Endorse script signs a hexstring instead of bytes

[tuupola]

Currently the endorse.py signs data like this:

pleasesign = hex(int(vnbtime))[2:].zfill(8) + hex(int(vnatime))[2:].zfill(8) + clientdet.zfill(32) + client_hihex.zfill(64) + cadet
pleasesignb = bytes(pleasesign, 'utf-8')
signature = ca_prkey.sign(pleasesignb)

This signs the pleasesign string and not the bytes pleasesign hexstring represents. You can test this by comparing the hex output by adding this snippet to endorse.py.

print("--")
print(pleasesign)
print("-")
print(pleasesignb.hex())
print("--")

Example output.

--
67c62660699e1f602001003ffe3ff80505d66743309f0fe56d9410f7e74cd43bfd90326327cfb3c0064489d4f52a2f94260c41076e7ec9a62001003ffe3ff805aee137fe56121d8e
-
363763363236363036393965316636303230303130303366666533666638303530356436363734333330396630666535366439343130663765373463643433626664393033323633323763666233633030363434383964346635326132663934323630633431303736653765633961363230303130303366666533666638303561656531333766653536313231643865
--

Unless I am mistaken you want to sign the actual bytes represented by the hexstring.

pleasesignb = bytes.fromhex(pleasesign)

And now the hex output mathes.

--
67c62660699e1f602001003ffe3ff80505d66743309f0fe56d9410f7e74cd43bfd90326327cfb3c0064489d4f52a2f94260c41076e7ec9a62001003ffe3ff805aee137fe56121d8e
-
67c62660699e1f602001003ffe3ff80505d66743309f0fe56d9410f7e74cd43bfd90326327cfb3c0064489d4f52a2f94260c41076e7ec9a62001003ffe3ff805aee137fe56121d8e
--

[tuupola]

There is another similar code using the hexstring instead of the bytes represented by the hexstring when generating the CSR.

hi = public_bytes.hex()
det = det_orchid(raa, hda, bytes(hi, 'utf-8'))