When I call openssl sha1 from the command line

 echo "00" | xxd -r -p | openssl dgst -sha1

the output I am receive is

(stdin)= 5ba93c9db0cff93f52b521d7420e43f6eda2784f

But the NIST Vector output is:

 MD = da39a3ee5e6b4b0d3255bfef95601890afd80709

Can anyone please explain this?

  • 1
    $\begingroup$ for reference, 5ba93c9db0cff93f52b521d7420e43f6eda2784f is the correct result for a 1 byte input of 0x00 $\endgroup$ Commented Apr 28, 2017 at 9:46
  • $\begingroup$ Almost cross-posted: Getting Message Digest from SHA1 message $\endgroup$
    – Artjom B.
    Commented Apr 28, 2017 at 17:59
  • $\begingroup$ Note you need to use -n with echo to prevent adding a trailing new line. You can test this by writing in the terminal $ echo 'foo' and $ echo -n 'foo'. $\endgroup$
    – Daniel
    Commented Feb 13, 2019 at 15:03

1 Answer 1


You read the testvector incorrectly.

I assume you are referring to the following part of the file SHA1ShortMsg.rsp of the FIPS 180-4 vectors:

[L = 20]

Len = 0 
Msg = 00 
MD = da39a3ee5e6b4b0d3255bfef95601890afd80709

This test vector has length 0, so the specified hash is for an empty message and not for a single zero byte. This openssl command shows the correct result.

$ echo -n ""|openssl dgst -sha1
(stdin)= da39a3ee5e6b4b0d3255bfef95601890afd80709

  • $\begingroup$ when the input is not of len 0 Len = 2 Msg = 40 MD = ec6b39952e1a3ec3ab3507185cf756181c84bbe2 The result is echo -n "\x40" | openssl dgst -sha1 (stdin)= 798f17bb2ad6914266daf60dc6e8e2571d779a39 echo -n "40" | xxd -r -p | openssl dgst -sha1 (stdin)= 9a78211436f6d425ec38f5c4e02270801f3524f8 echo -n "40" | openssl dgst -sha1 (stdin)= af3e133428b9e25c55bc59fe534248e6a0c0f17b None are matching with the result $\endgroup$ Commented Apr 28, 2017 at 9:59
  • $\begingroup$ @user3405360 I can't find that example here, but for example the second one works: printf "\x36" | openssl dgst -sha1 gives (stdin)= c1dfd96eea8cc2b62785275bca38ac261256e278 $\endgroup$
    – matsjoyce
    Commented Apr 28, 2017 at 11:00
  • $\begingroup$ I am checking for BIT oriented implementations but your example is for BYTE oriented implementation $\endgroup$ Commented Apr 28, 2017 at 11:32
  • $\begingroup$ openssl dgst can only process full bytes. $\endgroup$
    – mat
    Commented Apr 30, 2017 at 16:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.