BCryptVerifySignature

The BCryptVerifySignature function verifies that the specified signature matches the specified hash.

Syntax

NTSTATUS BCryptVerifySignature(
         BCRYPT_KEY_HANDLE hKey,
         VOID *pPaddingInfo,
         PUCHAR pbHash,
         ULONG cbHash,
         PUCHAR pbSignature,
         ULONG cbSignature,
         ULONG dwFlags
)  

Parameters

hKey
Type: BCRYPT_KEY_HANDLE 

[in] The handle of the key to use to decrypt the signature. This must be an identical key or the public key portion of the key pair used to sign the data with the BCryptSignHash function.

pPaddingInfo
Type: VOID *

[in, optional] A pointer to a structure that contains padding information. The actual type of structure this parameter points to depends on the value of the dwFlags parameter. This parameter is only used with asymmetric keys and must be NULL otherwise.

pbHash
Type: PUCHAR 

[in] The address of a buffer that contains the hash of the data. The cbHash parameter contains the size of this buffer.

cbHash
Type: ULONG 

[in] The size, in bytes, of the pbHash buffer.

pbSignature
Type: PUCHAR 

[in] The address of a buffer that contains the signed hash of the data. The BCryptSignHash function is used to create the signature. The cbSignature parameter contains the size of this buffer.

cbSignature
Type: ULONG 

[in] The size, in bytes, of the pbSignature buffer. The BCryptSignHash function is used to create the signature.

dwFlags
Type: ULONG 

[in] A set of flags that modify the behavior of this function. The allowed set of flags depends on the type of key specified by the hKey parameter.

If the key is a symmetric key, this parameter is not used and should be zero.

Return value

Type: NTSTATUS 

Returns a status code that indicates the success or failure of the function.

Return codes

Possible return codes include, but are not limited to, the following.

Remarks

This function decrypts the signature with the provided key and then compares the decrypted value to the specified hash value.

To use this function, you must hash the data by using the same hashing algorithm that was used to create the hash value that was signed. If applicable, you must also specify the same padding scheme that was specified when the signature was created.

Depending on what processor modes a provider supports, BCryptVerifySignature can be called either from user mode or kernel mode. Kernel mode callers can execute either at PASSIVE_LEVEL IRQL or DISPATCH_LEVEL IRQL. If the current IRQL level is DISPATCH_LEVEL, the handle provided in the hKey parameter must be derived from an algorithm handle returned by a provider that was opened by using the BCRYPT_PROV_DISPATCH flag, and any pointers passed to the BCryptVerifySignature function must refer to nonpaged (or locked) memory.

Requirements

Header: Declared in bcrypt.h.

Library: Use bcrypt.lib.