2

I need signature data in hex form, so I use:

openssl dgst -sha256 -hex -sign ./id_rsa my.data > my.signature

The openssl docs note that:

Hex signatures cannot be verified using openssl. Instead, use "xxd -r" or similar program to transform the hex signature into a binary signature prior to verification. Source

But, when I try to do this ...

echo "$(cat my.signature)" | xxd -r -p > binary.signature

... I get nothing

Can anyone see what I'm doing wrong?

jww
  • 97,681
  • 90
  • 411
  • 885
Dan
  • 4,197
  • 6
  • 34
  • 52
  • 1
    Stack Overflow is a site for programming and development questions. This question appears to be off-topic because it is not about programming or development. See [What topics can I ask about here](http://stackoverflow.com/help/on-topic) in the Help Center. Perhaps [Super User](http://superuser.com/) or [Unix & Linux Stack Exchange](http://unix.stackexchange.com/) would be a better place to ask. – jww Dec 22 '17 at 06:33

1 Answers1

4

Dan, the hex signature file is not a plain hex string. It starts with non-hex prefix that xxd failes to parse. Something like RSA-SHA256(my.data)=. You need to remove it before verification.

cat my.signature | sed -e 's/.*= \([^ ]\+\)$/\1/' | xxd -r -p > binary.signature

One little tip. If you used ssh-keygen to create file id_rsa, then corresponding id_rsa.pub is not suitable for openssl, it is in ssh format. You need to generate a public key in PEM format. 

openssl rsa -in id_rsa -pubout > id_rsa.pub.pem

This is the right format for verification.

openssl dgst -verify id_rsa.pub.pem -signature binary.signature my.data
-> Verified OK
Pak Uula
  • 2,750
  • 1
  • 8
  • 13
  • Thank you for the insight -- that sed syntax doesn't seem to work, unfortunately – Dan Dec 22 '17 at 15:43
  • Update: apparently it's due to differences between linux sed and macOS sed – Dan Dec 22 '17 at 15:54
  • I'm a perfect dummy in MacOS ) Though I tried those snippets in Linux and they worked. The idea in sed regex is to find the trailing sequence without spaces. – Pak Uula Dec 22 '17 at 16:09