0

I am using OpenSSL in iOS app to sign a message. I use RSA_sign to sign. When I use RSA_verify to verify the signature, result is like this

050 +(f2d7846a5f495a743e470663facf7a2858d052cf

Where f2d7846a5f495a743e470663facf7a2858d052cf is the original signature. So I am getting additional 050 +( at the beginning of the signature. Can anyone please tell me the reason of this?

This is how I am signing

int sign = RSA_sign(NID_sha1,( char *)reply, strlen(reply), signature, &siglen, myRSA );

where reply contains sha1 hashed data to be signed.

Best Regards

1 Answer 1

0

I'm very surprised that you see anything other than the original signature in the buffer. RSA_verify is not supposed to "return" anything other than the result of the verification (in the returned integer value, 0 for failure, 1 for success. Please use the methods as defined in the SSL documentation.

In my opinion it is a bug that you can see the hash in the first place. Unfortunately OpenSSL is not very well documented.

1
  • Anything missing from my answer, Aqueel? Relying on the returned hash may be dangerous, it may change in the implementation as it is not part of the documented interface. Oct 19, 2013 at 17:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.