1
$\begingroup$

I want to understand why creating a signed-digest of a file is different from creating a digest and then signing it. IE. If I do the latter, the verify fails.

Here is my test script. Can someone please explain why I get "Verify Failed" on the last line please.

#!/bin/bash

set -x

# A file to sign
truncate  --size=2000  test.zip

# Generate a keypair, and extract the public key
openssl  genrsa -aes128  -out keyTest -passout pass:123  1024
openssl  rsa    -pubout  -in  keyTest -passin  pass:123  -out pubTest

# generate a signed digest
openssl  dgst   -sha512 -binary  -sign keyTest  -passin pass:123  -out test.sig  test.zip

# generate a digest, then sign it
openssl  dgst   -sha512 -binary                                   -out test.dgst  test.zip
openssl  rsautl -sign            -inkey keyTest -passin pass:123  -in test.dgst  -out test.sig_dgst

openssl  dgst -sha512 -binary  -verify pubTest  -signature test.sig       test.zip
#Verified OK

openssl  dgst -sha512 -binary  -verify pubTest  -signature test.sig_dgst  test.zip
#Verification Failure  <-- Why does this fail?
$\endgroup$
  • 1
    $\begingroup$ This is about using a particular tool which is generally voted offtopic for crypto.SX, but see summary with multiple links (one migrated from here) at stackoverflow.com/a/38768455/2868801. PS: SHA-512 with RSA-1024 is grossly mismatched and a waste of effort; that part is ontopic for crypto but already answered many times. $\endgroup$ – dave_thompson_085 Mar 27 '17 at 3:32
  • 2
    $\begingroup$ What you do (most likely): one time you sign the hash of the message, the other time you sign the hash of the hash of the digest. $\endgroup$ – SEJPM Mar 27 '17 at 6:58
  • $\begingroup$ @dave_thompson_085 I thought it was a question about signing digests, with an example using openssl - are you stating this is a problem with openssl? ..."1024/512" - Yes, I reduced the keysize to speed up the test-phase. ...Ironic, I started an account here specifically to ask this question in the right place! $\endgroup$ – BlueChip Mar 27 '17 at 10:34
  • $\begingroup$ Note that a lot of cryptographic API's provide functionality to directly provide a (partial) hash to the signature generation function. Problem is that you won't easily find this functionality in command line tools. You don't want to necessarily hash a 2 GiB document on a smart card, to name just one issue. $\endgroup$ – Maarten Bodewes Mar 27 '17 at 17:10
  • 3
    $\begingroup$ BlueChip: yes your discrepancy here is specifically the openssl commandline program and not inherent in the algorithms or even OpenSSL library (aka libcrypto); see the links I pointed you to. @SEJPM: there is no double hashing here; as stated at my link the difference is including or omitting one step of RSASSA-PKCS1-v1_5 namely encoding an ASN.1 sequence containing the hash. $\endgroup$ – dave_thompson_085 Mar 28 '17 at 3:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.