Signature is invalid when it is added to csr. signature is created using safenet's sdk

Question

We have generated public key and private key using below code. Then tried to sign the certificate information using the signn method to create the signature of csr.

In sign method, generateKeyPairUtil method is called only to get the private key labeled by enrollmentId(It is called once before to generate key pair labelled by enrollmentId). Then the signature is created and it's of 512 bytes long hex string.

In swift end, I converted the hex string to Data ans it's size becomes 256 bytes. After that, we are creating csr according to below code in follow up questions.

Signature seems invalid in csr because of conflicting header type

After generating csr, when i am verifying csr with public key, it says that signature is invalid. Is there any way around to get rid of this incomplete verification?

std::string Dongle::sign(char *password, char* data, char* enrollmentId) {
    CK_RV rv = CKR_OK;
    CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
    
    LoadCryptoki(pkcs11_path);
    
    rv = GetFirstSlotId(&slotId);
    
    rv = C_OpenSession(slotId, (CKF_SERIAL_SESSION | CKF_RW_SESSION), NULL_PTR, NULL_PTR, &hSession);
    
    CK_OBJECT_HANDLE hPrivateKey = Dongle::generateKeyPairUtil(hSession, password, enrollmentId);
    
    std::string signature = Dongle::signUtil(hSession, hPrivateKey, password, data, enrollmentId);
    
    
    printf("OPERATION SUCCESS\n");
    //verify(password, signature, enrollmentId, );
    
end:
    if (hSession) fl->C_CloseSession(hSession);
    UnloadCryptoki();
    return signature;
}

CK_OBJECT_HANDLE Dongle::generateKeyPairUtil(CK_SESSION_HANDLE hSession, char *password, char *enrollmentId) {
    CK_RV rv = CKR_OK;
    CK_BBOOL    bFalse  = CK_FALSE;
    CK_BBOOL    bTrue   = CK_TRUE;
    CK_KEY_TYPE keyType = CKK_RSA;
    
    CK_OBJECT_HANDLE hPublicKey  = CK_INVALID_HANDLE;
    CK_OBJECT_HANDLE hPrivateKey = CK_INVALID_HANDLE;
    
    std::string labelPub = std::string("public") + enrollmentId;
    std::string labelPriv = std::string("private") + enrollmentId;
    
    
    CK_UTF8CHAR * labelPublic  = convertToCK_UTF8CHAR(labelPub);  //Label of public key.
    CK_UTF8CHAR * labelPrivate = convertToCK_UTF8CHAR(labelPriv); //Label of private key.
    
    // Setup public key attributes.
    CK_OBJECT_CLASS  classPublicKey = CKO_PUBLIC_KEY;
    CK_ULONG         vecModulusBits[] = { 2048 };
    CK_BYTE          publicExponent[] = { 0x01, 0x00, 0x01 };
    
    CK_ATTRIBUTE publicKeyTemplate[] =
    {
        { CKA_CLASS,            &classPublicKey,    sizeof(classPublicKey)      },
        { CKA_LABEL,            labelPublic,        strlen((char*)labelPublic)  },
        { CKA_KEY_TYPE,         &keyType,           sizeof(keyType)             },
        { CKA_TOKEN,            &bTrue,             sizeof(bTrue)               },
        { CKA_PRIVATE,          &bFalse,            sizeof(bFalse)              },
        { CKA_MODULUS_BITS,     &vecModulusBits[0], sizeof(vecModulusBits[0])   },
        { CKA_PUBLIC_EXPONENT,  &publicExponent,    sizeof(publicExponent)      },
    };
    
    // Setup private key attributes.
    CK_OBJECT_CLASS  classPrivateKey = CKO_PRIVATE_KEY;
    CK_ATTRIBUTE privateKeyTemplate[] =
    {
        { CKA_CLASS,            &classPrivateKey,   sizeof(classPrivateKey)     },
        { CKA_LABEL,            labelPrivate,       strlen((char*)labelPrivate) },
        { CKA_KEY_TYPE,         &keyType,           sizeof(keyType)             },
        { CKA_TOKEN,            &bTrue,             sizeof(bTrue)               },
        { CKA_PRIVATE,          &bTrue,             sizeof(bTrue)               },
    };
    
    // Setup mechanism to generate an RSA key pair.
    CK_MECHANISM mechanism;
    memset (&mechanism, 0, sizeof (mechanism));
    mechanism.mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
    
    // Login to the token with a user password.
    C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, strlen(password));
    
    // Try to find the two RSA keys with a specific label using the FindObject() function.
    hPrivateKey = FindObjects(hSession, privateKeyTemplate, DIM(privateKeyTemplate));
    hPublicKey  = FindObjects(hSession, publicKeyTemplate,  DIM(publicKeyTemplate));
    
    // Generate a new RSA key pair if an RSA key with the same label doesn't exist on the token.
    if ( ! (hPublicKey && hPrivateKey) )
    {
        printf("Wait for RSA key pair generation ... \n");
        rv = C_GenerateKeyPair(hSession, &mechanism, publicKeyTemplate, 7, privateKeyTemplate, 5, &hPublicKey, &hPrivateKey);
        
        if (rv == CKR_OK) {
            printf("OPERATION SUCCESS. Key Pair Generated Successfully.\n");
        }
    }
    
    else {
        printf("Key Pair Already Exists \n");
    }
    
end:
    C_Logout(hSession);
    return hPrivateKey;
}


std::string Dongle::signUtil(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hPrivateKey, char* password, char* data, char* enrollmentId) {
    //std::cout<<"data is: " << *data;
    CK_RV retCode = CKR_OK;
    
    int       isPaddingRequired = 0;
    int       isDataFromUser = 0;
    
    CK_MECHANISM mech;
    CK_BYTE pSigData[3000];
    
#ifndef PKCS11_V1
    CK_ULONG usSigLen = sizeof(pSigData);
#else
    CK_ULONG usSigLen = 0;
#endif
    char *pInputData = 0;
    unsigned long ulInputDataLen = strlen(data);
    std::cout << "length: " << ulInputDataLen;
    CK_BYTE_PTR pInData = (CK_BYTE_PTR)data;
    
    
    std::cout << "Mechanism: [6]SHA256-RSA" <<std::endl;
    
    retCode = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, strlen(password));
    
    mech.mechanism       = CKM_SHA256_RSA_PKCS;
    mech.pParameter      = 0;
    mech.ulParameterLen  = 0;
    isDataFromUser       = 0;
    
    
    if( retCode == CKR_OK )
    {
        if( isPaddingRequired )
        {
            for(unsigned long ulLoop=ulInputDataLen; ulLoop<64; ++ulLoop)
            {
                pInData[ulLoop] = 0;
            }
            ulInputDataLen = 64;
        }
    }
    
    
    if (retCode == CKR_OK)
    {
        retCode = C_SignInit(hSession, &mech, hPrivateKey);
    }
    
    CK_ULONG usInLen = (CK_ULONG)ulInputDataLen;
    
    // get the signature length
    if(retCode == CKR_OK)
    {
        retCode = C_Sign(hSession, pInData, usInLen, (CK_BYTE_PTR)NULL_PTR, &usSigLen);
    }
    
    // get the signature
    if(retCode == CKR_OK)
    {
        retCode = C_Sign(hSession, pInData, usInLen, (CK_BYTE_PTR)pSigData, &usSigLen);
    }
    
    std::string returnSignature = "";
    
    if( (retCode == CKR_OK) && usSigLen )
    {
        std::cout << "Signed Data " << std::endl << "(hex) ";
        //returnSignature = base64_encode(pSigData,usSigLen);
        for(unsigned long ulLoop=0; ulLoop<usSigLen; ++ulLoop)
        {
            char pBuffer[25];

            sprintf(pBuffer, "%02x", pSigData[ulLoop]);
            std::cout << pBuffer;

            returnSignature += pBuffer;
        }
//        returnSignature = base64_encode(pSigData, usSigLen);
        std::cout << std::endl;
        std::cout << "returned signature: \n";
        std::cout << returnSignature;
    }
    char arr[returnSignature.length() + 1];
        for (int x = 0; x < sizeof(arr); x++) {
            arr[x] = returnSignature[x];
        }
    //verify(password, arr,enrollmentId,pSigData,returnSignature.length(),2048);
    
    // Release memory
    if( pInputData )
    {
        delete pInputData;
    }
    
    return returnSignature;
}

std::string Dongle::getPublicKeyBits(char* enrollmentId, char* password) {
    CK_RV rv = CKR_OK;
    CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
    
    printf("\nThis sample demonstrates how to search for an object based on provided attribute template and how to generate an RSA key pair using PKCS#11 functions.\n\n");
    
    LoadCryptoki(pkcs11_path);
    
    rv = GetFirstSlotId(&slotId);
    if (rv != CKR_OK) {
        printf("Error getting slot ID\n");
    }
    
    rv = fl->C_OpenSession(slotId, (CKF_SERIAL_SESSION | CKF_RW_SESSION), NULL_PTR, NULL_PTR, &hSession);
    
    if (rv != CKR_OK) {
        printf("Error opening session\n");
    }
    
    CK_BBOOL    bFalse  = CK_FALSE;
    CK_BBOOL    bTrue   = CK_TRUE;
    CK_KEY_TYPE keyType = CKK_RSA;
    
    CK_OBJECT_HANDLE hPublicKey  = CK_INVALID_HANDLE;
    
    std::string labelPub = std::string("public") + enrollmentId;
    
    CK_UTF8CHAR * labelPublic  = convertToCK_UTF8CHAR(labelPub) ;  //Label of public key.
    
    // Setup public key attributes.
    CK_OBJECT_CLASS  classPublicKey = CKO_PUBLIC_KEY;
    CK_ULONG         vecModulusBits[] = { 2048 };
    CK_BYTE          publicExponent[] = { 0x01, 0x00, 0x01 };
    
    CK_ATTRIBUTE publicKeyTemplate[] =
    {
        { CKA_CLASS,            &classPublicKey,    sizeof(classPublicKey)      },      // 0
        { CKA_LABEL,            labelPublic,        strlen((char*)labelPublic)  },      // 1
        { CKA_KEY_TYPE,         &keyType,           sizeof(keyType)             },      // 2
        { CKA_TOKEN,            &bTrue,             sizeof(bTrue)               },      // 3
        { CKA_PRIVATE,          &bFalse,            sizeof(bFalse)              },      // 4
        { CKA_MODULUS_BITS,     &vecModulusBits[0], sizeof(vecModulusBits[0])   },      // 5
        { CKA_PUBLIC_EXPONENT,  &publicExponent,    sizeof(publicExponent)      },      // 6
    };
    
    
    // Login to the token with a user password.
    C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, strlen(password));
    
    // Try to find the two RSA keys with a specific label using the FindObject() function.
    hPublicKey  = FindObjects(hSession, publicKeyTemplate,  DIM(publicKeyTemplate));
    
    // Generate a new RSA key pair if an RSA key with the same label doesn't exist on the token.
    if (!hPublicKey) {
        printf("Public Key not found\n");
    }
    
    CK_ULONG obj_bits = 0;
    
    CK_ATTRIBUTE attrVal[] = {
        { CKA_MODULUS, NULL_PTR, 0 },
        { CKA_PUBLIC_EXPONENT, NULL_PTR, 0 },
        { CKA_MODULUS_BITS, &obj_bits, sizeof(obj_bits) }
    };
    
    // Get length
    rv = C_GetAttributeValue(hSession, hPublicKey, &attrVal[0], 2) ;
    
    attrVal[0].pValue = (CK_VOID_PTR)malloc(attrVal[0].ulValueLen);
    attrVal[1].pValue = (CK_VOID_PTR)malloc(attrVal[1].ulValueLen);
    
    // Check values
    rv = C_GetAttributeValue(hSession, hPublicKey, &attrVal[0], 3) ;
    
    
    if (rv != CKR_OK) {
        printf("Error getting attribute value of PublicKey modulus and exponents\n");
    }
    
    CK_BYTE_PTR modulus = (CK_BYTE_PTR) attrVal[0].pValue;
    CK_BYTE_PTR exponent = (CK_BYTE_PTR) attrVal[1].pValue;
    
    //std::string modulusStr = bytePtrToStr(modulus, attrVal[0].ulValueLen);
    //std::string exponentStr = bytePtrToStr(exponent, attrVal[1].ulValueLen);
    std::string modulusStr = base64_encode(modulus, attrVal[0].ulValueLen);
    std::string exponentStr = base64_encode(exponent, attrVal[1].ulValueLen);
    
    char c[modulusStr.size() + 1];
    char p[exponentStr.size() + 1];
    
    std::strcpy(c, modulusStr.c_str());
    std::strcpy(p, exponentStr.c_str());
    
    EVP_PKEY * publicKeyEVP = RSA_fromBase64(c, p);
    
    std::string publicKeyBits = getRSAKeyTextRepresentation(publicKeyEVP);
    
    free(attrVal[0].pValue);
    free(attrVal[1].pValue);

    
end:
    C_Logout(hSession);
    return publicKeyBits;
    
}

- (NSString*) signn: (NSString*)password data: (NSData*)data enrollmentId: (NSString*)enrollmentId {
  Dongle *d = (Dongle*)dong;
  
  char * pass = strdup([password UTF8String]);
  //char * signData = strdup([data UTF8String]);
  char * enId = strdup([enrollmentId UTF8String]);
  const void *_Nullable rawData = [data bytes];
  char *signData = (char *)rawData;
  std::cout << data;
  std::cout << "size of signed data: \n";
  std::cout << strlen(signData);
 // char *signData = (char *)[data2 bytes];
  char bits[2048];
  int i;
  for (i=0; i<strlen(signData)*8; i++) {
      bits[i] = ((1 << (i % 8)) & (signData[i/8])) >> (i % 8);
  }
  //char * signData = strdup([nsData UTF8String]);;
  NSString* signaturedString = [NSString stringWithCString:d->sign(pass, bits, enId).c_str() encoding:[NSString defaultCStringEncoding]];
  return signaturedString;
}

***Note, I tried signData as Data type, String type and then bitstring conversion type as used above. In every case, signature seems invalid.