MD5WithRSA digital signatures

[Werner Koch]

On Thu,  9 Jun 2011 23:24, mailjohnmorris at gmail.com said:

> Signature sig = Signature.getInstance("MD5WithRSA");

I don't know what scheme this is.  Is it pkcs#1 (v1.5 or PSS)?

> gcry_md_hash_buffer(GCRY_MD_MD5, md5, data, dataLen);
> rc = gcry_sexp_build(&data_sexp, NULL, "(data(flags pkcs1)(hash md5 %b))",
> (size_t)16, md5);

*You need to cast to (int)!*  On 32 bit system this usually doesn't
matter but on most 64 bit systems you would corrupt your stack.

Except for this it looks okay.

BTW, using MD5 for any new code is a serious problem; even all old code
should have been changed to to use at least SHA-1.  MD5 is broken.


Shalom-Salam,

   Werner


-- 
Die Gedanken sind frei.  Ausnahmen regelt ein Bundesgesetz.