From: Robert Klemme <shortcutter@...>
Date: 2006-08-11T21:40:05+09:00
Subject: Re: Cryptographic Signatures: Ruby versus OpenSSL

On 11.08.2006 14:07, Andy Stewart wrote:
> Hello Everyone,
> 
> I am having problems matching up a signature created with openssl on the 
> command line with a signature created in Ruby.
> 
> The signature I am trying to get is an RSA encryption with my 1024 bit 
> private key of a SHA-1 hash of data.
> 
> This is what I did on the command line:
> 
> $ openssl genrsa -out private.pem 1024
> $ echo -n "Some text to sign" \
>     | openssl dgst -sha1 -binary \
>     | openssl rsautl -sign -inkey private.pem \
>     | openssl enc -base64
> 
> This is what I did in Ruby:
> 
> require 'base64'
> require 'openssl'
> include OpenSSL
> include PKey
> include Digest
> 
> private_key = RSA.new(File.open("/Users/andy/tmp/private.pem").read)
> signature  = private_key.sign(OpenSSL::Digest::SHA1.new, "Some text to 
> sign")
> puts Base64.encode64(signature)
> 
> Unfortunately the base64-encoded signatures produced by each method 
> don't match.
> 
> I have spent quite a lot of time with Google and the RubyPKI source -- 
> but I am new to Ruby and have exhausted all the avenues I can think of.

Could it be that in your Ruby script you're missing out the equivalent 
step of "| openssl dgst -sha1 -binary \"?  I'd rather have expected 
something like

signature  = private_key.sign(OpenSSL::Digest::SHA1.new("Some text to 
sign"))

For testing purposes I'd use the same *file* (i.e. in the file system). 
  And you should open that in binary mode from within Ruby to be sure 
both tools see the same.

I'd probably work through this step by step, i.e. compare the output of 
every step from the first step on.  That way you can easily detect where 
it goes wrong.  HTH

Kind regards

	robert