what the PIN or touch policies are without actually
237- /// trying to sign. Also, it is not possible to know programmatically if
238- /// an authentication failure is due to PIN or touch. This means that on
239- /// older YubiKeys, this method will try to sign without the PIN, and if
240- /// it does not work because of authentication failure, it will not know
241- /// if the failure was due to PIN or touch. Hence, it will try to verify
242- /// the PIN then try to sign again. This all means that on older
243- /// YubiKeys, it is possible a YubiKey slot was originally configured
244- /// with a PIN policy of "never" and a touch policy of "always", and this
245- /// method will call for the PIN anyway. This happens if the user does
246- /// not touch the YubiKey before the timeout. See the User's Manual entry
247- /// on <xref href="UsersManualPivKeepingTrack">keeping track</xref> of
248- /// slot contents.
249- /// </para>
250- /// </remarks>
251- /// <param name="slotNumber">
252- /// The slot containing the key to use.
253- /// </param>
254- /// <param name="dataToSign">
255- /// The formatted message digest.
256- /// </param>
257- /// <param name="keyType">The algorithm to use.</param>
258- /// <returns>
259- /// The resulting signature.
260- /// </returns>
261- /// <exception cref="ArgumentException">
262- /// The slot number given was not valid, or the data to sign was an
263- /// invalid length.
264- /// </exception>
265- /// <exception cref="InvalidOperationException">
266- /// There was no key in the slot specified or the data did not match the
267- /// key (e.g. the data to sign was 32 bytes long but the key was ECC
268- /// P-384).
269- /// </exception>
270- /// <exception cref="OperationCanceledException">
271- /// Either the PIN was required and the user canceled collection or touch
272- /// was required and the user did not touch within the timeout period.
273- /// </exception>
274- /// <exception cref="SecurityException">
275- /// The remaining retries count indicates the PIN is blocked.
276- /// </exception>
277- /// <exception cref="NotSupportedException">
278- /// If the specified <see cref="PivAlgorithm"/> is not supported by the provided <see cref="IYubiKeyDevice"/>.
279- /// </exception>
280- public byte [ ] Sign ( byte slotNumber , ReadOnlyMemory < byte > dataToSign , KeyType keyType )
281- {
282- var pivAlgorithm = keyType . GetPivAlgorithm ( ) ;
283- YubiKey . ThrowIfUnsupportedAlgorithm ( pivAlgorithm ) ;
284-
285- var signCommand = new AuthenticateSignCommand ( dataToSign , slotNumber , pivAlgorithm ) ;
286- return PerformPrivateKeyOperation (
287- slotNumber ,
288- signCommand ,
289- signCommand . Algorithm ,
290- string . Format (
291- CultureInfo . CurrentCulture ,
292- ExceptionMessages . IncorrectDigestLength ) ) ;
293- }
294-
295161 /// <summary>
296162 /// Decrypt the given data using the key in the given slot.
297163 /// </summary>
0 commit comments