//--------------------------------------------------------------------
// 數字簽名以及認證

#include <stdio.h>
#include <windows.h>
#include <wincrypt.h>
#define MY_ENCODING_TYPE  (PKCS_7_ASN_ENCODING | X509_ASN_ENCODING)
void MyHandleError(char *s);

void main(void)
{
	//-------------------------------------------------------------
	// Declare and initialize variables.
	
	HCRYPTPROV hProv;
	BYTE *pbBuffer= (BYTE *)"The data that is to be hashed and signed.";//被簽名的數據
	DWORD dwBufferLen = strlen((char *)pbBuffer)+1;
	HCRYPTHASH hHash;
	HCRYPTKEY hKey;
	BYTE *pbKeyBlob;			//簽名者得公鑰數據
	BYTE *pbSignature;			//數字簽名
	DWORD dwSigLen;
	DWORD dwBlobLen;
	LPTSTR szDescription = "Test Data Description";
	
	//--------------------------------------------------------------------
	// 獲得CSP句柄,密鑰容器名為登陸用戶名	
	if(CryptAcquireContext(
		&hProv, 
		NULL, 
		NULL, 
		PROV_RSA_FULL, 
		0)) 
	{
		printf("CSP context acquired.\n");
	}
	else	//密鑰容器不存在創建之
	{
		if(CryptAcquireContext(
			&hProv, 
			NULL, 
			NULL, 
			PROV_RSA_FULL, 
			CRYPT_NEWKEYSET)) 
		{
			printf("A new key container has been created.\n");
		}
		else
		{
			MyHandleError("Error during CryptAcquireContext.");
		}
	}

	//--------------------------------------------------------------------
	// 從密鑰容器中取數字簽名用的密鑰
	if(CryptGetUserKey(   
		hProv,    
		AT_SIGNATURE,    
		&hKey)) 
	{
		printf("The signature key has been acquired. \n");
	}
	else
	{
		if(GetLastError() == NTE_NO_KEY) //密鑰容器里不存在signature key pair創建之
		{
			if(CryptGenKey(
				hProv,			//CSP句柄
				AT_SIGNATURE,	//創建的密鑰對類型為signature key pair
				0,				//key類型，這里用默認值
				&hKey)) 		//創建成功返回新創建的密鑰對的句柄
			{
				printf("Created a signature key pair.\n");
			}
			else
			{
				MyHandleError("Error occurred creating a signature key.\n"); 
			}
			
		}
		else
		{
			MyHandleError("Error during CryptGetUserKey for signkey.");
		}
	}

	//--------------------------------------------------------------------
	// 因為接收消息者要驗證數字簽名，所以要導出公鑰給接收者。
	if(CryptExportKey(   
		hKey,    
		NULL,    
		PUBLICKEYBLOB,
		0,    
		NULL, 
		&dwBlobLen)) //得到公鑰的大小
	{
		printf("Size of the BLOB for the public key determined. \n");
	}
	else
	{
		MyHandleError("Error computing BLOB length.");
	}

	//--------------------------------------------------------------------
	// 為存儲公鑰的緩沖區分配內存。
	if(pbKeyBlob = (BYTE*)malloc(dwBlobLen)) 
	{
		printf("Memory has been allocated for the BLOB. \n");
	}
	else
	{
		MyHandleError("Out of memory. \n");
	}

	//--------------------------------------------------------------------
	// 真正導出公鑰數據
	if(CryptExportKey(   
		hKey, 
		NULL,    
		PUBLICKEYBLOB,    
		0,    
		pbKeyBlob,    //這個數據可以存入文件，發送給接收者。一般被存入數字證書
		&dwBlobLen))
	{
		printf("Contents have been written to the BLOB. \n");
	}
	else
	{
		MyHandleError("Error during CryptExportKey.");
	}

	//--------------------------------------------------------------------
	// 創建hash對象
	if(CryptCreateHash(
		hProv, 
		CALG_MD5, 
		0, 
		0, 
		&hHash)) 
	{
		printf("Hash object created. \n");
	}
	else
	{
		MyHandleError("Error during CryptCreateHash.");
	}

	//--------------------------------------------------------------------
	// 對數據進行hash運算
	if(CryptHashData(
		hHash, 
		pbBuffer, 
		dwBufferLen, 
		0)) 
	{
		printf("The data buffer has been hashed.\n");
	}
	else
	{
		MyHandleError("Error during CryptHashData.");
	}

	//--------------------------------------------------------------------
	// 使用signature key pair的私鑰對hash數據簽名

	dwSigLen= 0;
	if(CryptSignHash(
		hHash, 
		AT_SIGNATURE, 
		szDescription, 
		0, 
		NULL, 
		&dwSigLen)) //得到數字簽名大小
	{
		printf("Signature length %d found.\n",dwSigLen);
	}
	else
	{
		MyHandleError("Error during CryptSignHash.");
	}

	//--------------------------------------------------------------------
	// 為數字簽名緩沖區分配內存
	if(pbSignature = (BYTE *)malloc(dwSigLen))
	{
		printf("Memory allocated for the signature.\n");
	}
	else
	{
		MyHandleError("Out of memory.");
	}

	//--------------------------------------------------------------------
	// 得到數字簽名
	if(CryptSignHash(
		hHash, 
		AT_SIGNATURE, 
		szDescription, 
		0, 
		pbSignature, //這里將返回數字簽名，同被簽名的數據一起發送給接收方
		&dwSigLen)) 
	{
		printf("pbSignature is the hash signature.\n");
	}
	else
	{
		MyHandleError("Error during CryptSignHash.");
	}

	//--------------------------------------------------------------------
	// Destroy the hash object.
	if(hHash) 
		CryptDestroyHash(hHash);
	
	printf("The hash object has been destroyed.\n");
	printf("The signing phase of this program is completed.\n\n");
	

	//--------------------------------------------------------------------
	// 下面的代碼應該是接收者使用的，這里為了說明方便就把它放在一個文件里了。
	
	// pbBuffer, pbSignature, szDescription， pbKeyBlob, 還有他們的長度
	// 在這里直接使用了，應該是接收者從文件或其他地方讀取的。
	
	// pbBuffer 里保存的是被簽名的數據，所以認證時的內容必須跟簽名時的一樣
	
	// 這里使用的CSP句柄也沒有重新創建

	// Point szDescription at the text describing the data being 
	// signed. This is the same description text that was originally
	// passed to CryptSignHash.
	
	//--------------------------------------------------------------------
	// 把簽名者的公鑰數據導入生成公鑰句柄
	
	HCRYPTKEY hPubKey;
	if(CryptImportKey(
		hProv,
		pbKeyBlob,
		dwBlobLen,
		0,
		0,
		&hPubKey))
	{
		printf("The key has been imported.\n");
	}
	else
	{
		MyHandleError("Public key import failed.");
	}

	//--------------------------------------------------------------------
	// 創建哈希對象
	if(CryptCreateHash(
		hProv, 
		CALG_MD5, 
		0, 
		0, 
		&hHash)) 
	{
		printf("The hash object has been recreated. \n");
	}
	else
	{
		MyHandleError("Error during CryptCreateHash.");
	}

	//--------------------------------------------------------------------
	// 跟生成時一樣對數據進行hash運算
	if(CryptHashData(
		hHash, 
		pbBuffer, 
		dwBufferLen, 
		0)) 
	{
		printf("The new has been created.\n");
	}
	else
	{
		MyHandleError("Error during CryptHashData.");
	}

	//--------------------------------------------------------------------
	// 驗證數字簽名
	if(CryptVerifySignature(
		hHash, 
		pbSignature,	//數字簽名數據
		dwSigLen, 
		hPubKey,		//簽名者的公鑰
		szDescription, 
		0)) 
	{
		printf("The signature has been verified.\n");
	}
	else
	{
		printf("Signature not validated!\n");
	}

	//--------------------------------------------------------------------
	// Free memory to be used to store signature.
	if(pbSignature)
		free(pbSignature);

	if(pbKeyBlob)
		free(pbKeyBlob);
	
	//--------------------------------------------------------------------
	// Destroy the hash object.
	if(hHash) 
		CryptDestroyHash(hHash);
	
	//--------------------------------------------------------------------
	// Release the provider handle.
	if(hProv) 
		CryptReleaseContext(hProv, 0);
} //  End of main

//--------------------------------------------------------------------
//  This example uses the function MyHandleError, a simple error
//  handling function, to print an error message to the standard error 
//  (stderr) file and exit the program. 
//  For most applications, replace this function with one 
//  that does more extensive error reporting.

void MyHandleError(char *s)
{
    fprintf(stderr,"An error occurred in running the program. \n");
    fprintf(stderr,"%s\n",s);
    fprintf(stderr, "Error number %x.\n", GetLastError());
    fprintf(stderr, "Program terminating. \n");
    exit(1);
} // End of MyHandleError