Difference between openSSL rsautl and dgst

by

The simple answer is that dgst -sign creates a hash, ASN1 encodes it, and then signs the ASN1 encoded hash, whereas rsautl -sign just signs the input without hashing or ASN1 encoding. Both methods include the input data in the output, together with the signature, rather than producing only a signature as output. Here is a Bash script that shows the difference between openssl dgst -sign and openssl rsautl -sign. 

#!/bin/bash
# @(#) Bash script demos difference between openssl rsautl and dgst signing
# Usage: $0 <name of file to sign> <private key file, without passphrase>

# 1. Make an ASN1 config file

cat >asn1.conf <<EOF
asn1 = SEQUENCE:digest_info_and_digest

[digest_info_and_digest]
dinfo = SEQUENCE:digest_info
digest = FORMAT:HEX,OCT:`openssl dgst -sha256 $1 |cut -f 2 -d ' '`

[digest_info]
algid = OID:2.16.840.1.101.3.4.2.1
params = NULL

EOF

# If you are wondering what the "algid = OID:2.16.840.1.101.3.4.2.1" is, it's
# the SHA256 OID, see http://oid-info.com/get/2.16.840.1.101.3.4.2.1

# 2. Make a DER encoded ASN1 structure that contains the hash and
# the hash type
openssl asn1parse -i -genconf asn1.conf -out $1.dgst.asn1

# 3. Make a signature file that contains both the ASN1 structure and
# its signature
openssl rsautl -sign -in $1.dgst.asn1 -inkey $2 -out $1.sig.rsa

# 4. Verify the signature that we just made and ouput the ASN structure
openssl rsautl -verify -in $1.sig.rsa -inkey $2 -out $1.dgst.asn1_v

# 5. Verify that the output from the signature matches the original
# ASN1 structure
diff $1.dgst.asn1 $1.dgst.asn1_v

# 6. Do the equivalent of steps 1-5 above in one "dgst" command
openssl dgst -sha256 -sign $2 -out $1.sig.rsa_dgst $1

# 7. Verify that the signature file produced from the rsautl and the dgst
# are identical
diff $1.sig.rsa $1.sig.rsa_dgst

See my comment above to the OP for the credits.

More Related Contents:

  1. How to create public and private key with openssl?
  2. How can I transform between the two styles of public key format, one “BEGIN RSA PUBLIC KEY”, the other is “BEGIN PUBLIC KEY”
  3. Differences between “BEGIN RSA PRIVATE KEY” and “BEGIN PRIVATE KEY”
  4. Converting pfx to pem using openssl
  5. CMake not able to find OpenSSL library
  6. Use RSA private key to generate public key? [closed]
  7. Converting PKCS#12 certificate into PEM using OpenSSL
  8. Verify a certificate chain using openssl verify
  9. Convert PEM traditional private key to PKCS8 private key
  10. Using OpenSSL what does “unable to write ‘random state'” mean?
  11. Multiple OpenSSL RSA signing methods produce different results
  12. How to extract public key using OpenSSL?
  13. OpenSSL Verify return code: 20 (unable to get local issuer certificate)
  14. How do I manage the error “OpenSSL v1.1.1 ssl_choose_client_version unsupported protocol”? [closed]
  15. Why is Apple Deprecating OpenSSL in MacOS 10.7 (Lion)? [closed]
  16. RSA: Get exponent and modulus given a public key
  17. Correct location of openssl.cnf file
  18. Programmatically Create X509 Certificate using OpenSSL
  19. How to generate an openSSL key using a passphrase from the command line?
  20. Convert pem key to ssh-rsa format
  21. How to save public key from a certificate in .pem format
  22. How to convert an ECDSA key to PEM format
  23. Unable to load Private Key. (PEM routines:PEM_read_bio:no start line:pem_lib.c:648:Expecting: ANY PRIVATE KEY) [closed]
  24. Creating a .p12 file
  25. How do I get Visual Studio Code to trust our self-signed proxy certificate?
  26. When was TLS 1.2 support added to OpenSSL?
  27. Cross Compile OpenSSH for ARM
  28. How to make browser trust localhost SSL certificate? [closed]
  29. Java equivalent of an OpenSSL AES CBC encryption
  30. How to install: OpenSSL + WAMP

Leave a Comment