Skip to content

docs: Fix docs about encodings for PIV signing command #239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 10, 2025
Merged

docs: Fix docs about encodings for PIV signing command #239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eba2ef0
docs: Fixed DER encoding of DigestInfo for PIV signing command
YourMJK Jun 7, 2025
c14c479
docs: Fixed typo in response APDU for PIV signing command
YourMJK Jun 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/users-manual/application-piv/apdu/auth-sign.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ The signature is returned encoded as follows,

For example, with RSA-2048, the signature will be

7C 82 01 04 82 828 01 00 <256-byte signature>
7C 82 01 04 82 82 01 00 <256-byte signature>

With ECC-P256, the signature will be

Expand Down
11 changes: 6 additions & 5 deletions docs/users-manual/application-piv/commands.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -880,21 +880,22 @@ For example, if using PKCS 1 v 1.5, before calling, build the following block.

For a 2048-bit key, the block is 256 bytes long (the leading 00 byte is one of the 256).

If the digest algorithm is SHA-256, the DER of the DigestInfo will be 49 bytes long:
If the digest algorithm is SHA-256, the DER of the DigestInfo will be 51 bytes long:

30 2f
30 0b
30 31
30 0d
06 09
60 86 48 01 65 03 04 02 01
05 00
04 20
<32-byte digest>

The block to pass to the YubiKey will be

00 01 FF FF ... FF 00 \<49-byte DER of DigestInfo\>
00 01 FF FF ... FF 00 \<51-byte DER of DigestInfo\>
^ ^
| |
-------------- 204 bytes of 0xFF
-------------- 202 bytes of 0xFF
```

PSS (Probabilistic Signature Scheme) is much more complicated. If you want to learn how to
Expand Down