Инфраструктура открытых ключей: библиотека GCrypt как альтернатива OpenSSL с поддержкой российской криптографии18.06.2018 08:32

#include 
#include 
#include 
#include 
/*Функция печати S-выражений*/
static void
show_sexp (const char *prefix, gcry_sexp_t a)
{
  char *buf;
  size_t size;
  if (prefix)
    fputs (prefix, stderr);
  size = gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, NULL, 0);
  buf = gcry_xmalloc (size);
  gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, buf, size);
  fprintf (stderr, "%.*s", (int)size, buf);
  gcry_free (buf);
}
int main(int argc, char* argv[]) {
    gpg_error_t err;
    gcry_sexp_t key_spec, key_pair, pub_key, sec_key;
/*Базовые точки*/
    char *curve_gost[] = {"GOST2001-CryptoPro-A", "GOST2001-CryptoPro-B", "GOST2001-CryptoPro-C", "GOST2012-tc26-A", "GOST2012-tc26-B", NULL};
/*Задаем параметры для генерации ключевой пары*/
    err = gcry_sexp_build (&key_spec, NULL,
                               "(genkey (ecc (curve %s)))", curve_gost[1]);
    if (err) {
         fprintf(stderr, "creating S-expression failed: %s\n", gcry_strerror (err));
        exit (1);
    }
    err = gcry_pk_genkey (&key_pair, key_spec);
    if (err){
        fprintf(stderr, "creating %s  key failed: %s\n", argv[1], gcry_strerror (err));
        exit(1);
    }
/*Печать S-выражения ключевой пары*/
    show_sexp ("ECC GOST key pair:\n", key_pair);
/*Сохраняем публичный ключ*/
    pub_key = gcry_sexp_find_token (key_pair, "public-key", 0);
    if (! pub_key) {
        fprintf(stderr, "public part missing in key\n");
        exit(1);
    }
/*Печать S-выражения публичного ключа*/
    show_sexp ("ECC GOST public key:\n", pub_key);
/*Сохраняем закрытый ключ*/
    sec_key = gcry_sexp_find_token (key_pair, "private-key", 0);
    if (! sec_key){
        fprintf(stderr, "private part missing in key\n");
        exit(1);
    }
/*Печать S-выражения закрытого ключа*/
    show_sexp ("ECC GOST private key:\n", sec_key);
/*Освобождаем память, занимаемую ключевой парой*/    
    gcry_sexp_release (key_pair);
/*Освобождаем память, занимаемую параметрами ключевой пары*/    
    gcry_sexp_release (key_spec);
}

ECC GOST key pair:
(key-data 
 (public-key 
  (ecc 
   (curve GOST2001-CryptoPro-B)
   (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
   )
  )
 (private-key 
  (ecc 
   (curve GOST2001-CryptoPro-B)
   (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
   (d #1ABB5A62BFF88C97567B467C6F4017242FE344B4F4BC8906CE40A0F9D51CBE48#)
   )
  )
 )
ECC GOST public key:
(public-key 
 (ecc 
  (curve GOST2001-CryptoPro-B)
  (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
  )
 )
ECC GOST private key:
(private-key 
 (ecc 
  (curve GOST2001-CryptoPro-B)
  (q #043484CF83F837AAC7ABD4707DE27F5A1F6161120C0D77B63DFFC7D50A7772A12D1E836E6257766E8B83209DD59845F8080BA29E9A86D0A6B6C2D68F44650B3A14#)
  (d #1ABB5A62BFF88C97567B467C6F4017242FE344B4F4BC8906CE40A0F9D51CBE48#)
  )
 )

#include 
#include 
#include 
#include 
int main(int argc, char* argv[]) {
    gpg_error_t err;
    int algo = GCRY_MD_NONE;
    int i;
    unsigned char *h;
    size_t size;
    gcry_md_hd_t hd;
    FILE *fp;
    unsigned char buf[1024];    
    char *dgst_gost[] = {"GOSTR3411_CP", "STRIBOG256", "STRIBOG512", NULL};
    i = 0;
/*Проверка параметров хэш-функции*/
    if (argc == 3)
        algo = gcry_md_map_name (argv[1]);
    if (algo == GCRY_MD_NONE) {
        fprintf(stderr, "Usage: digest_gcrypt  \n");
        fprintf(stderr, "=");
        while (dgst_gost[i] != NULL){
            if (i > 0 ) 
                fprintf(stderr, " | ", dgst_gost[i]);              
            fprintf(stderr, "%s", dgst_gost[i]);
            i++;
        }
        fprintf(stderr, "\n");
        exit (1);
    }
/*Создаем контекст хэш функции*/
    err = gcry_md_open(&hd, algo, 0);
    if (err) { 
fprintf (stderr, "LibGCrypt error %s\n",
       gcry_strerror (err));
        exit (1);
    }
/*Открываем подписываемый файл*/
    if (!strcmp (argv[2], "-"))
        fp = stdin;
    else
        fp = fopen (argv[2], "r");

    if (fp == NULL) {
          fprintf(stderr, "Cannot fopen file=%s\n", argv[2]);
          exit(1);
    }
/*Считаем хэш содержимого файла*/
    while (!feof (fp)) {
          size = fread (buf, 1, sizeof(buf), fp);
          gcry_md_write (hd, buf, size);
    }
/*Сохраняем значение хэш*/
    h  = gcry_md_read(hd, 0);
/*Печатаем значение хэш*/
    printf("Длина хеш %s = %d (в байтах)\n", argv[1], gcry_md_get_algo_dlen (algo));
    printf("Хэш от файла  %s:\n", argv[2]);
    for (i = 0; i < gcry_md_get_algo_dlen (algo); i++)
        printf("%02x", h[i]);
    printf("\n");
    fflush(stdout);
/*Закрываем контекст*/
    gcry_md_reset(hd);
    gcry_md_close(hd);
}

proc parse_cert_gost {cert} {
#    parray ::pki::oids
#puts "parse_cert_gost=$cert"
    set cert_seq ""
    if { [string range $cert 0 9 ] == "-----BEGIN" } {
        array set parsed_cert [::pki::_parse_pem $cert "-----BEGIN CERTIFICATE-----" "-----END CERTIFICATE-----"]
        set cert_seq $parsed_cert(data)
    } else {
#FORMAT DER
        set cert_seq $cert
    }
    set finger [::sha1::sha1 $cert_seq]
    set ret(fingerprint) $finger

    binary scan  $cert_seq H* certdb 
    set ret(certdb) $certdb
#puts "CERTDB=$certdb"
        array set ret [list]

        # Decode X.509 certificate, which is an ASN.1 sequence
        ::asn::asnGetSequence cert_seq wholething
        ::asn::asnGetSequence wholething cert
        set ret(cert) $cert

        set ret(cert) [::asn::asnSequence $ret(cert)]
if {0} {
    set ff [open "/tmp/tbs.der" w]
    fconfigure $ff -translation binary
    puts -nonewline $ff $ret(cert)
    close $ff
}
        binary scan $ret(cert) H* ret(cert)

        ::asn::asnPeekByte cert peek_tag
        if {$peek_tag != 0x02} {
                # Version number is optional, if missing assumed to be value of 0
                ::asn::asnGetContext cert - asn_version
                ::asn::asnGetInteger asn_version ret(version)
                incr ret(version)
        } else {
                set ret(version) 1
        }

        ::asn::asnGetBigInteger cert ret(serial_number)
        ::asn::asnGetSequence cert data_signature_algo_seq
                ::asn::asnGetObjectIdentifier data_signature_algo_seq ret(data_signature_algo)
        ::asn::asnGetSequence cert issuer
        ::asn::asnGetSequence cert validity
                ::asn::asnGetUTCTime validity ret(notBefore)
                ::asn::asnGetUTCTime validity ret(notAfter)
        ::asn::asnGetSequence cert subject
        ::asn::asnGetSequence cert pubkeyinfo

        binary scan  $pubkeyinfo H* pubkeyinfoG
        set ret(pubkeyinfo) $pubkeyinfoG


                ::asn::asnGetSequence pubkeyinfo pubkey_algoid

        binary scan  $pubkey_algoid H* pubkey_algoidG
        set ret(pubkey_algoid) $pubkey_algoidG

                        ::asn::asnGetObjectIdentifier pubkey_algoid ret(pubkey_algo)
                ::asn::asnGetBitString pubkeyinfo pubkey

        set extensions_list [list]
        while {$cert != ""} {
                ::asn::asnPeekByte cert peek_tag

                switch -- [format {0x%02x} $peek_tag] {
                        "0xa1" {
                                ::asn::asnGetContext cert - issuerUniqID
                        }
                        "0xa2" {
                                ::asn::asnGetContext cert - subjectUniqID
                        }
                        "0xa3" {
                                ::asn::asnGetContext cert - extensions_ctx
                                ::asn::asnGetSequence extensions_ctx extensions
                                while {$extensions != ""} {
                                        ::asn::asnGetSequence extensions extension
                                                ::asn::asnGetObjectIdentifier extension ext_oid

                                                ::asn::asnPeekByte extension peek_tag
                                                if {$peek_tag == 0x1} {
                                                        ::asn::asnGetBoolean extension ext_critical
                                                } else {
                                                        set ext_critical false
                                                }

                                                ::asn::asnGetOctetString extension ext_value_seq

                                        set ext_oid [::pki::_oid_number_to_name $ext_oid]

                                        set ext_value [list $ext_critical]

                                        switch -- $ext_oid {
                                                id-ce-basicConstraints {
                                                        ::asn::asnGetSequence ext_value_seq ext_value_bin

                                                        if {$ext_value_bin != ""} {
                                                                ::asn::asnGetBoolean ext_value_bin allowCA
                                                        } else {
                                                                set allowCA "false"
                                                        }

                                                        if {$ext_value_bin != ""} {
                                                                ::asn::asnGetInteger ext_value_bin caDepth
                                                        } else {
                                                                set caDepth -1
                                                        }
                                                
                                                        lappend ext_value $allowCA $caDepth
                                                }
                                                default {
                                                        binary scan $ext_value_seq H* ext_value_seq_hex
                                                        lappend ext_value $ext_value_seq_hex
                                                }
                                        }

                                        lappend extensions_list $ext_oid $ext_value
                                }
                        }
                }
        }
        set ret(extensions) $extensions_list

        ::asn::asnGetSequence wholething signature_algo_seq
        ::asn::asnGetObjectIdentifier signature_algo_seq ret(signature_algo)
        ::asn::asnGetBitString wholething ret(signature)

        # Convert values from ASN.1 decoder to usable values if needed
        set ret(notBefore) [::pki::x509::_utctime_to_native $ret(notBefore)]
        set ret(notAfter) [::pki::x509::_utctime_to_native $ret(notAfter)]
        set ret(serial_number) [::math::bignum::tostr $ret(serial_number)]
        set ret(data_signature_algo) [::pki::_oid_number_to_name $ret(data_signature_algo)]
        set ret(signature_algo) [::pki::_oid_number_to_name $ret(signature_algo)]
        set ret(pubkey_algo) [::pki::_oid_number_to_name $ret(pubkey_algo)]
        set ret(issuer) [::pki::x509::_dn_to_string $issuer]
        set ret(subject) [::pki::x509::_dn_to_string $subject]
        set ret(signature) [binary format B* $ret(signature)]
        binary scan $ret(signature) H* ret(signature)

        # Handle RSA public keys by extracting N and E
#puts "PUBKEY_ALGO=$ret(pubkey_algo)"
        switch -- $ret(pubkey_algo) {
                "rsaEncryption" {
                        set pubkey [binary format B* $pubkey]
                        binary scan $pubkey H* ret(pubkey)

                        ::asn::asnGetSequence pubkey pubkey_parts
                        ::asn::asnGetBigInteger pubkey_parts ret(n)
                        ::asn::asnGetBigInteger pubkey_parts ret(e)

                        set ret(n) [::math::bignum::tostr $ret(n)]
                        set ret(e) [::math::bignum::tostr $ret(e)]
                        set ret(l) [expr {int([::pki::_bits $ret(n)] / 8.0000 + 0.5) * 8}]
                        set ret(type) rsa
                } 
                "GostR2012_256" -
                "GostR2012_512" -
                "GostR2001" -
                "1.2.643.2.2.19" -
                "1.2.643.7.1.1.1.1" -
                "1.2.643.7.1.1.1.2" {
#       gost2001, gost2012-256,gost2012-512
                        set pubkey [binary format B* $pubkey]
#puts "LL=[string length $pubkey]"
if {[string length $pubkey] < 100} {
    set pubk [string range $pubkey 2 end]
} else {
    set pubk [string range $pubkey 3 end]
}
set pubkey_revert [string reverse $pubk]
binary scan $pubkey_revert H* ret(pubkey_rev)
                        binary scan $pubkey H* ret(pubkey)
                        set ret(type) gost
                        ::asn::asnGetSequence pubkey_algoid pubalgost
#OID - параметра
                        ::asn::asnGetObjectIdentifier pubalgost ret(paramkey)
        set ret(paramkey) [::pki::_oid_number_to_name $ret(paramkey)]
#OID - Функция хэша
                        ::asn::asnGetObjectIdentifier pubalgost ret(hashkey)
        set ret(hashkey) [::pki::_oid_number_to_name $ret(hashkey)]
#puts "ret(paramkey)=$ret(paramkey)\n"
#puts "ret(hashkey)=$ret(hashkey)\n"
                }
        }
        return [array get ret]
}

proc set_nick_for_oid {} {
#    set ::pki::oids(1.2.643.2.2.19) "gost2001pubKey"
#    set ::pki::oids(1.2.643.2.2.3)  "gost2001withGOST3411_94"
    set ::pki::oids(1.2.643.100.1)  "OGRN"
    set ::pki::oids(1.2.643.100.5)  "OGRNIP"
    set ::pki::oids(1.2.643.3.131.1.1) "INN"
    set ::pki::oids(1.2.643.100.3) "SNILS"
#Алгоритмы подписи
    set ::pki::oids(1.2.643.2.2.3) "ГОСТ Р 34.10-2001-256"
    set ::pki::oids(1.2.643.7.1.1.3.2) "ГОСТ Р 34.10-2012-256"
    set ::pki::oids(1.2.643.7.1.1.3.3) "ГОСТ Р 34.10-2012-512"
#    set ::pki::oids(1.2.643.2.2.3) "gost"
#    set ::pki::oids(1.2.643.7.1.1.3.2) "gost"
#    set ::pki::oids(1.2.643.7.1.1.3.3) "gost"
#Алгоритмы ключа
#    set ::pki::oids(1.2.643.2.2.19) "ГОСТ Р 34.10-2001"
#    set ::pki::oids(1.2.643.7.1.1.1.1) "ГОСТ Р 34.10-2012 256 байт"
#    set ::pki::oids(1.2.643.7.1.1.1.2) "ГОСТ Р 34.10-2012 512 байт"
    set ::pki::oids(1.2.643.2.2.19) "GostR2001"
    set ::pki::oids(1.2.643.7.1.1.1.1) "GostR2012_256"
    set ::pki::oids(1.2.643.7.1.1.1.2) "GostR2012_512"
#Oid-ы параметров ключа ГОСТ Р 34.10-2001 и ГОСТ Р 34.10-2012-256
    set ::pki::oids(1.2.643.2.2.35.0) "GOST2001-test"
    set ::pki::oids(1.2.643.2.2.35.1) "GOST2001-CryptoPro-A"
    set ::pki::oids(1.2.643.2.2.35.2) "GOST2001-CryptoPro-B"
    set ::pki::oids(1.2.643.2.2.35.3) "GOST2001-CryptoPro-C"
#    { "GOST2001-CryptoPro-A",     set ::pki::oids("GOST2001-CryptoPro-XchA" },
#    { "GOST2001-CryptoPro-C",     set ::pki::oids("GOST2001-CryptoPro-XchB" },
    set ::pki::oids(1.2.643.2.2.36.0) "GOST2001-CryptoPro-A"
    set ::pki::oids(1.2.643.2.2.36.1) "GOST2001-CryptoPro-C"
#Oid-ы параметров ключа ГОСТ Р 34.10-2012-512
    set ::pki::oids(1.2.643.7.1.2.1.2.1) "GOST2012-tc26-A"
    set ::pki::oids(1.2.643.7.1.2.1.2.2) "GOST2012-tc26-B"
#Nick для хэш
    set ::pki::oids(1.2.643.7.1.1.2.2) "STRIBOG256"
    set ::pki::oids(1.2.643.7.1.1.2.3) "STRIBOG512"
    set ::pki::oids(1.2.643.2.2.30.1) "GOSTR3411_CP"
}

#!/usr/bin/tclsh
#загружаем пакет PKI
package require pki
#загружаем файл с процедурой разбора ГОСТ-ых сертификатов
source parse_cert_gost_oid.tcl
if {$argc != 2} {
    puts "Usage: parse_certs_for_verify_load.tcl <проверяемый сертификат> <корневой сертификат>"
    exit 1
}
#Проверяемый сертификат
if {[file exists "[lindex $argv 0]"] == 0 } {
    puts "Usage: parse_certs_for_verify_load.tcl <проверяемый сертификат> <корневой сертификат>"
    puts "Отсутствует файл [lindex $argv 0]"
    exit 1
}
#Корневой сертификат
if {[file exists "[lindex $argv 1]"] == 0 } {
    puts "Usage: parse_certs_for_verify_load.tcl <проверяемый сертификат> <корневой сертификат>"
    puts "Отсутствует файл [lindex $argv 1]"
    exit 1
}
#Устанавливаем nick-и для ГОСТ-овых oid-ов
set_nick_for_oid

set file [lindex $argv 0]
set f [open $file r]
set cert [read $f]
close $f
#READ DER-format
if { [string range $cert 0 9 ] != "-----BEGIN" } {
        set fd [open $file]
        chan configure $fd -translation binary
        set cert [read $fd]
        close $fd
}

array set cert_user [parse_cert_gost $cert]
#Читай рекомендации ТК-26
set len_sign [expr [string length $cert_user(signature)] /2]
set sign_r [string range $cert_user(signature) $len_sign end]
set sign_s [string range $cert_user(signature) 0 [expr $len_sign - 1]]

#puts "Корневой сертификат: $file"
set file [lindex $argv 1]
set f [open $file r]
set cert [read $f]
close $f
#READ DER
    if { [string range $cert 0 9 ] != "-----BEGIN" } {
        set fd [open $file]
        chan configure $fd -translation binary
        set cert [read $fd]
        close $fd
    }

#Распарсиваем в массив корневой сертификат
array set cert_ca [parse_cert_gost $cert]
#Читай рекомендации ТК-26
set len_key [expr [string length $cert_ca(pubkey_rev)]/2]
set key_pub_left [string range $cert_ca(pubkey_rev) $len_key end]
set key_pub_right [string range $cert_ca(pubkey_rev) 0 [expr $len_key - 1]]
puts "/*Делаем C-код: Исходные данные для проверки подписи сертификата*/"
#TBS-проверяемого сертификата
puts "char tbc\[\] = \"[string toupper $cert_user(cert)]\";"
#Тип хэш-функции
puts "char hash_type\[\] = \"$cert_ca(hashkey)\";"
#Открытый ключ корневого сертификата
puts "unsigned char pub_key_ca\[\] = \"(public-key \""
puts "\"(ecc \""
puts "\" (curve $cert_ca(paramkey))\""
puts "\" (q #04[string toupper $key_pub_left$key_pub_right]#)\""
puts "\")\""
puts "\")\";"
#Подпись проверяемого сертификата
puts "unsigned char sig_cert\[\] = \"(sig-val\"" 
puts "\"($cert_ca(type) \""
puts "\" (r #[string toupper $sign_r]#)\""
puts "\" (s #[string toupper $sign_s]#)\""
puts "\")\""
puts "\")\";"
puts "/*Сохраните вывод в файле TEST_from_TCL.h*/"
puts "/*Оттранслируйте модуль TEST_from_Tcl.c: cc -o TEST_from_Tcl TEST_from_Tcl.c -lgcrypt и выполните модуль TEST_from_Tcl*/"

#include 
#include 
#include 
#include 
#include 

#include "TEST_from_TCL.h"

#define digitp(p)     (*(p) >= '0' && *(p) <= '9')
#define hexdigitp(a)  (digitp (a)                     \
                       || (*(a) >= 'A' && *(a) <= 'F')  \
                       || (*(a) >= 'a' && *(a) <= 'f'))
#define xtoi_1(p)     (*(p) <= '9'? (*(p)- '0'): \
                       *(p) <= 'F'? (*(p)-'A'+10):(*(p)-'a'+10))
#define xtoi_2(p)     ((xtoi_1(p) * 16) + xtoi_1((p)+1))
#define xmalloc(a)    gcry_xmalloc ((a))

static void
show_sexp (const char *prefix, gcry_sexp_t a)
{
  char *buf;
  size_t size;

  if (prefix)
    fputs (prefix, stderr);
  size = gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, NULL, 0);
  buf = gcry_xmalloc (size);

  gcry_sexp_sprint (a, GCRYSEXP_FMT_ADVANCED, buf, size);
  fprintf (stderr, "%.*s", (int)size, buf);
  gcry_free (buf);
}
/* Convert STRING consisting of hex characters into its binary
   representation and return it as an allocated buffer. The valid
   length of the buffer is returned at R_LENGTH.  The string is
   delimited by end of string.  The function returns NULL on
   error.  */
static void *
hex2buffer (const char *string, size_t *r_length)
{
  const char *s;
  unsigned char *buffer;
  size_t length;

  buffer = xmalloc (strlen(string)/2+1);
  length = 0;
  for (s=string; *s; s +=2 )
    {
      if (!hexdigitp (s) || !hexdigitp (s+1))
        return NULL;           /* Invalid hex digits. */
      ((unsigned char*)buffer)[length++] = xtoi_2 (s);
    }
  *r_length = length;
  return buffer;
}

int main(int argc, char* argv[]) {
    gpg_error_t err;
    int algo;
    gcry_md_hd_t hd;
    unsigned char *tbs_ptr;
    size_t len_tbs;
    int i;
    unsigned char *h;
    gcry_sexp_t pub_key;
    gcry_sexp_t data;
    gcry_sexp_t sig;
    gcry_mpi_t x;
    int len_xy;
    unsigned char c;
/*Для тестирования архитектуры little-endian или big-endian*/
    unsigned short arch = 1; /* 0x0001 */

    tbs_ptr = hex2buffer(tbc, &len_tbs);
    if (tbs_ptr == NULL) {
      fprintf (stderr, "Bad tbs\n");
        exit(1);
    }
    algo = gcry_md_map_name (hash_type);
    if (algo == GCRY_MD_NONE)
    {
      fprintf (stderr, "Unknown algorithm '%s'\n", hash_type);
      exit (1);
    }

    err = gcry_md_open(&hd, algo, 0);
    if (err)
    {
      fprintf (stderr, "LibGCrypt error %s/%s\n",
          gcry_strsource (err),
          gcry_strerror (err));
        exit (1);
    }
    gcry_md_write (hd, tbs_ptr, len_tbs);
    h  = gcry_md_read(hd, 0);
//    len_xy = gcry_md_get_algo_dlen (algo);
/*Проверяем архитектуру и инвертируем хэш*/
    printf("%s\n", *((unsigned char *) &arch) == 0 ? "Архитектура big-endian" : "Архитекткра little-endian");
    len_xy =  *((unsigned char *) &arch) == 0 ? 0:gcry_md_get_algo_dlen (algo);
    for (i = 0; i < (len_xy/2); i++) {
                    c = *(h + i);
                    *(h + i) = *(h + len_xy - i - 1);
                    *(h + len_xy - i - 1) = c;
    }

fprintf(stderr, "Хэш длина=%d\n", gcry_md_get_algo_dlen (algo));
    for (i = 0; i < gcry_md_get_algo_dlen (algo); i++)
        printf("%02X", h[i]);
//    printf("\n  %s\n", tbc);
    fflush(stdout);
/*Сохраняем хэш */
    x = gcry_mpi_set_opaque_copy(NULL, h, gcry_md_get_algo_dlen (algo) * 8);

/*Закрываем контекст хэширования*/
    gcry_md_reset(hd);
    gcry_md_close(hd);
/*Контекст хэша*/
    err = gcry_sexp_build (&data, NULL,
                             "(data (flags gost) (value %m))", x);
    show_sexp ("ECC GOST data cert:\n", data);
fprintf (stderr, "\nStep 1\n");
/*Контекст публичного ключа корневого сертификата*/
    err = gcry_sexp_sscan (&pub_key, NULL, pub_key_ca,
                           strlen (pub_key_ca));
    if (err){
        fprintf(stderr, "TEST_SEXP: er gcry_sexp_sscan for pub_key_ca\n");
        exit(1);
    }
    show_sexp ("ECC GOST public key:\n", pub_key);
fprintf (stderr, "Step 2\n");
/*Контекст подписи проверяемого сертификата*/
    err = gcry_sexp_sscan (&sig, NULL, sig_cert, strlen (sig_cert));
    if (err){
        fprintf(stderr, "TEST_SEXP: er gcry_sexp_sscan for sig_cert\n");
        exit(1);
    }
    show_sexp ("ECC GOST sig cert:\n", sig);
fprintf (stderr, "Step 3\n");
/*Проверка подписи сертификата*/
    err = gcry_pk_verify (sig, data, pub_key);
    if (err) {
        fprintf (stderr, "TEST_SEXP: verify cert failed\n");
        exit (1);
    }
    fprintf (stderr, "TEST_SEXP: verify cert OK!!\n");
}