Hi Maurice, On Mon, Nov 7, 2011 at 8:01 AM, Maurice Mahieu <[email protected]> wrote: > I mean the first case, to verify the signature. > As I understand the signature is the encyrpted digest of the certificate, I > was wondering if it is possible to decrypt the digest using the public key > of the issuer. 'Decrypt with public key' is similar to 'encrypt with private key'. Neither are valid cryptographic transformations.
Have you taken a look at EVP_PKEY_verify (http://www.openssl.org/docs/crypto/EVP_PKEY_verify.html) to see if it fits your needs? Jeff > On 11/07/2011 01:51 AM, Jakob Bohm wrote: >> >> On 11/6/2011 7:33 PM, Maurice Mahieu wrote: >>> >>> I want to know if it is possible to decrypt the signature from a >>> server certicate with the issuers public key using openssl. >>> >> Depends what you mean by "decrypt the signature". >> >> If you are referring to the RSA-specific terminology of using that >> phrase to mean >> "Verify the signature", then of cause. The SSL protocol code in OpenSSL >> probably >> does this by default if used correctly. For doing it outside an SSL >> exchange, use >> the command line command "openssl verify" or the various "verify" >> functions >> in the OpenSSL programming libraries. >> >> If you are referring to somehow getting the information needed to sign a >> different >> certificate or otherwise doing stuff that only the certificate issuer >> should be able >> to do, then no, the whole point is to make this practically impossible >> to do, even >> if you spend billions of dollars on special hardware and software. >> >> ______________________________________________________________________ >> OpenSSL Project http://www.openssl.org >> User Support Mailing List [email protected] >> Automated List Manager [email protected] >> > > ______________________________________________________________________ > OpenSSL Project http://www.openssl.org > User Support Mailing List [email protected] > Automated List Manager [email protected] > ______________________________________________________________________ OpenSSL Project http://www.openssl.org User Support Mailing List [email protected] Automated List Manager [email protected]
