From: Andy Stewart <ruth_andy@...>
Date: 2006-08-12T03:07:59+09:00
Subject: Re: Cryptographic Signatures: Ruby versus OpenSSL


On 11 Aug 2006, at 18:28, Francis Cianfrocca wrote:

> RSA#sign is basically a wrapper over EVP_SignInit, EVP_SignUpdate and
> EVP_SignFinalize, which are themselves a high-level wrapper over the
> actual crypto operations. The EVP_xxx calls do the hashing for you, so
> since you're using RSA, you have to specify a digest algorithm.

So what's the difference between:

- a signature specifying RSA on top of SHA-1
- RSA encryption using a private key of SHA-1 hashed data?

Conceptually they are the same, I believe, so why do  
RSA::private_encrypt and RSA::sign behave differently?

> I assume you tested the Ruby output with rsautl -verify and it worked?

Yes indeed.  I did:

$ ruby sig.rb | openssl enc -base64 -d | openssl rsautl -verify - 
inkey public.pem -pubin | xxd

And that wrote out the SHA-1 digest of my original data.

By the way, the pipeline came from Allan Odgaard here: http:// 
macromates.com/sigpipe/archives/2004/09/05/using-openssl-for-license- 
keys/

Thanks and regards,
Andy