From: Jan Svitok <jan.svitok@...>
Date: 2006-08-11T22:48:24+09:00
Subject: Re: Cryptographic Signatures: Ruby versus OpenSSL

On 8/11/06, Robert Klemme <shortcutter@googlemail.com> wrote:
> On 11.08.2006 14:07, Andy Stewart wrote:
> > Hello Everyone,
> >
> > I am having problems matching up a signature created with openssl on the
> > command line with a signature created in Ruby.
> >
> > The signature I am trying to get is an RSA encryption with my 1024 bit
> > private key of a SHA-1 hash of data.
> >
> > This is what I did on the command line:
> >
> > $ openssl genrsa -out private.pem 1024
> > $ echo -n "Some text to sign" \
> >     | openssl dgst -sha1 -binary \
> >     | openssl rsautl -sign -inkey private.pem \
> >     | openssl enc -base64
> >
> > This is what I did in Ruby:
> >
> > require 'base64'
> > require 'openssl'
> > include OpenSSL
> > include PKey
> > include Digest
> >
> > private_key = RSA.new(File.open("/Users/andy/tmp/private.pem").read)
> > signature  = private_key.sign(OpenSSL::Digest::SHA1.new, "Some text to
> > sign")
> > puts Base64.encode64(signature)
> >
> > Unfortunately the base64-encoded signatures produced by each method
> > don't match.
> >
> > I have spent quite a lot of time with Google and the RubyPKI source --
> > but I am new to Ruby and have exhausted all the avenues I can think of.
>
> Could it be that in your Ruby script you're missing out the equivalent
> step of "| openssl dgst -sha1 -binary \"?  I'd rather have expected
> something like
>
> signature  = private_key.sign(OpenSSL::Digest::SHA1.new("Some text to
> sign"))

It seems it's not neccessary, sign will do that.

> For testing purposes I'd use the same *file* (i.e. in the file system).
>   And you should open that in binary mode from within Ruby to be sure
> both tools see the same.
>
> I'd probably work through this step by step, i.e. compare the output of
> every step from the first step on.  That way you can easily detect where
> it goes wrong.  HTH

From what I've seen they both should produce PKCS#1-padded signature,
so in this case, only possible difference is that one produces block
type 00, and the other 01, but that's not very probable (=they should
use deterministic type of padding)

I'd try:
- the official test vectors, to see which one is right
- using cmdline tools and/or Bignumber ** and % to decrypt the
signature to see the padding
- crossverification of the respective signatures (i.e. whether cmdline
verifies ruby-generated signature and vice versa)
- stepping through RSA#sign, as it is written in ruby.

Disclaimer: I don't know what version do you have, nor what version
I've looked at, so I may be wrong.