PHP的openssl_sign生成的签名与SSCrypto的签名不同

Question

I'm writing an OS X client for a software that is written in PHP. This software uses a simple RPC interface to receive and execute commands. The RPC client has to sign the commands he sends to ensure that no MITM can modify any of them.

However, as the server was not accepting the signatures I sent from my OS X client, I started investigating and found out that PHP's openssl_sign function generates a different signature for a given private key/data combination than the Objective-C SSCrypto framework (which is only a wrapper for the openssl lib):

SSCrypto *crypto = [[SSCrypto alloc] initWithPrivateKey:self.localPrivKey];
NSData *shaed = [self sha1:@"hello"];
[crypto setClearTextWithData:shaed];
NSData *data = [crypto sign];

generates a signature like CtbkSxvqNZ+mAN ...

The PHP code

openssl_sign("hello", $signature, $privateKey);

generates a signature like 6u0d2qjFiMbZ+ ... (For my certain key, of course. base64 encoded)

I'm not quite shure why this is happening and I unsuccessfully experimented with different hash-algorithms. As the PHP documentation states SHA1 is used by default.

So why do these two functions generate different signatures and how can I get my Objective-C part to generate a signature that PHPs openssl_verify will accept?

Note: I double checked that the keys and the data is correct!

Answer 1

Okay, it took quite a few hours. Here's what's happening:

When you call the openssl_sign function, PHP internally uses the EVP API that is provided by the openssl lib. EVP is a "high level" API to the underlying functions like RSA_private_encrypt . So when you call base64_encode(openssl_sign('hello', $signature, $privKey)) that's similar to do something like this on the command line using the openssl binary:

echo -n "hello"| openssl dgst -sha1 -sign priv.key | openssl enc -base64

and NOT

echo -n "hello" | openssl dgst -sha1 | openssl rsautl -encrypt priv.key | openssl enc -base64

I don't know why this produces different output , but it does. If someone has an idea why they differ: please share!
However, as I'm using the SSCrypto framework I rewrote the -sign (and -verify) function with EVP calls (abstract):

OpenSSL_add_all_digests();
EVP_MD_CTX_init(&md_ctx);
EVP_SignInit(&md_ctx, mdtype);
EVP_SignUpdate(&md_ctx, input, inlen);
if (EVP_SignFinal(&md_ctx, (unsigned char*) outbuf, (unsigned int *)&outlen, pkey)) {
    NSLog(@"signed successfully.");
}

And voila: I get the same signatures as I got from PHP. Oh and for the record: PHP uses the PKCS padding.

Thank you guys for pointing me in the right direction!

Answer 2

Your code snippet was a big help, I had the same problem, and I came up with the following method based on your lines, if that helps anyone with the same issue.

- (NSData *)getSignature {
NSString * signString = [self getSignatureText];
NSData * privateKeyData = [self getPrivateKey];

BIO *publicBIO = NULL;
EVP_PKEY *privateKey = NULL;

if (!(publicBIO = BIO_new_mem_buf((unsigned char *)[privateKeyData bytes], [privateKeyData length]))) {
    NSLog(@"BIO_new_mem_buf() failed!");
    return nil;
}

if (!PEM_read_bio_PrivateKey(publicBIO, &privateKey, NULL, NULL)) {
    NSLog(@"PEM_read_bio_PrivateKey() failed!");
    return nil;
}   

const char * data = [signString cStringUsingEncoding:NSUTF8StringEncoding];
unsigned int length = [signString length];
int outlen;
unsigned char * outbuf[EVP_MAX_MD_SIZE];
const EVP_MD * digest = EVP_md5();
EVP_MD_CTX md_ctx;

EVP_MD_CTX_init(&md_ctx);
EVP_SignInit(&md_ctx, digest);
EVP_SignUpdate(&md_ctx, data, length);
if (EVP_SignFinal(&md_ctx, (unsigned char*) outbuf, (unsigned int *) &outlen, privateKey)) {
    NSLog(@"Signed successfully.");
}
EVP_MD_CTX_cleanup(&md_ctx);
EVP_PKEY_free(privateKey);

NSData * signature = [NSData dataWithBytes:outbuf length:outlen];

return signature;

}

Answer 3

It looks to me like your PHP is signing "hello" , while your Objective-C is signing sha1("hello") . That is, the way I read the docs, PHP's openssl_sign is using sha1 by default in the internal mechanics of signing, as opposed to applying sha1 to the data before signing.

Answer 4

Not that it fixes, but your use of rsautl seems to be incorrect. You probably should be using rsautl -sign instead of rsautl -encrypt