Инфраструктура открытых ключей: библиотека GCrypt как альтернатива OpenSSL с поддержкой российской криптографии

#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <gcrypt.h>
/*Функция печати S-выражений*/
static void
show_sexp (const char *prefix, gcry_sexp_t a)
{
  char *buf;
  size_t size;
  if (prefix)
    fputs (prefix, stderr);
  size = gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, NULL, 0);
  buf = gcry_xmalloc (size);
  gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, buf, size);
  fprintf (stderr, "%.*s", (int)size, buf);
  gcry_free (buf);
}
int main(int argc, char* argv[]) {
    gpg_error_t err;
    gcry_sexp_t key_spec, key_pair, pub_key, sec_key;
/*Базовые точки*/
    char *curve_gost[] = {"GOST2001-CryptoPro-A", "GOST2001-CryptoPro-B", "GOST2001-CryptoPro-C", "GOST2012-tc26-A", "GOST2012-tc26-B", NULL};
/*Задаем параметры для генерации ключевой пары*/
    err = gcry_sexp_build (&key_spec, NULL,
                               "(genkey (ecc (curve %s)))", curve_gost[1]);
    if (err) {
         fprintf(stderr, "creating S-expression failed: %sn", gcry_strerror (err));
    	exit (1);
    }
    err = gcry_pk_genkey (&key_pair, key_spec);
    if (err){
        fprintf(stderr, "creating %s  key failed: %sn", argv[1], gcry_strerror (err));
        exit(1);
    }
/*Печать S-выражения ключевой пары*/
    show_sexp ("ECC GOST key pair:n", key_pair);
/*Сохраняем публичный ключ*/
    pub_key = gcry_sexp_find_token (key_pair, "public-key", 0);
    if (! pub_key) {
        fprintf(stderr, "public part missing in keyn");
        exit(1);
    }
/*Печать S-выражения публичного ключа*/
    show_sexp ("ECC GOST public key:n", pub_key);
/*Сохраняем закрытый ключ*/
    sec_key = gcry_sexp_find_token (key_pair, "private-key", 0);
    if (! sec_key){
        fprintf(stderr, "private part missing in keyn");
        exit(1);
    }
/*Печать S-выражения закрытого ключа*/
    show_sexp ("ECC GOST private key:n", sec_key);
/*Освобождаем память, занимаемую ключевой парой*/    
    gcry_sexp_release (key_pair);
/*Освобождаем память, занимаемую параметрами ключевой пары*/    
    gcry_sexp_release (key_spec);
}

ECC GOST key pair:
(key-data 
 (public-key 
  (ecc 
   (curve GOST2001-CryptoPro-B)
   (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
   )
  )
 (private-key 
  (ecc 
   (curve GOST2001-CryptoPro-B)
   (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
   (d #1ABB5A62BFF88C97567B467C6F4017242FE344B4F4BC8906CE40A0F9D51CBE48#)
   )
  )
 )
ECC GOST public key:
(public-key 
 (ecc 
  (curve GOST2001-CryptoPro-B)
  (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
  )
 )
ECC GOST private key:
(private-key 
 (ecc 
  (curve GOST2001-CryptoPro-B)
  (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
  (d #1ABB5A62BFF88C97567B467C6F4017242FE344B4F4BC8906CE40A0F9D51CBE48#)
  )
 )

#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <gcrypt.h>
int main(int argc, char* argv[]) {
    gpg_error_t err;
    int algo = GCRY_MD_NONE;
    int i;
    unsigned char *h;
    size_t size;
    gcry_md_hd_t hd;
    FILE *fp;
    unsigned char buf[1024];	
    char *dgst_gost[] = {"GOSTR3411_CP", "STRIBOG256", "STRIBOG512", NULL};
    i = 0;
/*Проверка параметров хэш-функции*/
    if (argc == 3)
        algo = gcry_md_map_name (argv[1]);
    if (algo == GCRY_MD_NONE) {
    	fprintf(stderr, "Usage: digest_gcrypt <nick_name_digest> <file_for_digest>n");
        fprintf(stderr, "<nick_name_digest>=");
    	while (dgst_gost[i] != NULL){
            if (i > 0 ) 
                fprintf(stderr, " | ", dgst_gost[i]);              
    	    fprintf(stderr, "%s", dgst_gost[i]);
    	    i++;
    	}
        fprintf(stderr, "n");
    	exit (1);
    }
/*Создаем контекст хэш функции*/
    err = gcry_md_open(&hd, algo, 0);
    if (err) { 
fprintf (stderr, "LibGCrypt error %sn",
       gcry_strerror (err));
        exit (1);
    }
/*Открываем подписываемый файл*/
    if (!strcmp (argv[2], "-"))
        fp = stdin;
    else
        fp = fopen (argv[2], "r");

    if (fp == NULL) {
          fprintf(stderr, "Cannot fopen file=%sn", argv[2]);
          exit(1);
    }
/*Считаем хэш содержимого файла*/
    while (!feof (fp)) {
          size = fread (buf, 1, sizeof(buf), fp);
          gcry_md_write (hd, buf, size);
    }
/*Сохраняем значение хэш*/
    h  = gcry_md_read(hd, 0);
/*Печатаем значение хэш*/
    printf("Длина хеш %s = %d (в байтах)n", argv[1], gcry_md_get_algo_dlen (algo));
    printf("Хэш от файла  %s:n", argv[2]);
    for (i = 0; i < gcry_md_get_algo_dlen (algo); i++)
        printf("%02x", h[i]);
    printf("n");
    fflush(stdout);
/*Закрываем контекст*/
    gcry_md_reset(hd);
    gcry_md_close(hd);
}

proc parse_cert_gost {cert} {
#    parray ::pki::oids
#puts "parse_cert_gost=$cert"
    set cert_seq ""
    if { [string range $cert 0 9 ] == "-----BEGIN" } {
	array set parsed_cert [::pki::_parse_pem $cert "-----BEGIN CERTIFICATE-----" "-----END CERTIFICATE-----"]
	set cert_seq $parsed_cert(data)
    } else {
#FORMAT DER
	set cert_seq $cert
    }
    set finger [::sha1::sha1 $cert_seq]
    set ret(fingerprint) $finger

    binary scan  $cert_seq H* certdb 
    set ret(certdb) $certdb
#puts "CERTDB=$certdb"
	array set ret [list]

	# Decode X.509 certificate, which is an ASN.1 sequence
	::asn::asnGetSequence cert_seq wholething
	::asn::asnGetSequence wholething cert
	set ret(cert) $cert

	set ret(cert) [::asn::asnSequence $ret(cert)]
if {0} {
    set ff [open "/tmp/tbs.der" w]
    fconfigure $ff -translation binary
    puts -nonewline $ff $ret(cert)
    close $ff
}
	binary scan $ret(cert) H* ret(cert)

	::asn::asnPeekByte cert peek_tag
	if {$peek_tag != 0x02} {
		# Version number is optional, if missing assumed to be value of 0
		::asn::asnGetContext cert - asn_version
		::asn::asnGetInteger asn_version ret(version)
		incr ret(version)
	} else {
		set ret(version) 1
	}

	::asn::asnGetBigInteger cert ret(serial_number)
	::asn::asnGetSequence cert data_signature_algo_seq
		::asn::asnGetObjectIdentifier data_signature_algo_seq ret(data_signature_algo)
	::asn::asnGetSequence cert issuer
	::asn::asnGetSequence cert validity
		::asn::asnGetUTCTime validity ret(notBefore)
		::asn::asnGetUTCTime validity ret(notAfter)
	::asn::asnGetSequence cert subject
	::asn::asnGetSequence cert pubkeyinfo

	binary scan  $pubkeyinfo H* pubkeyinfoG
	set ret(pubkeyinfo) $pubkeyinfoG


		::asn::asnGetSequence pubkeyinfo pubkey_algoid

	binary scan  $pubkey_algoid H* pubkey_algoidG
	set ret(pubkey_algoid) $pubkey_algoidG

			::asn::asnGetObjectIdentifier pubkey_algoid ret(pubkey_algo)
		::asn::asnGetBitString pubkeyinfo pubkey

	set extensions_list [list]
	while {$cert != ""} {
		::asn::asnPeekByte cert peek_tag

		switch -- [format {0x%02x} $peek_tag] {
			"0xa1" {
				::asn::asnGetContext cert - issuerUniqID
			}
			"0xa2" {
				::asn::asnGetContext cert - subjectUniqID
			}
			"0xa3" {
				::asn::asnGetContext cert - extensions_ctx
				::asn::asnGetSequence extensions_ctx extensions
				while {$extensions != ""} {
					::asn::asnGetSequence extensions extension
						::asn::asnGetObjectIdentifier extension ext_oid

						::asn::asnPeekByte extension peek_tag
						if {$peek_tag == 0x1} {
							::asn::asnGetBoolean extension ext_critical
						} else {
							set ext_critical false
						}

						::asn::asnGetOctetString extension ext_value_seq

					set ext_oid [::pki::_oid_number_to_name $ext_oid]

					set ext_value [list $ext_critical]

					switch -- $ext_oid {
						id-ce-basicConstraints {
							::asn::asnGetSequence ext_value_seq ext_value_bin

							if {$ext_value_bin != ""} {
								::asn::asnGetBoolean ext_value_bin allowCA
							} else {
								set allowCA "false"
							}

							if {$ext_value_bin != ""} {
								::asn::asnGetInteger ext_value_bin caDepth
							} else {
								set caDepth -1
							}
						
							lappend ext_value $allowCA $caDepth
						}
						default {
							binary scan $ext_value_seq H* ext_value_seq_hex
							lappend ext_value $ext_value_seq_hex
						}
					}

					lappend extensions_list $ext_oid $ext_value
				}
			}
		}
	}
	set ret(extensions) $extensions_list

	::asn::asnGetSequence wholething signature_algo_seq
	::asn::asnGetObjectIdentifier signature_algo_seq ret(signature_algo)
	::asn::asnGetBitString wholething ret(signature)

	# Convert values from ASN.1 decoder to usable values if needed
	set ret(notBefore) [::pki::x509::_utctime_to_native $ret(notBefore)]
	set ret(notAfter) [::pki::x509::_utctime_to_native $ret(notAfter)]
	set ret(serial_number) [::math::bignum::tostr $ret(serial_number)]
	set ret(data_signature_algo) [::pki::_oid_number_to_name $ret(data_signature_algo)]
	set ret(signature_algo) [::pki::_oid_number_to_name $ret(signature_algo)]
	set ret(pubkey_algo) [::pki::_oid_number_to_name $ret(pubkey_algo)]
	set ret(issuer) [::pki::x509::_dn_to_string $issuer]
	set ret(subject) [::pki::x509::_dn_to_string $subject]
	set ret(signature) [binary format B* $ret(signature)]
	binary scan $ret(signature) H* ret(signature)

	# Handle RSA public keys by extracting N and E
#puts "PUBKEY_ALGO=$ret(pubkey_algo)"
	switch -- $ret(pubkey_algo) {
		"rsaEncryption" {
			set pubkey [binary format B* $pubkey]
			binary scan $pubkey H* ret(pubkey)

			::asn::asnGetSequence pubkey pubkey_parts
			::asn::asnGetBigInteger pubkey_parts ret(n)
			::asn::asnGetBigInteger pubkey_parts ret(e)

			set ret(n) [::math::bignum::tostr $ret(n)]
			set ret(e) [::math::bignum::tostr $ret(e)]
			set ret(l) [expr {int([::pki::_bits $ret(n)] / 8.0000 + 0.5) * 8}]
			set ret(type) rsa
		} 
		"GostR2012_256" -
		"GostR2012_512" -
		"GostR2001" -
		"1.2.643.2.2.19" -
		"1.2.643.7.1.1.1.1" -
		"1.2.643.7.1.1.1.2" {
#	gost2001, gost2012-256,gost2012-512
			set pubkey [binary format B* $pubkey]
#puts "LL=[string length $pubkey]"
if {[string length $pubkey] < 100} {
    set pubk [string range $pubkey 2 end]
} else {
    set pubk [string range $pubkey 3 end]
}
set pubkey_revert [string reverse $pubk]
binary scan $pubkey_revert H* ret(pubkey_rev)
			binary scan $pubkey H* ret(pubkey)
			set ret(type) gost
			::asn::asnGetSequence pubkey_algoid pubalgost
#OID - параметра
			::asn::asnGetObjectIdentifier pubalgost ret(paramkey)
	set ret(paramkey) [::pki::_oid_number_to_name $ret(paramkey)]
#OID - Функция хэша
			::asn::asnGetObjectIdentifier pubalgost ret(hashkey)
	set ret(hashkey) [::pki::_oid_number_to_name $ret(hashkey)]
#puts "ret(paramkey)=$ret(paramkey)n"
#puts "ret(hashkey)=$ret(hashkey)n"
		}
	}
	return [array get ret]
}

proc set_nick_for_oid {} {
#    set ::pki::oids(1.2.643.2.2.19) "gost2001pubKey"
#    set ::pki::oids(1.2.643.2.2.3)  "gost2001withGOST3411_94"
    set ::pki::oids(1.2.643.100.1)  "OGRN"
    set ::pki::oids(1.2.643.100.5)  "OGRNIP"
    set ::pki::oids(1.2.643.3.131.1.1) "INN"
    set ::pki::oids(1.2.643.100.3) "SNILS"
#Алгоритмы подписи
    set ::pki::oids(1.2.643.2.2.3) "ГОСТ Р 34.10-2001-256"
    set ::pki::oids(1.2.643.7.1.1.3.2) "ГОСТ Р 34.10-2012-256"
    set ::pki::oids(1.2.643.7.1.1.3.3) "ГОСТ Р 34.10-2012-512"
#    set ::pki::oids(1.2.643.2.2.3) "gost"
#    set ::pki::oids(1.2.643.7.1.1.3.2) "gost"
#    set ::pki::oids(1.2.643.7.1.1.3.3) "gost"
#Алгоритмы ключа
#    set ::pki::oids(1.2.643.2.2.19) "ГОСТ Р 34.10-2001"
#    set ::pki::oids(1.2.643.7.1.1.1.1) "ГОСТ Р 34.10-2012 256 байт"
#    set ::pki::oids(1.2.643.7.1.1.1.2) "ГОСТ Р 34.10-2012 512 байт"
    set ::pki::oids(1.2.643.2.2.19) "GostR2001"
    set ::pki::oids(1.2.643.7.1.1.1.1) "GostR2012_256"
    set ::pki::oids(1.2.643.7.1.1.1.2) "GostR2012_512"
#Oid-ы параметров ключа ГОСТ Р 34.10-2001 и ГОСТ Р 34.10-2012-256
    set ::pki::oids(1.2.643.2.2.35.0) "GOST2001-test"
    set ::pki::oids(1.2.643.2.2.35.1) "GOST2001-CryptoPro-A"
    set ::pki::oids(1.2.643.2.2.35.2) "GOST2001-CryptoPro-B"
    set ::pki::oids(1.2.643.2.2.35.3) "GOST2001-CryptoPro-C"
#    { "GOST2001-CryptoPro-A",     set ::pki::oids("GOST2001-CryptoPro-XchA" },
#    { "GOST2001-CryptoPro-C",     set ::pki::oids("GOST2001-CryptoPro-XchB" },
    set ::pki::oids(1.2.643.2.2.36.0) "GOST2001-CryptoPro-A"
    set ::pki::oids(1.2.643.2.2.36.1) "GOST2001-CryptoPro-C"
#Oid-ы параметров ключа ГОСТ Р 34.10-2012-512
    set ::pki::oids(1.2.643.7.1.2.1.2.1) "GOST2012-tc26-A"
    set ::pki::oids(1.2.643.7.1.2.1.2.2) "GOST2012-tc26-B"
#Nick для хэш
    set ::pki::oids(1.2.643.7.1.1.2.2) "STRIBOG256"
    set ::pki::oids(1.2.643.7.1.1.2.3) "STRIBOG512"
    set ::pki::oids(1.2.643.2.2.30.1) "GOSTR3411_CP"
}

#!/usr/bin/tclsh
#загружаем пакет PKI
package require pki
#загружаем файл с процедурой разбора ГОСТ-ых сертификатов
source parse_cert_gost_oid.tcl
if {$argc != 2} {
    puts "Usage: parse_certs_for_verify_load.tcl <проверяемый сертификат> <корневой сертификат>"
    exit 1
}
#Проверяемый сертификат
if {[file exists "[lindex $argv 0]"] == 0 } {
    puts "Usage: parse_certs_for_verify_load.tcl <проверяемый сертификат> <корневой сертификат>"
    puts "Отсутствует файл [lindex $argv 0]"
    exit 1
}
#Корневой сертификат
if {[file exists "[lindex $argv 1]"] == 0 } {
    puts "Usage: parse_certs_for_verify_load.tcl <проверяемый сертификат> <корневой сертификат>"
    puts "Отсутствует файл [lindex $argv 1]"
    exit 1
}
#Устанавливаем nick-и для ГОСТ-овых oid-ов
set_nick_for_oid

set file [lindex $argv 0]
set f [open $file r]
set cert [read $f]
close $f
#READ DER-format
if { [string range $cert 0 9 ] != "-----BEGIN" } {
	set fd [open $file]
	chan configure $fd -translation binary
	set cert [read $fd]
	close $fd
}

array set cert_user [parse_cert_gost $cert]
#Читай рекомендации ТК-26
set len_sign [expr [string length $cert_user(signature)] /2]
set sign_r [string range $cert_user(signature) $len_sign end]
set sign_s [string range $cert_user(signature) 0 [expr $len_sign - 1]]

#puts "Корневой сертификат: $file"
set file [lindex $argv 1]
set f [open $file r]
set cert [read $f]
close $f
#READ DER
    if { [string range $cert 0 9 ] != "-----BEGIN" } {
	set fd [open $file]
	chan configure $fd -translation binary
	set cert [read $fd]
	close $fd
    }

#Распарсиваем в массив корневой сертификат
array set cert_ca [parse_cert_gost $cert]
#Читай рекомендации ТК-26
set len_key [expr [string length $cert_ca(pubkey_rev)]/2]
set key_pub_left [string range $cert_ca(pubkey_rev) $len_key end]
set key_pub_right [string range $cert_ca(pubkey_rev) 0 [expr $len_key - 1]]
puts "/*Делаем C-код: Исходные данные для проверки подписи сертификата*/"
#TBS-проверяемого сертификата
puts "char tbc[] = "[string toupper $cert_user(cert)]";"
#Тип хэш-функции
puts "char hash_type[] = "$cert_ca(hashkey)";"
#Открытый ключ корневого сертификата
puts "unsigned char pub_key_ca[] = "(public-key ""
puts ""(ecc ""
puts "" (curve $cert_ca(paramkey))""
puts "" (q #04[string toupper $key_pub_left$key_pub_right]#)""
puts "")""
puts "")";"
#Подпись проверяемого сертификата
puts "unsigned char sig_cert[] = "(sig-val"" 
puts ""($cert_ca(type) ""
puts "" (r #[string toupper $sign_r]#)""
puts "" (s #[string toupper $sign_s]#)""
puts "")""
puts "")";"
puts "/*Сохраните вывод в файле TEST_from_TCL.h*/"
puts "/*Оттранслируйте модуль TEST_from_Tcl.c: cc -o TEST_from_Tcl TEST_from_Tcl.c -lgcrypt и выполните модуль TEST_from_Tcl*/"

-----BEGIN CERTIFICATE-----
MIIGrDCCBlugAwIBAgILAOvBBVQAAAAAAFkwCAYGKoUDAgIDMIIBSjEeMBwGCSqG
SIb3DQEJARYPZGl0QG1pbnN2eWF6LnJ1MQswCQYDVQQGEwJSVTEcMBoGA1UECAwT
Nzcg0LMuINCc0L7RgdC60LLQsDEVMBMGA1UEBwwM0JzQvtGB0LrQstCwMT8wPQYD
VQQJDDYxMjUzNzUg0LMuINCc0L7RgdC60LLQsCwg0YPQuy4g0KLQstC10YDRgdC6
0LDRjywg0LQuIDcxLDAqBgNVBAoMI9Cc0LjQvdC60L7QvNGB0LLRj9C30Ywg0KDQ
vtGB0YHQuNC4MRgwFgYFKoUDZAESDTEwNDc3MDIwMjY3MDExGjAYBggqhQMDgQMB
ARIMMDA3NzEwNDc0Mzc1MUEwPwYDVQQDDDjQk9C+0LvQvtCy0L3QvtC5INGD0LTQ
vtGB0YLQvtCy0LXRgNGP0Y7RidC40Lkg0YbQtdC90YLRgDAeFw0xNjAzMTYxMjAy
NTFaFw0yNzA3MTIxMjAyNTFaMIIBITEaMBgGCCqFAwOBAwEBEgwwMDc3MTA0NzQz
NzUxGDAWBgUqhQNkARINMTA0NzcwMjAyNjcwMTEeMBwGCSqGSIb3DQEJARYPZGl0
QG1pbnN2eWF6LnJ1MTwwOgYDVQQJDDMxMjUzNzUg0LMuINCc0L7RgdC60LLQsCDR
g9C7LiDQotCy0LXRgNGB0LrQsNGPINC0LjcxLDAqBgNVBAoMI9Cc0LjQvdC60L7Q
vNGB0LLRj9C30Ywg0KDQvtGB0YHQuNC4MRUwEwYDVQQHDAzQnNC+0YHQutCy0LAx
HDAaBgNVBAgMEzc3INCzLiDQnNC+0YHQutCy0LAxCzAJBgNVBAYTAlJVMRswGQYD
VQQDDBLQo9CmIDEg0JjQoSDQk9Cj0KYwYzAcBgYqhQMCAhMwEgYHKoUDAgIjAQYH
KoUDAgIeAQNDAARAx70Y7WYQ4ODtdiSSx3MJnr1GQBEIExiPO/LWj1TRKES1OcDI
YgtdOBGVYSvbsStl10jkAOG0OpnGsd2by4m+LaOCA0MwggM/MA8GA1UdEwEB/wQF
MAMBAf8wHQYDVR0OBBYEFBGIaV7vyOlz23pXNbzSAfMF/qfRMAsGA1UdDwQEAwIB
hjCCAYsGA1UdIwSCAYIwggF+gBSLmDuJGFHo75wCeLjqyNQgslXJXaGCAVKkggFO
MIIBSjEeMBwGCSqGSIb3DQEJARYPZGl0QG1pbnN2eWF6LnJ1MQswCQYDVQQGEwJS
VTEcMBoGA1UECAwTNzcg0LMuINCc0L7RgdC60LLQsDEVMBMGA1UEBwwM0JzQvtGB
0LrQstCwMT8wPQYDVQQJDDYxMjUzNzUg0LMuINCc0L7RgdC60LLQsCwg0YPQuy4g
0KLQstC10YDRgdC60LDRjywg0LQuIDcxLDAqBgNVBAoMI9Cc0LjQvdC60L7QvNGB
0LLRj9C30Ywg0KDQvtGB0YHQuNC4MRgwFgYFKoUDZAESDTEwNDc3MDIwMjY3MDEx
GjAYBggqhQMDgQMBARIMMDA3NzEwNDc0Mzc1MUEwPwYDVQQDDDjQk9C+0LvQvtCy
0L3QvtC5INGD0LTQvtGB0YLQvtCy0LXRgNGP0Y7RidC40Lkg0YbQtdC90YLRgIIQ
NGgeQMtB7zOpoLfIdpKaKTBZBgNVHR8EUjBQMCagJKAihiBodHRwOi8vcm9zdGVs
ZWNvbS5ydS9jZHAvZ3VjLmNybDAmoCSgIoYgaHR0cDovL3JlZXN0ci1wa2kucnUv
Y2RwL2d1Yy5jcmwwJgYFKoUDZG8EHQwb0JrRgNC40L/RgtC+LdCf0YDQviBDU1Ag
My42MCUGA1UdIAQeMBwwCAYGKoUDZHEBMAgGBiqFA2RxAjAGBgRVHSAAMIHGBgUq
hQNkcASBvDCBuQwj0J/QkNCa0JwgwqvQmtGA0LjQv9GC0L7Qn9GA0L4gSFNNwrsM
INCf0JDQmiDCq9CT0L7Qu9C+0LLQvdC+0Lkg0KPQpsK7DDbQl9Cw0LrQu9GO0YfQ
tdC90LjQtSDihJYgMTQ5LzMvMi8yLTk5OSDQvtGCIDA1LjA3LjIwMTIMONCX0LDQ
utC70Y7Rh9C10L3QuNC1IOKEliAxNDkvNy8xLzQvMi02MDMg0L7RgiAwNi4wNy4y
MDEyMAgGBiqFAwICAwNBAKVYokUvb7XAMPJF38ZPKO2BFBldmGEfqsfmsiO35Y52
kTkx512H3YLqWMrOLjIfVMJhc+DTCNeXWY6bhK4/DRU=
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIFGTCCBMigAwIBAgIQNGgeQMtB7zOpoLfIdpKaKTAIBgYqhQMCAgMwggFKMR4w
HAYJKoZIhvcNAQkBFg9kaXRAbWluc3Z5YXoucnUxCzAJBgNVBAYTAlJVMRwwGgYD
VQQIDBM3NyDQsy4g0JzQvtGB0LrQstCwMRUwEwYDVQQHDAzQnNC+0YHQutCy0LAx
PzA9BgNVBAkMNjEyNTM3NSDQsy4g0JzQvtGB0LrQstCwLCDRg9C7LiDQotCy0LXR
gNGB0LrQsNGPLCDQtC4gNzEsMCoGA1UECgwj0JzQuNC90LrQvtC80YHQstGP0LfR
jCDQoNC+0YHRgdC40LgxGDAWBgUqhQNkARINMTA0NzcwMjAyNjcwMTEaMBgGCCqF
AwOBAwEBEgwwMDc3MTA0NzQzNzUxQTA/BgNVBAMMONCT0L7Qu9C+0LLQvdC+0Lkg
0YPQtNC+0YHRgtC+0LLQtdGA0Y/RjtGJ0LjQuSDRhtC10L3RgtGAMB4XDTEyMDcy
MDEyMzExNFoXDTI3MDcxNzEyMzExNFowggFKMR4wHAYJKoZIhvcNAQkBFg9kaXRA
bWluc3Z5YXoucnUxCzAJBgNVBAYTAlJVMRwwGgYDVQQIDBM3NyDQsy4g0JzQvtGB
0LrQstCwMRUwEwYDVQQHDAzQnNC+0YHQutCy0LAxPzA9BgNVBAkMNjEyNTM3NSDQ
sy4g0JzQvtGB0LrQstCwLCDRg9C7LiDQotCy0LXRgNGB0LrQsNGPLCDQtC4gNzEs
MCoGA1UECgwj0JzQuNC90LrQvtC80YHQstGP0LfRjCDQoNC+0YHRgdC40LgxGDAW
BgUqhQNkARINMTA0NzcwMjAyNjcwMTEaMBgGCCqFAwOBAwEBEgwwMDc3MTA0NzQz
NzUxQTA/BgNVBAMMONCT0L7Qu9C+0LLQvdC+0Lkg0YPQtNC+0YHRgtC+0LLQtdGA
0Y/RjtGJ0LjQuSDRhtC10L3RgtGAMGMwHAYGKoUDAgITMBIGByqFAwICIwEGByqF
AwICHgEDQwAEQI+lv3kQI8jWka1kMVdbvpvFioP0Pyn3Knmp+2XD6KgPWnXEIlSR
X8g/IYracDr51YsNc2KE3C7mkH6hA3M3ofujggGCMIIBfjCBxgYFKoUDZHAEgbww
gbkMI9Cf0JDQmtCcIMKr0JrRgNC40L/RgtC+0J/RgNC+IEhTTcK7DCDQn9CQ0Jog
wqvQk9C+0LvQvtCy0L3QvtC5INCj0KbCuww20JfQsNC60LvRjtGH0LXQvdC40LUg
4oSWIDE0OS8zLzIvMi05OTkg0L7RgiAwNS4wNy4yMDEyDDjQl9Cw0LrQu9GO0YfQ
tdC90LjQtSDihJYgMTQ5LzcvMS80LzItNjAzINC+0YIgMDYuMDcuMjAxMjAuBgUq
hQNkbwQlDCPQn9CQ0JrQnCDCq9Ca0YDQuNC/0YLQvtCf0YDQviBIU03CuzBDBgNV
HSAEPDA6MAgGBiqFA2RxATAIBgYqhQNkcQIwCAYGKoUDZHEDMAgGBiqFA2RxBDAI
BgYqhQNkcQUwBgYEVR0gADAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
/zAdBgNVHQ4EFgQUi5g7iRhR6O+cAni46sjUILJVyV0wCAYGKoUDAgIDA0EA23Re
ec/Y27rpMi+iFbgWCazGY3skBTq5ZGsQKOUxCe4mO7UBDACiWqdA0nvqiQMXeHgq
o//fO9pxuIHtymwyMg==
-----END CERTIFICATE-----

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdarg.h>
#include <gcrypt.h>

#include "TEST_from_TCL.h"

#define digitp(p)     (*(p) >= '0' && *(p) <= '9')
#define hexdigitp(a)  (digitp (a)                     
                       || (*(a) >= 'A' && *(a) <= 'F')  
                       || (*(a) >= 'a' && *(a) <= 'f'))
#define xtoi_1(p)     (*(p) <= '9'? (*(p)- '0'): 
                       *(p) <= 'F'? (*(p)-'A'+10):(*(p)-'a'+10))
#define xtoi_2(p)     ((xtoi_1(p) * 16) + xtoi_1((p)+1))
#define xmalloc(a)    gcry_xmalloc ((a))

static void
show_sexp (const char *prefix, gcry_sexp_t a)
{
  char *buf;
  size_t size;

  if (prefix)
    fputs (prefix, stderr);
  size = gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, NULL, 0);
  buf = gcry_xmalloc (size);

  gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, buf, size);
  fprintf (stderr, "%.*s", (int)size, buf);
  gcry_free (buf);
}
/* Convert STRING consisting of hex characters into its binary
   representation and return it as an allocated buffer. The valid
   length of the buffer is returned at R_LENGTH.  The string is
   delimited by end of string.  The function returns NULL on
   error.  */
static void *
hex2buffer (const char *string, size_t *r_length)
{
  const char *s;
  unsigned char *buffer;
  size_t length;

  buffer = xmalloc (strlen(string)/2+1);
  length = 0;
  for (s=string; *s; s +=2 )
    {
      if (!hexdigitp (s) || !hexdigitp (s+1))
        return NULL;           /* Invalid hex digits. */
      ((unsigned char*)buffer)[length++] = xtoi_2 (s);
    }
  *r_length = length;
  return buffer;
}

int main(int argc, char* argv[]) {
    gpg_error_t err;
    int algo;
    gcry_md_hd_t hd;
    unsigned char *tbs_ptr;
    size_t len_tbs;
    int i;
    unsigned char *h;
    gcry_sexp_t pub_key;
    gcry_sexp_t data;
    gcry_sexp_t sig;
    gcry_mpi_t x;
    int len_xy;
    unsigned char c;
/*Для тестирования архитектуры little-endian или big-endian*/
    unsigned short arch = 1; /* 0x0001 */

    tbs_ptr = hex2buffer(tbc, &len_tbs);
    if (tbs_ptr == NULL) {
      fprintf (stderr, "Bad tbsn");
	exit(1);
    }
    algo = gcry_md_map_name (hash_type);
    if (algo == GCRY_MD_NONE)
    {
      fprintf (stderr, "Unknown algorithm '%s'n", hash_type);
      exit (1);
    }

    err = gcry_md_open(&hd, algo, 0);
    if (err)
    {
      fprintf (stderr, "LibGCrypt error %s/%sn",
          gcry_strsource (err),
          gcry_strerror (err));
        exit (1);
    }
    gcry_md_write (hd, tbs_ptr, len_tbs);
    h  = gcry_md_read(hd, 0);
//    len_xy = gcry_md_get_algo_dlen (algo);
/*Проверяем архитектуру и инвертируем хэш*/
    printf("%sn", *((unsigned char *) &arch) == 0 ? "Архитектура big-endian" : "Архитекткра little-endian");
    len_xy =  *((unsigned char *) &arch) == 0 ? 0:gcry_md_get_algo_dlen (algo);
    for (i = 0; i < (len_xy/2); i++) {
            	    c = *(h + i);
            	    *(h + i) = *(h + len_xy - i - 1);
            	    *(h + len_xy - i - 1) = c;
    }

fprintf(stderr, "Хэш длина=%dn", gcry_md_get_algo_dlen (algo));
    for (i = 0; i < gcry_md_get_algo_dlen (algo); i++)
        printf("%02X", h[i]);
//    printf("n  %sn", tbc);
    fflush(stdout);
/*Сохраняем хэш */
    x = gcry_mpi_set_opaque_copy(NULL, h, gcry_md_get_algo_dlen (algo) * 8);

/*Закрываем контекст хэширования*/
    gcry_md_reset(hd);
    gcry_md_close(hd);
/*Контекст хэша*/
    err = gcry_sexp_build (&data, NULL,
                             "(data (flags gost) (value %m))", x);
    show_sexp ("ECC GOST data cert:n", data);
fprintf (stderr, "nStep 1n");
/*Контекст публичного ключа корневого сертификата*/
    err = gcry_sexp_sscan (&pub_key, NULL, pub_key_ca,
                           strlen (pub_key_ca));
    if (err){
	fprintf(stderr, "TEST_SEXP: er gcry_sexp_sscan for pub_key_can");
	exit(1);
    }
    show_sexp ("ECC GOST public key:n", pub_key);
fprintf (stderr, "Step 2n");
/*Контекст подписи проверяемого сертификата*/
    err = gcry_sexp_sscan (&sig, NULL, sig_cert, strlen (sig_cert));
    if (err){
	fprintf(stderr, "TEST_SEXP: er gcry_sexp_sscan for sig_certn");
	exit(1);
    }
    show_sexp ("ECC GOST sig cert:n", sig);
fprintf (stderr, "Step 3n");
/*Проверка подписи сертификата*/
    err = gcry_pk_verify (sig, data, pub_key);
    if (err) {
        fprintf (stderr, "TEST_SEXP: verify cert failedn");
        exit (1);
    }
    fprintf (stderr, "TEST_SEXP: verify cert OK!!n");
}