0
$\begingroup$

Computing the signature of hello.txt file which has the text hello in it, here is done in two steps:

openssl sha1 -binary -out hash hello.txt
openssl pkeyutl -sign -inkey private.key -in hash -out signed -pkeyopt digest:sha1

First we'll get the digest value in the hash file, then this file is signed getting the signed file, this file is the signature of hello.txt

But, when i try to encrypt this hash file;

openssl pkeyutl -encrypt -inkey private.key -in hash -out encrypted

The file encrypted is different from signed. Why these two files are differents? if the answer to my question is no, why not?

Improve this question
$\endgroup$
0

2 Answers 2

Reset to default
3
$\begingroup$

See PKCS1 now at RFC8017; encryption and signature are different things -- and for all PKC not just RSA, publickey encrypts or verifies, privatekey decrypts or signs (see wikipedia).

openssl pkeyutl -encrypt (and also the older rsautl for RSA) accepts a privatekey file (which contains the publickey as well, i.e. the keypair), a publickey file, or a certificate file -- see options -pubin -certin on the man page -- but it uses the publickey -- see the descriptions of -sign -encrypt -decrypt (although -verify[recover] fails to mention it).

See also my long list of Qs explaining that signature is not encryption

Also, encryption is randomized; if you encrypt twice you get different results, so you couldn't determine correctness just by comparing the files anyway. Some signatures are randomized, including RSA-PSS, but not RSA-PKCS1v1_5.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thank's, how does the recipient of the message find out whatever it is inside the signature?, I guess the publickey must be applied somehow, the signature (signed file) cannot be decrypted in openssl, the command -decrypt only accepts the privatekey not the publickey $\endgroup$
    – user2495207
    Oct 20 at 22:25
  • $\begingroup$ @user2495207: for most signature schemes (including common RSA ones) the signed data cannot be recovered from the signature; both data and signature must be sent. There are many ways of doing this; e.g. PGP 3 decades ago pioneered 'clear signing' where the signature is encoded and can only be processed with PGP software, but the data is plain and can be read with any software, with the limitation that when you can't or don't verify the signature you risk forgery or tampering. See xkcd.com/1181 for a humorous take on this. ... $\endgroup$
    – dave_thompson_085
    Oct 22 at 9:18
  • $\begingroup$ ... For RSA only it is possible to design signatures 'with recovery' (rather than 'with appendix') which recover a limited amount of data that must meet strong and specialized constraints. This is used in some specific cases where data needs to be minimized and can be strictly controlled, such as EMV payment-card (smartcard) transactions. $\endgroup$
    – dave_thompson_085
    Oct 22 at 9:23
2
$\begingroup$

No, encryption of a hash of a message is never the same as a signature. The closest it gets is with RSA with PKCS#1v1.5 padding, where signing is related to decryption of a padded hash of a message.

There is no such thing as encrypting with a private key. Private keys can sign or decrypt, by definition. In systems other than RSA it's mathematically invalid, in RSA it's semantically invalid.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.