I did a screencast this morning on creating a certificate that can be used to validate an application - this assumes that you safeguard your private keys, of course. Here's a simple example that shows how to generate a certificate, and then how to validate it. First, you create the keys:

	| rsaKeyGen |
	"create a key generator"
	rsaKeyGen := RSAKeyGenerator
				keySize: 1024
				random: (DSSRandom seed: Timestamp now asSeconds ** 10)
				primalityTest: (MillerRabin random: (DSSRandom b: 160)).

	"create keys"
	privateKey := rsaKeyGen privateKey.
	publicKey := rsaKeyGen publicKey.

	"store keys.  Note that this is hardly the preferred way of storing such data..."
	SimpleCertificate privateKey: privateKey.
	SimpleCertificate publicKey: publicKey

Storing the public and private keys together is a bad idea, but it does make this example easier to show. The Class SimpleCertificate has two class instance variables: publicKey, privateKey (you can kind it in the Public Store Repository - use it as a guideline, not as the right way to do this). Next, create your certificate with some text, signing with the private key:

register: details
	| stream encodedDetails signature |
	encodedDetails := details asByteArrayEncoding: #utf8.
	signature := RSA new
		useSHA;
		privateKey: self privateKey;
		sign: encodedDetails.
	stream := 'certificate.txt' asFilename writeStream binary.
	[stream nextPutAll: signature; nextPutAll: encodedDetails] ensure: [stream close].
	^signature

To call that, use:

"details for the certificate"
details := 'username=jarober
email=jarober@gmail.com
id=1234567890'.

signature := SimpleCertificate register: details.

Finally, to verify the certificate, you use the public key to check:

verify: signature for: details
	"answers a boolean"

	| rsaCipher |
	rsaCipher := RSA new publicKey: SimpleCertificate publicKey. 
	rsaCipher useSHA. 
	^rsaCipher verify: signature of: details.

And to call that:

SimpleCertificate verify: signature for: details.

That should answer true. If you try it with different text for details, it should answer false. There's a simple example of signing text, and later validating it. I'll cover all of this in a screencast soon.

Technorati Tags: certificate, digital signature