Hi Thomas,
Thus wrote Thomas Anderson ([email protected]):
> ubu...@ubuntu:~$ openssl rsautl -sign -in rsa.txt -inkey rsa.txt -out sig
> Enter pass phrase for rsa.txt:
> RSA operation error
> 1543:error:0406C06E:rsa routines:RSA_padding_add_PKCS1_type_1:data too
> large for key size:rsa_pk1.c:73:
> If I didn't know better, I'd guess that rsautl wasn't signing messages
> but rather was encrypting them, even though I had "out -sig" set. So
> how do I sign with rsautl? Is it even possible? And how do I sign
> with PSS as opposed to PKCS#1?
the manpage of rsautl says
NOTES
rsautl because it uses the RSA algorithm directly can only be used to
sign or verify small pieces of data.
In your example, the error is triggered by
if (flen > (tlen-RSA_PKCS1_PADDING_SIZE))
{
RSAerr(RSA_F_RSA_PADDING_ADD_PKCS1_TYPE_1,RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE);
tlen is the length of RSA's number n (all calculations are modulo n).
flen is the length of your input and RSA_PKCS1_PADDING_SIZE is 11 bytes.
For signing, rsautl indeed encrypts the input data with the private key,
see rsautl.c
switch(rsa_mode) {
[...]
case RSA_SIGN:
rsa_outlen = RSA_private_encrypt(rsa_inlen, rsa_in, rsa_out, rsa, pad);
I suggest running the content through a digest before signing and
verifying.
openssl genrsa -out key.pem 2048
openssl rsa -in key.pem -pubout > pubKey.pem
openssl sha1 -sign key.pem input.txt > sig.txt
openssl sha1 -verify pubKey.pem -signature sig.txt input.txt
Best regards,
Martin
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List [email protected]
Automated List Manager [email protected]
