3

This is my first question here, because I have not found a solution for this. Hopefully someone has an answer for this issue.

I try to sign and verify a message with DSA (Digital Signature Algorithm) and pyOpenSSL wrapper.

I've created an example below:

from OpenSSL.crypto import TYPE_DSA, Error, PKey
from OpenSSL.crypto import FILETYPE_PEM, sign
from Crypto.Hash import SHA
key = PKey()
key.generate_key(TYPE_DSA, 1024)
message = "abc"
digest = SHA.new(message).digest()
data_to_sign = base64.b64encode(digest)
signature = sign(key, data_to_sign, 'sha1')

After running this piece of code I'll get the following result:

OpenSSL.crypto.Error: [('digital envelope routines', 'EVP_SignFinal', 'wrong public key type')]
jww
  • 97,681
  • 90
  • 411
  • 885
Minh Trang Nguyen
  • 51
  • 4
  • `EVP_Sign*` and `EVP_Verify*` are the old interfaces. You should be using the new OpenSSL gear: `EVP_DigestSign*` and `EVP_DigestVerify*`. – jww Jan 17 '15 at 04:52
  • DSA is being dropped from TLS 1.3. Apparently, nobody is using it. Use RSA and ECDSA. TLS 1.3 *might* include `ed25519`. – jww Jan 17 '15 at 04:56

1 Answers1

2

I've found the solution, but I used another python library. The OpenSSL library I am using on my Mac did not work for me. I am using a 4096 bit key and the library did not supports it. On my linux box the following script worked.

from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import interfaces
from cryptography.hazmat.primitives.serialization import load_pem_private_key, load_pem_public_key
from cryptography.hazmat.primitives import hashes
from cryptography.exceptions import InvalidSignature

pem_data = contents = open('./pri.pem').read()
pem_public_data = contents = open('./pub.pem').read()
key = load_pem_private_key(pem_data, password=None, backend=default_backend())
if isinstance(key, interfaces.DSAPrivateKey):
    msg = b"abc"
    signer = key.signer(hashes.SHA1())
    signer.update(msg)
    signature = signer.finalize()
    public_key = load_pem_public_key(pem_public_data, backend=default_backend())
    verifier = public_key.verifier(signature, hashes.SHA1())
    verifier.update(msg)
    try:
        verifier.verify()
        print 'Signature is valid'
    except InvalidSignature:
        print 'InvalidSignature'
Minh Trang Nguyen
  • 51
  • 4
  • Thanks Minh, after a lot of searching, this was the most helpful post about signing with an DSA private key a message in python. – Hassek Jun 05 '15 at 00:09