# Unable to reproduce correct signature data

"Skatteetaten" is the Norwegian tax authority.

We're currently trying to implement signing of messages for digital cash registry systems and i'm not able to reproduce the desired signed data.

Went back and forth with different types of padding and hashing algorithms, still unable to reproduce the desired return data.

I'm using their validation tool hosted here on github. Trying to get a private key using RSA 1024 to work (Form in Validator.html).

Example private key:

-----BEGIN RSA PRIVATE KEY-----
MIICXwIBAAKBgQDag84L+pT6OlFZ8kav08ixPdugo6bsqOICJrl8TzGY87Iek9K1
dgbz2sr7r0OBl2/ndz0CoxiyKoiLc5YY6wy5Qg1qNRCc4C71r2A7N+vjhfkSSoS7
RQekuhKSMJ1Wp8RfXB/AccWPdqb0Mm1TjklSizptJAANppC12fijFVTocQIDAQAB
Uo8PKC8iyQzYkt+5HJC3Bf+DfzyMMty5NPJVpNK1fr0ftz1TfAK7A0I5PWOq9DPL
pjNmz8DIGCfoMOsg1plfh2oprqK36shpWzG1jzXizui4u+aBAkEA/A6M8fM01L5r
xeGtppKEY8EtaSImnBc09kONP1vPqexNUA8cORqZn3J1GKhv90zk79IWdTrzPN4C
ZTHGpGR/eQJBAN3u7HyT/HqvvIhZksqKS+DTbjYaKGr3KxiAEAKU0PeQOBD5TQds
JVstZ2vGSbAsCU6VNEh8eQfTpxzy59S2mrkCQQCM8P3zFNGH3GqbHdRh/i+1MAHa
x01W5pFnPS4wWypFnsoPVjnJUaCwB08sTnZC6m6GMqw7DVM0j6PY8EaYB7ssVZ9W
RFHNgAL4FcVG38Jr2ySZUQJBAOPa7ScbGi7XTiV3TStW2rhmd9CyKnOeSdjIejGm
R4xrannBqg+ikWXuW0cnuGk2a2a/ymHXq1pSCTFAa2VeryA=
-----END RSA PRIVATE KEY-----

Example public key:

-----BEGIN PUBLIC KEY-----
o6bsqOICJrl8TzGY87Iek9K1dgbz2sr7r0OBl2/ndz0CoxiyKoiLc5YY6wy5Qg1q
NRCc4C71r2A7N+vjhfkSSoS7RQekuhKSMJ1Wp8RfXB/AccWPdqb0Mm1TjklSizpt
JAANppC12fijFVTocQIDAQAB
-----END PUBLIC KEY-----

When using these keys with the signing data:

0;2014-01-24;23:59:59;123456789;1250.00;1000.00

Performing signing with sha1WithRSAEncryption i get the signed data:

gs1HumV5FxfeUum3Ws9s7ZsczPEtXUq+5/5MgYcbUb3hP9CJ2eg9d6Bm+d+D8HtbfLB3fCV8pfXo1JaluJ0JGtwLzyyC2uLDR+qvxRbCbly4W0/Ab8jPuF2KJHEPT9HLtbfwMEclMdyK+xp+OPwOvCCnREV43KMwisMGaB4TziA=

Which is base64 of the signature.

I've tried various PHP-crypto libraries and the openssl commandline tool to reproduce this signature and i can't just get the desired output.

If their validation library is not broken i must be missing something and all the possible combinations i've tried has not yielded the correct result...

Help would be appreciated to say the least.

• Might be more appropriate to security stackexchange. – kodlu Nov 28 '18 at 20:13
• Did you try to sha1 the text and sign the generated signature? SIGN(SHA1("0;2014-01-24;23:59:59;123456789;1250.00;1000.00")) basically – camp0 Nov 28 '18 at 22:21

$$printf '0;2014-01-24;23:59:59;123456789;1250.00;1000.00' \ > |openssl sha1 -sign cry64393.key |openssl base64 -A; echo gs1HumV5FxfeUum3Ws9s7ZsczPEtXUq+5/5MgYcbUb3hP9CJ2eg9d6Bm+d+D8HtbfLB3fCV8pfXo1JaluJ0JGtwLzyyC2uLDR+qvxRbCbly4W0/Ab8jPuF2KJHEPT9HLtbfwMEclMdyK+xp+OPwOvCCnREV43KMwisMGaB4TziA=$$ # or