kcenon::pacs::security::digital_signature Class Reference

#include <digital_signature.h>

Collaboration diagram for kcenon::pacs::security::digital_signature:

Static Public Member Functions
static auto	sign (core::dicom_dataset &dataset, const certificate &cert, const private_key &key, signature_algorithm algo=signature_algorithm::rsa_sha256) -> kcenon::common::VoidResult
	Sign a DICOM dataset.
static auto	sign_tags (core::dicom_dataset &dataset, const certificate &cert, const private_key &key, std::span< const core::dicom_tag > tags_to_sign, signature_algorithm algo=signature_algorithm::rsa_sha256) -> kcenon::common::VoidResult
	Sign specific tags in a DICOM dataset.
static auto	verify (const core::dicom_dataset &dataset) -> kcenon::common::Result< signature_status >
	Verify digital signatures in a dataset.
static auto	verify_with_trust (const core::dicom_dataset &dataset, const std::vector< certificate > &trusted_certs) -> kcenon::common::Result< signature_status >
	Verify digital signatures with a trusted certificate store.
static auto	get_signature_info (const core::dicom_dataset &dataset) -> std::optional< signature_info >
	Get information about signatures in a dataset.
static auto	get_all_signatures (const core::dicom_dataset &dataset) -> std::vector< signature_info >
	Get all signatures in a dataset.
static auto	has_signature (const core::dicom_dataset &dataset) -> bool
	Check if a dataset contains digital signatures.
static auto	remove_signatures (core::dicom_dataset &dataset) -> bool
	Remove all digital signatures from a dataset.
static auto	generate_signature_uid () -> std::string
	Generate a new Digital Signature UID.

Static Private Member Functions
static auto	compute_mac (const core::dicom_dataset &dataset, std::span< const core::dicom_tag > tags, mac_algorithm algo) -> std::vector< std::uint8_t >
static auto	sign_mac (std::span< const std::uint8_t > mac_data, const private_key &key, signature_algorithm algo) -> kcenon::common::Result< std::vector< std::uint8_t > >
static auto	verify_mac_signature (std::span< const std::uint8_t > mac_data, std::span< const std::uint8_t > signature, const certificate &cert, signature_algorithm algo) -> bool

Detailed Description

Definition at line 68 of file digital_signature.h.

Member Function Documentation

compute_mac()

auto kcenon::pacs::security::digital_signature::compute_mac ( const core::dicom_dataset & dataset, std::span< const core::dicom_tag > tags, mac_algorithm algo ) -> std::vector<std::uint8_t>

staticprivate

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 602 of file digital_signature.cpp.

                           {
    // Serialize elements
    auto data = serialize_elements_for_mac(dataset, tags);
 
    // Compute hash
    const EVP_MD* md = get_mac_evp_md(algo);
    unsigned int md_len = EVP_MD_size(md);
 
    std::vector<std::uint8_t> result(md_len);
 
    evp_md_ctx_ptr ctx(EVP_MD_CTX_new());
    if (!ctx) {
        return {};
    }
 
    if (EVP_DigestInit_ex(ctx.get(), md, nullptr) != 1) {
        return {};
    }
 
    if (EVP_DigestUpdate(ctx.get(), data.data(), data.size()) != 1) {
        return {};
    }
 
    if (EVP_DigestFinal_ex(ctx.get(), result.data(), &md_len) != 1) {
        return {};
    }
 
    result.resize(md_len);
    return result;
}

generate_signature_uid()

auto kcenon::pacs::security::digital_signature::generate_signature_uid ( ) -> std::string

staticnodiscard

Generate a new Digital Signature UID.

Creates a new unique identifier for a digital signature.

Returns

New UID string

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 598 of file digital_signature.cpp.

                                                            {
    return generate_uid();
}

get_all_signatures()

auto kcenon::pacs::security::digital_signature::get_all_signatures ( const core::dicom_dataset & dataset ) -> std::vector<signature_info>

staticnodiscard

Get all signatures in a dataset.

Extracts information for all signatures if multiple are present.

Parameters

dataset

The dataset to inspect

Returns

Vector of signature info (empty if no signatures)

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 556 of file digital_signature.cpp.

                               {
    // For this simplified implementation, we only support one signature
    std::vector<signature_info> result;
 
    auto info = get_signature_info(dataset);
    if (info) {
        result.push_back(std::move(*info));
    }
 
    return result;
}

get_signature_info()

auto kcenon::pacs::security::digital_signature::get_signature_info ( const core::dicom_dataset & dataset ) -> std::optional<signature_info>

staticnodiscard

Get information about signatures in a dataset.

Extracts signature metadata from the Digital Signature Sequence without performing verification.

Parameters

dataset

The dataset to inspect

Returns

Optional containing signature info, or nullopt if no signature

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 506 of file digital_signature.cpp.

                                 {
    if (!has_signature(dataset)) {
        return std::nullopt;
    }
 
    signature_info info;
 
    // Get signature UID
    info.signature_uid = dataset.get_string(signature_uid_tag);
 
    // Get timestamp
    std::string dt_str = dataset.get_string(signature_datetime_tag);
    if (!dt_str.empty()) {
        info.timestamp = parse_dicom_datetime(dt_str);
    }
 
    // Get certificate and extract signer info
    const auto* cert_elem = dataset.get(certificate_of_signer_tag);
    if (cert_elem) {
        auto cert_result = certificate::load_from_der(cert_elem->raw_data());
        if (cert_result.is_ok()) {
            const auto& cert = cert_result.value();
            info.signer_name = cert.subject_common_name();
            info.signer_organization = cert.subject_organization();
            info.certificate_thumbprint = cert.thumbprint();
        }
    }
 
    // Default algorithm (could be extracted from MAC algorithm tag)
    info.algorithm = signature_algorithm::rsa_sha256;
 
    // Get signed tags
    const auto* signed_tags_elem = dataset.get(data_elements_signed_tag);
    if (signed_tags_elem) {
        const auto& tag_data = signed_tags_elem->raw_data();
        for (size_t i = 0; i + 3 < tag_data.size(); i += 4) {
            uint16_t group = static_cast<uint16_t>(tag_data[i]) |
                           (static_cast<uint16_t>(tag_data[i + 1]) << 8);
            uint16_t element = static_cast<uint16_t>(tag_data[i + 2]) |
                             (static_cast<uint16_t>(tag_data[i + 3]) << 8);
            info.signed_tags.push_back(
                (static_cast<uint32_t>(group) << 16) | element);
        }
    }
 
    return info;
}

References kcenon::pacs::security::certificate::load_from_der(), and kcenon::pacs::security::rsa_sha256.

Here is the call graph for this function:

has_signature()

auto kcenon::pacs::security::digital_signature::has_signature ( const core::dicom_dataset & dataset ) -> bool

staticnodiscard

Check if a dataset contains digital signatures.

Parameters

dataset

The dataset to check

Returns

true if Digital Signature Sequence is present

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 570 of file digital_signature.cpp.

          {
    // Check for signature tag or signature sequence
    return dataset.contains(signature_tag) ||
           dataset.contains(digital_signature_sequence_tag);
}

remove_signatures()

auto kcenon::pacs::security::digital_signature::remove_signatures ( core::dicom_dataset & dataset ) -> bool

static

Remove all digital signatures from a dataset.

Removes the Digital Signature Sequence (0400,0561) from the dataset.

Parameters

dataset

The dataset to modify

Returns

true if signatures were removed, false if none present

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 578 of file digital_signature.cpp.

          {
    bool removed = false;
 
    // Remove all signature-related tags
    removed |= dataset.remove(digital_signature_sequence_tag);
    removed |= dataset.remove(signature_uid_tag);
    removed |= dataset.remove(signature_datetime_tag);
    removed |= dataset.remove(certificate_type_tag);
    removed |= dataset.remove(certificate_of_signer_tag);
    removed |= dataset.remove(signature_tag);
    removed |= dataset.remove(mac_id_number_tag);
    removed |= dataset.remove(mac_calculation_transfer_syntax_tag);
    removed |= dataset.remove(mac_algorithm_tag);
    removed |= dataset.remove(data_elements_signed_tag);
 
    return removed;
}

sign()

auto kcenon::pacs::security::digital_signature::sign ( core::dicom_dataset & dataset, const certificate & cert, const private_key & key, signature_algorithm algo = signature_algorithm::rsa_sha256 ) -> kcenon::common::VoidResult

staticnodiscard

Sign a DICOM dataset.

Creates a digital signature for the entire dataset and adds the Digital Signature Sequence (0400,0561) to the dataset.

Parameters

dataset	The dataset to sign (modified in place)
cert	Signer's X.509 certificate
key	Signer's private key (must match certificate's public key)
algo	Signature algorithm to use (default: RSA-SHA256)

Returns

Result indicating success or error

Note

The dataset is modified to include the signature sequence.

All existing data elements are signed by default.

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 289 of file digital_signature.cpp.

                            {
    // Get all signable tags
    auto tags = get_signable_tags(dataset);
    return sign_tags(dataset, cert, key, tags, algo);
}

sign_mac()

auto kcenon::pacs::security::digital_signature::sign_mac ( std::span< const std::uint8_t > mac_data, const private_key & key, signature_algorithm algo ) -> kcenon::common::Result<std::vector<std::uint8_t>>

staticprivate

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 637 of file digital_signature.cpp.

                                               {
    if (!key.is_loaded()) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            1, "Private key not loaded", "digital_signature");
    }
 
    // Get EVP_PKEY from private_key
    // Note: This requires internal access to the private_key implementation
    auto* key_impl = key.impl();
    if (!key_impl) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            2, "Invalid private key", "digital_signature");
    }
 
    // Access the EVP_PKEY through the impl
    // In production, this would use a proper internal API
    EVP_PKEY* pkey = reinterpret_cast<EVP_PKEY*>(const_cast<void*>(
        static_cast<const void*>(key_impl)));
 
    const EVP_MD* md = get_evp_md(algo);
 
    evp_md_ctx_ptr ctx(EVP_MD_CTX_new());
    if (!ctx) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            3, "Failed to create context: " + get_openssl_error(), "digital_signature");
    }
 
    if (EVP_DigestSignInit(ctx.get(), nullptr, md, nullptr, pkey) != 1) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            4, "Failed to init sign: " + get_openssl_error(), "digital_signature");
    }
 
    if (EVP_DigestSignUpdate(ctx.get(), mac_data.data(), mac_data.size()) != 1) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            5, "Failed to update sign: " + get_openssl_error(), "digital_signature");
    }
 
    // Get signature length
    size_t sig_len = 0;
    if (EVP_DigestSignFinal(ctx.get(), nullptr, &sig_len) != 1) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            6, "Failed to get signature length: " + get_openssl_error(), "digital_signature");
    }
 
    std::vector<std::uint8_t> signature(sig_len);
    if (EVP_DigestSignFinal(ctx.get(), signature.data(), &sig_len) != 1) {
        return kcenon::common::make_error<std::vector<std::uint8_t>>(
            7, "Failed to create signature: " + get_openssl_error(), "digital_signature");
    }
 
    signature.resize(sig_len);
    return signature;
}

sign_tags()

auto kcenon::pacs::security::digital_signature::sign_tags ( core::dicom_dataset & dataset, const certificate & cert, const private_key & key, std::span< const core::dicom_tag > tags_to_sign, signature_algorithm algo = signature_algorithm::rsa_sha256 ) -> kcenon::common::VoidResult

staticnodiscard

Sign specific tags in a DICOM dataset.

Creates a digital signature for only the specified tags.

Parameters

dataset	The dataset to sign (modified in place)
cert	Signer's X.509 certificate
key	Signer's private key
tags_to_sign	List of tags to include in signature
algo	Signature algorithm to use

Returns

Result indicating success or error

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 300 of file digital_signature.cpp.

                            {
    if (!cert.is_loaded()) {
        return kcenon::common::make_error<std::monostate>(
            1, "Certificate not loaded", "digital_signature");
    }
 
    if (!key.is_loaded()) {
        return kcenon::common::make_error<std::monostate>(
            2, "Private key not loaded", "digital_signature");
    }
 
    if (!cert.is_valid()) {
        return kcenon::common::make_error<std::monostate>(
            3, "Certificate is not valid (expired or not yet valid)", "digital_signature");
    }
 
    // Compute MAC of the data
    auto mac_algo = get_mac_algorithm(algo);
    auto mac = compute_mac(dataset, tags_to_sign, mac_algo);
 
    // Sign the MAC
    auto signature_result = sign_mac(mac, key, algo);
    if (signature_result.is_err()) {
        return kcenon::common::make_error<std::monostate>(
            signature_result.error().code,
            signature_result.error().message,
            "digital_signature");
    }
 
    const auto& signature_bytes = signature_result.value();
 
    // Create Digital Signature Sequence item
    // For simplicity, we'll add the signature data directly to the dataset
    // In a full implementation, this would create a proper sequence item
 
    // Generate signature UID
    std::string sig_uid = generate_signature_uid();
 
    // Get certificate DER
    auto cert_der = cert.to_der();
 
    // Create signed tags list (as AT type - list of tags)
    std::vector<std::uint8_t> signed_tags_data;
    for (const auto& tag : tags_to_sign) {
        uint16_t group = tag.group();
        uint16_t element = tag.element();
        signed_tags_data.push_back(static_cast<uint8_t>(group & 0xFF));
        signed_tags_data.push_back(static_cast<uint8_t>((group >> 8) & 0xFF));
        signed_tags_data.push_back(static_cast<uint8_t>(element & 0xFF));
        signed_tags_data.push_back(static_cast<uint8_t>((element >> 8) & 0xFF));
    }
 
    // Add signature elements to dataset
    // Note: In a full DICOM implementation, these would be in a sequence item
    dataset.set_string(signature_uid_tag, encoding::vr_type::UI, sig_uid);
    dataset.set_string(signature_datetime_tag, encoding::vr_type::DT, format_dicom_datetime());
    dataset.set_string(certificate_type_tag, encoding::vr_type::CS, "X509_1993_SIG");
 
    // Add certificate data
    dataset.insert(core::dicom_element(
        certificate_of_signer_tag,
        encoding::vr_type::OB,
        cert_der));
 
    // Add signature
    dataset.insert(core::dicom_element(
        signature_tag,
        encoding::vr_type::OB,
        signature_bytes));
 
    // Add MAC algorithm
    dataset.set_string(mac_algorithm_tag, encoding::vr_type::CS,
        std::string(to_dicom_uid(mac_algo)));
 
    // Add signed tags
    dataset.insert(core::dicom_element(
        data_elements_signed_tag,
        encoding::vr_type::AT,
        signed_tags_data));
 
    return kcenon::common::ok();
}

References kcenon::pacs::encoding::AT, kcenon::pacs::encoding::CS, kcenon::pacs::encoding::DT, kcenon::pacs::encoding::OB, kcenon::pacs::security::to_dicom_uid(), and kcenon::pacs::encoding::UI.

Here is the call graph for this function:

verify()

auto kcenon::pacs::security::digital_signature::verify ( const core::dicom_dataset & dataset ) -> kcenon::common::Result<signature_status>

staticnodiscard

Verify digital signatures in a dataset.

Verifies all digital signatures present in the Digital Signature Sequence (0400,0561).

Parameters

dataset

The dataset to verify

Returns

Result containing signature status or error

Note

Returns signature_status::no_signature if no signatures present.

Returns signature_status::invalid if any signature fails verification.

Definition at line 389 of file digital_signature.cpp.

                                          {
    // Check if signature exists
    if (!has_signature(dataset)) {
        return signature_status::no_signature;
    }
 
    // Get signature info
    auto info = get_signature_info(dataset);
    if (!info) {
        return kcenon::common::make_error<signature_status>(
            1, "Failed to extract signature info", "digital_signature");
    }
 
    // Get certificate from dataset
    const auto* cert_elem = dataset.get(certificate_of_signer_tag);
    if (!cert_elem) {
        return kcenon::common::make_error<signature_status>(
            2, "No certificate in signature", "digital_signature");
    }
 
    auto cert_result = certificate::load_from_der(cert_elem->raw_data());
    if (cert_result.is_err()) {
        return kcenon::common::make_error<signature_status>(
            3, "Failed to load certificate: " + cert_result.error().message,
            "digital_signature");
    }
 
    const auto& cert = cert_result.value();
 
    // Check certificate validity
    if (cert.is_expired()) {
        return signature_status::expired;
    }
 
    if (!cert.is_valid()) {
        return signature_status::untrusted_signer;
    }
 
    // Get signed tags
    const auto* signed_tags_elem = dataset.get(data_elements_signed_tag);
    std::vector<core::dicom_tag> signed_tags;
 
    if (signed_tags_elem) {
        const auto& tag_data = signed_tags_elem->raw_data();
        for (size_t i = 0; i + 3 < tag_data.size(); i += 4) {
            uint16_t group = static_cast<uint16_t>(tag_data[i]) |
                           (static_cast<uint16_t>(tag_data[i + 1]) << 8);
            uint16_t element = static_cast<uint16_t>(tag_data[i + 2]) |
                             (static_cast<uint16_t>(tag_data[i + 3]) << 8);
            signed_tags.emplace_back(group, element);
        }
    } else {
        // If no signed tags specified, use all non-signature tags
        signed_tags = get_signable_tags(dataset);
    }
 
    // Compute MAC
    auto mac = compute_mac(dataset, signed_tags, mac_algorithm::sha256);
 
    // Get signature
    const auto* sig_elem = dataset.get(signature_tag);
    if (!sig_elem) {
        return kcenon::common::make_error<signature_status>(
            4, "No signature data found", "digital_signature");
    }
 
    // Verify signature
    bool valid = verify_mac_signature(
        mac,
        sig_elem->raw_data(),
        cert,
        info->algorithm);
 
    return valid ? signature_status::valid : signature_status::invalid;
}

References kcenon::pacs::security::expired, kcenon::pacs::security::invalid, kcenon::pacs::security::certificate::load_from_der(), kcenon::pacs::security::no_signature, kcenon::pacs::security::sha256, kcenon::pacs::security::untrusted_signer, and kcenon::pacs::security::valid.

Here is the call graph for this function:

verify_mac_signature()

auto kcenon::pacs::security::digital_signature::verify_mac_signature ( std::span< const std::uint8_t > mac_data, std::span< const std::uint8_t > signature, const certificate & cert, signature_algorithm algo ) -> bool

staticprivate

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 695 of file digital_signature.cpp.

          {
    if (!cert.is_loaded()) {
        return false;
    }
 
    // Get X509 from certificate
    auto* cert_impl = cert.impl();
    if (!cert_impl) {
        return false;
    }
 
    // Access the X509 through the impl
    X509* x509 = reinterpret_cast<X509*>(const_cast<void*>(
        static_cast<const void*>(cert_impl)));
 
    EVP_PKEY* pkey = X509_get_pubkey(x509);
    if (!pkey) {
        return false;
    }
 
    const EVP_MD* md = get_evp_md(algo);
 
    evp_md_ctx_ptr ctx(EVP_MD_CTX_new());
    if (!ctx) {
        EVP_PKEY_free(pkey);
        return false;
    }
 
    bool result = false;
 
    if (EVP_DigestVerifyInit(ctx.get(), nullptr, md, nullptr, pkey) == 1 &&
        EVP_DigestVerifyUpdate(ctx.get(), mac_data.data(), mac_data.size()) == 1 &&
        EVP_DigestVerifyFinal(ctx.get(), signature.data(), signature.size()) == 1) {
        result = true;
    }
 
    EVP_PKEY_free(pkey);
    return result;
}

verify_with_trust()

auto kcenon::pacs::security::digital_signature::verify_with_trust ( const core::dicom_dataset & dataset, const std::vector< certificate > & trusted_certs ) -> kcenon::common::Result<signature_status>

staticnodiscard

Verify digital signatures with a trusted certificate store.

Verifies signatures and validates the signer's certificate against a set of trusted certificates.

Parameters

dataset	The dataset to verify
trusted_certs	Trusted certificates for validation

Returns

Result containing signature status or error

Examples

/home/runner/work/pacs_system/pacs_system/include/kcenon/pacs/security/digital_signature.h.

Definition at line 467 of file digital_signature.cpp.

                                          {
    // First do basic verification
    auto basic_result = verify(dataset);
    if (basic_result.is_err()) {
        return basic_result;
    }
 
    auto status = basic_result.value();
    if (status != signature_status::valid && status != signature_status::untrusted_signer) {
        return status;
    }
 
    // Get signer certificate
    const auto* cert_elem = dataset.get(certificate_of_signer_tag);
    if (!cert_elem) {
        return signature_status::untrusted_signer;
    }
 
    auto cert_result = certificate::load_from_der(cert_elem->raw_data());
    if (cert_result.is_err()) {
        return signature_status::untrusted_signer;
    }
 
    const auto& signer_cert = cert_result.value();
    std::string signer_thumbprint = signer_cert.thumbprint();
 
    // Check if signer is in trusted list
    for (const auto& trusted : trusted_certs) {
        if (trusted.thumbprint() == signer_thumbprint) {
            return signature_status::valid;
        }
    }
 
    return signature_status::untrusted_signer;
}

References kcenon::pacs::security::certificate::load_from_der(), kcenon::pacs::security::untrusted_signer, and kcenon::pacs::security::valid.

Here is the call graph for this function:

---

The documentation for this class was generated from the following files:

• include/kcenon/pacs/security/digital_signature.h
• src/security/digital_signature.cpp