How to sign pdf files using algorithm rsassa_pkcs1v15 with pkcs11?

[pahnd]

I'm new to pyhanko. How do I use pyhanko to sign pdf file with algorithm rsassa_pkcs1v15 using pkcs11 module. I have consulted pkcs11.py but it seems there is no algorithm selection section. For rsassa_pss there is a prefer_pss field but for rsassa_pkcs1v15 haven't see any guide in the documentation. Sorry for my bad English.

[MatthiasValvekens]

That one is the default for RSA keys, so you don't have to do anything special :).

[pahnd]

That one is the default for RSA keys, so you don't have to do anything special :).

Thank for your reply. I use pyhanko validate and this is the result when I check the pdf file. Signing with local certificate and through pkcs11 gives the same result:

Although it's a bit stupid, is there any way to sign and return the result of the signature mechanism "rsassa_pkcs1v15" like this?

[MatthiasValvekens]

I'm not sure what you mean. sha256_rsa is the name asn1crypto uses for "rsassa_pkcs1v15 with sha256", so the signature is of the type you want. Are you mixing up PKCS#1 and PKCS#11? Those are two completely different beasts: the former standardises RSA usage (that's what the rsassa_pkcs1v15 thing comes from), the latter specifies a generic interface to cryptographic devices.

Signing with a local key or through PKCS#11 is purely a matter of key administration, there's no generic way of distinguishing the resulting signatures (PKCS#11 is purely an interface standard, after all), so the validator can't "know" that a signature was produced with PKCS#11.

If what you want is to prove somehow that you are signing using a hardware-controlled key, you need to either find a CA that issues certificates that contain metadata asserting that the key resides in secure hardware, or include an attestation certificate with your signature. This may or may not involve buying new hardware and/or certs, depending on your situation.

[pahnd]

Oh, I really don't know. I will learn more about this. Thank you very much. 🥇