Experience in using the RUTOKEN technology for user registration and authentication in the system (part 3)

Good day!

In the previous part we successfully created our own certification authority. How can it be useful for our purposes?

With the help of a local certification authority, we can issue certificates and also verify signatures using these certificates.

When issuing a certificate to a user, the certification authority uses a special certificate issuance request Pkcs#10, which has the file format '.csr'. This request contains an encoded sequence that the certification authority knows how to correctly parse. The request includes both the user's public key and the data for creating the certificate (an associative array with user data).

We will discuss how to obtain a certificate issuance request in the next article, but in this one, I want to present the main commands of the certification authority that will help us accomplish our task on the backend.

So, first we need to create a certificate. For this, we use the command:

openssl ca -batch -in user.csr -out user.crt

ca — the openSSL command that relates to the certification authority,
-batch — disables confirmation prompts when generating the certificate.
user.csr — the request for certificate creation (file in .csr format).
user.crt — the certificate (the result of the command).

For this command to work, the certification authority must be configured exactly as described in the previous part of the article. Otherwise, you will need to specify the location of the root certification authority certificate.

Certificate verification command:

openssl cms -verify -in authenticate.cms -inform PEM -CAfile /Users/……/demoCA/ca.crt -out data.file

cms — the openSSL command used for signing, verifying, encrypting data, and other cryptographic operations with openSSL.

-verify — in this case, we are performing certificate verification.

authenticate.cms — the file containing the signed data by the certificate issued by the previous command.

-inform PEM — using the PEM format.

-CAfile /Users/……/demoCA/ca.crt — the path to the root certificate. (without this, my command did not work, even though paths to ca.crt are specified in openssl.cfg)

-out data.file — sending the decrypted data to the file data.file.

The algorithm for applying the certificate authority on the backend is as follows:

• User Registration:
  1. We receive a request to create a certificate and save it in the file user.csr.
  2. Save the first command of this article in a file with a .bat or .cmd extension. Run this file from the code, after saving the certificate creation request in the file user.csr. We obtain the certificate file user.crt.
  3. Read the file user.crt and send it to the client.

• User Authentication:
  1. We receive signed data from the client and save it in the file authenticate.cms.
  2. Save the second command of this article in a file with a .bat or .cmd extension. Run this file from the code, after saving the signed data from the server in authenticate.cms. We obtain the file with the decrypted data data.file.
  3. Read data.file and check this data for validity. What exactly to check is described in the first article. If the data is valid, the user authentication is considered successful.

Any programming language used for backend development can be used to implement these algorithms.

In the next article, we will explore how to work with the RUTOKEN plugin.

Thank you for your attention!

Source: habr.com