c++ - 在 Crypto++ 中使用 ECDSA 的正确方法是什么

Question

当我在 Crypto++ 中使用 ECDSA 验证器验证签名时，如果公钥不正确，该方法只会使应用程序崩溃。我应该 try catch 异常吗？处理此问题的最佳方法是什么？

谢谢!

Answer 1

... should I try catch the exception? What is the best way to handle this?

这取决于你想怎么做。我认为有三种选择。

以下信息来自Elliptic Curve Digital Signature Algorithm和 SignatureVerificationFilter在 Crypto++ wiki 上。

首先，如果您愿意，可以捕获 SignatureVerificationFailed 异常:

try
{
    DSA::Verifier verifier(publicKey);
    StringSource ss2(message+signature, true,
        new SignatureVerificationFilter(
            verifier, NULL, THROW_EXCEPTION
            /* SIGNATURE_AT_END */
       )
    );

    std::cout << "Verified signature on message" << std::endl;
}
catch (SignatureVerificationFailed& ex)
{
    std::cerr << "Failed to verify signature on message" << std::endl;
}

其次，您可以获得 bool 值形式的结果。注意缺少 THROW_EXCEPTION:

bool result = false;
StringSource ss(message+signature, true,
    new SignatureVerificationFilter(
        verifier,
        new ArraySink(
            (byte*)&result, sizeof(result)),
        PUT_RESULT | SIGNATURE_AT_END
   )
);

if(result)
    std::cout << "Verified signature on message" << std::endl;
else
    std::cerr << "Failed to verify signature on message" << std::endl;

第三，您可以放弃管道，只调用 Verifier 对象上的 VerifyMessage:

bool result = verifier.VerifyMessage(ConstBytePtr(message), BytePtrSize(message), ConstBytePtr(signature), BytePtrSize(signature));
if(result)
    std::cout << "Verified signature on message" << std::endl;
else
    std::cerr << "Failed to verify signature on message" << std::endl;