[Tizen Software Development] adfree:
Memo to me...

Sign TPK... here little bit theory...

https://developer.tizen.org/develop...application/tizen-application-model#signature

What I have found about these 2 files:

author-signature.xml
signature1.xml

For Base64 encoded stuff...

Use WinHex or for instance online Decoder...

http://base64-encoding.online-domain-tools.com/

Each XML has 2 Certs inside... = 4 Certs minimum...

<X509Data>
<X509Certificate>

Decode as Base64... and you can see them... save as *.cer for instance...

Interesting to see, if Cert is expired...

SHA256 is used for files... after filename you can see this:

<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#[B]sha256[/B]"></DigestMethod>
<DigestValue>

Decode Base64... then you can compare...

Signature is easy to identify... before Certs...

</Reference>
</SignedInfo>
<SignatureValue>

In my experiment... Signatures are 128 Byte long... after Base64 decode...

So RSA 1024 Certs... you could see description in XML... at end of file:

Id="identifier" Target="#[B]Author[/B]Signature"><dsp:Identifier></dsp:Identifier></SignatureProperty></SignatureProperties></Object>
</Signature>

In this case my own Author cert... :angel:

I can copy & paste public key from Cert and decrypt Signature...

Result is again 128 Byte... last 32 Byte are SHA256

Now I have 2 little tiny problems... :D

1.

One SHA256 Value is for?

For what?

The others are for each file in package... last SHA256 starts with:

[B]<Reference URI="#prop">[/B]
<Transforms>
<Transform Algorithm="http://www.w3.org/2006/12/xml-c14n11"></Transform>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></DigestMethod>
<DigestValue>

:confused:

Means #prop... last few Bytes in XML which starts with:

</KeyInfo>
<Object Id="prop"><Signature[B]Prop[/B]erties xmlns:dsp="http://www.w3.org/2009/xmldsig-properties"><SignatureProperty

:confused: :confused:

2.

SHA256 in Signature is not the same, encoded as Base64...

Also it seems not whole file is signed complete...

3.

Little Endian seems mistake in my Brain...

:o

Long time ago I have played little bit with Qualcomm BREW...

http://forum.gsmhosting.com/vbb/f83/brew-signature-certificates-492942/

For Wave and bada, we had some nice Tool to change Cert and Sigs... :angel:

In Tizen World in Z1 and Z3... forgotten if also in Reference devices... there are few funny Scripts... *.sh

signature-replace.sh for instance

#If signature file is not existed, create it with test certificates.
#if test ! -e "$signBase/$signFile"
#then
# if test "$authorSigJob" == "1"
# then
# $hashSignerScript -a "$signBase" -w $pkgId
# else
# $hashSignerScript -d -p $privilegeLevel "$signBase" -w $pkgId
# fi
#fi

#########################################################
#Job for distribur signature
if test "$authorSigJob" == "0"
then
#author-signature.xml can be modified in previous signature-replace.sh job.
#So hash value of author-signature.xml in signature1.xml should be re-calculated.
authorSignatureHash=$(openssl sha256 -binary $signBase/author-signature.xml \
| $base64Tool)
xmlstarlet ed -L -N s="http://www.w3.org/2000/09/xmldsig#" \
-u "/s:Signature/s:SignedInfo/s:Reference[@URI='author-signature.xml']/s:DigestValue" \
-v $authorSignatureHash \
$signBase/$signFile
objectHash=$(xmlstarlet sel -N s="http://www.w3.org/2000/09/xmldsig#" \
-t -c "/s:Signature/s:eek:bject" \
"$signBase"/"$signFile" \
| xmlstarlet c14n \
| openssl sha256 -binary \
| $base64Tool)
xmlstarlet ed -L -N s="http://www.w3.org/2000/09/xmldsig#" \
-u "/s:Signature/s:SignedInfo/s:Reference[@URI='#prop']/s:DigestValue" \
-v $objectHash \
$signBase/$signFile
fi

#Calculate hash value of SignedInfo and send it to Signing Server
signedInfoHash=$(xmlstarlet sel -N s="http://www.w3.org/2000/09/xmldsig#" \
-t -c "/s:Signature/s:SignedInfo" $signBase/$signFile \
| xmlstarlet c14n \
| openssl sha256 -binary \
| $base64Tool)
#echo "signature hash is $signedInfoHash"

But I am not able to use these Scripts... :o :rolleyes:

Best Regards