AS3 RSAKey.sign() != PHP openssl_sign()

Question

everyone!

I have some PHP code to sign some text and it works fine. I need to have equivalent of this code on actionscript 3. I need your help.

$privateKeyPath = "private.key";
$message = "hello";
$privateKey = file_get_contents($privateKeyPath);
openssl_sign($message, $signature, $privateKey);

echo base64_encode($signature);

In AS3 I using as3crypto library to make sign:

private function readPrivateKey():String {
    var f:File = new File("/Users/ivan/Desktop/private.key");
    var fs:FileStream = new FileStream();
    fs.open(f,FileMode.READ);
    var key:String = fs.readUTFBytes(fs.bytesAvailable);
    fs.close();
    return key;
}

private function getSign():void {
    var message:String = "hello";
    var privateKey:String = readPrivateKey();
    var srcBA:ByteArray = new ByteArray();
    var resultBA:ByteArray = new ByteArray();
    var rsaKey:RSAKey;
    var base64encoder:Base64Encoder = new Base64Encoder();

    srcBA.writeUTFBytes(message);

    rsaKey = PEM.readRSAPrivateKey(privateKey);
    rsaKey.sign(srcBA, resultBA, srcBA.length);
    b64encoder.encodeBytes(resultBA);

    trace(b64encoder.toString());
}

I have same private key file. I expect that the output values are equals. But these values are different =( What am I doing wrong?

UPDATE: I tried to verify my encoded base64 string using public key and verify method - everything is ok inside Actionscript. Example:

var text:String = "hello";
var srcBA:ByteArray;
var desBA:ByteArray;

var rsaKey:RSAKey;
var encodedB64:String;

// ENCODING 

srcBA = new ByteArray();
srcBA.writeUTFBytes(text);

desBA = new ByteArray();

rsaKey = PEM.readRSAPrivateKey( readPrivateKey() );
rsaKey.sign(srcBA, desBA, srcBA.length);

encodedB64 = Base64.encodeByteArray(desBA);
trace("Original: " + text);
trace("Encoded: " + encodedB64 );


// DECODING

var srcBA2:ByteArray = new ByteArray();
var desBA2:ByteArray = new ByteArray();
var rsaKey2:RSAKey = PEM.readRSAPublicKey( readPublicKey() );

srcBA2 = Base64.decodeToByteArray( encodedB64 );

rsaKey2.verify(srcBA2, desBA2, srcBA2.length);

trace("Decoded: " + desBA2.toString() );

My original text and decoded value are equals. So, I conclude that AS3 signing methods are different than PHP. Is anyone have idea to make it equals?

Thanks.

Hello Sergeev Ivan, Let me describe issue: openssl_sign() creates digest from data and encrypts information about kind of digest And its default encryption function is OPENSSL_ALGO_SHA1 While you are using rsaKey.sign to create signature, so both signature are different — JK Patel, Mar 26 '16 at 12:12
JK Patel, thank you for your comment. Ok, I got it, but my task is still actual. I need to have clone of openssl_sign(). Yes, that's my post on upwork — Sergeev Ivan, Mar 27 '16 at 05:02

score 0 · Answer 1 · answered Sep 20 '16 at 15:21

Maybe it's late answer, but anyway... AS3 works fine in your second code, PHP needs some tweaks, like this:

$privateKeyPath = "private.key";
$message = "hello";
$privateKey = openssl_pkey_get_private(file_get_contents($privateKeyPath));
openssl_private_encrypt($message, $signature, $privateKey);

echo base64_encode($signature);

I just checked with key genereted on this site: http://www.selfsignedcertificate.com/ and everything works fine, I'm getting similar results in both PHP and AS3 versions.

AS3 RSAKey.sign() != PHP openssl_sign()

1 Answers1