I'm trying to go through the basic exercise of signing and verifying a signature using OpenSSL. Signing works fine
$ openssl pkeyutl -hexdump -sign -inkey id_rsa -in test.txt > test.sig
Enter pass phrase for id_rsa:
$ cat test.sig
0000 - 20 ab 34 00 ff 87 50 1e-de fb c9 3d 10 2f 7b fd .4...P....=./{.
0010 - 99 a1 61 e0 3d 5f 93 82-63 e9 0a 6f 1a 22 4f 04 ..a.=_..c..o."O.
etc...
However, when I try to verify that signature, I get an error.
$ openssl pkeyutl -verify -pubin -inkey id_rsa.pub.pem -signature test.sig test.txt
unable to load Public Key
The public key that I'm trying to use is a converted SSH public key in PEM format:
-----BEGIN RSA PUBLIC KEY-----
MIICCAKCAf8wxsGr3b/rR/BsRqRMBaKPEGATYhSNaqnThcx9YdA7jHcj1dK7Utmo
nXZz7WwB0W1vzADZpzX96UUX5OIn1iByZ3ZQZpkO6YApMYxo/oHyiBYiCyEhbqKR
TydzmXFGYJ6UtLBFLD1eKfJokhiqdRa1kVMdAd6nBT5JiNb0ADO3VisyPwQZpqyB
Izbq1643JT2PC1BYk1cqqxyTnY/kAEEQvcQwrd0y7p29slRHC6g77HToWJLzNdAj
b2rjkRIfMzDx0LwmCuEqh+9XfVYQFJyrqXTrcgQlKBQhTSneSnn/9SpqYs4ziOIR
4djO9BbhGb/09LSb31NFy6S99rXsElI2aSaaGz5y6/6wyYq+zMxmiS//iCV/heNv
i3PH+D2hxOdz+VEvAJ77x4cMOn3ovVW73aWoBsNP8c9ISKt6MSXClljskA1WFcYJ
9UuBicQ/FGL2j96lzQ2NZZrYru0gAOkj3WUF/z5ORGC7iRvgOc89oqUxKNG+N/RN
jrMbCBAN8hOlJCW0e7/MoangYtBtZ52ZSIxYACRRfKTUlKdjsE9UVYrqBtTeVDGp
Igb+0kuBD61XF6IpnHEX0OZeArL7FY1trDJ85lUU09qNbnlnxNAY2Qo3cZiXSRBW
ROBUxz0OzF2Gvj30BEiY1rshH+XtM5ViQo1nK+YkBQcrCbwfnCFBAgMBAAE=
-----END RSA PUBLIC KEY-----
generated with the command
ssh-keygen -f key.pub -e -m pem
Based on discussions and documentation that I've read about this problem, that should work. But it doesn't.
Any hints?
EDIT: I've just tried the same process with a pair of keys generated with OpenSSL rather than converted SSH keys. That merely fails silently rather than producing an error (openssl
gives me pkeyutl
usage information rather than verifying the signature).
EDIT 2: Using a binary signature (omitting -hexdump
) has the same effect on keys generated with OpenSSL. On converted RSA keys, I get
unable to load Public Key
Error initializing context
[snip usage output]