Signature differs in JAVA and OpenSSL CLI

Question

I have an architecture where I want to sign some data on one server with private key and verify the signature on another server with respective public key. I have java code to sign data on my first server and verification of same data on second server is using OpenSSL shell. Somehow I am unable to implement this, my verification fails on second server. To debug I decided to sign the data on second server using same private key as used by first server and compare both the signatures. It seems both the servers generate different signatures.

Generating signature on First Server -

`String My_Message = "This is Sample Text";

//Get Key from file tkt_privkey_rsa.pem
PrivateKey priv = loadPrivateKey();

// Compute digest
MessageDigest sha1 = MessageDigest.getInstance("SHA1");
byte[] digest = sha1.digest(My_Message.getBytes());

//Prepare signature.
Signature sign = Signature.getInstance("SHA1withRSA");
sign.initSign(priv);            
sign.update(digest);

//Sign the data with private key.
byte[] realSig = sign.sign();

//encode Signature
String encodedSig = Base64.getEncoder().encodeToString(realSig);

System.out.println("Signature Generated -\n"+encodedSig);

return encodedSig;

Output – Signature Generated - Aap+/3SvcXs/pCsSnih+MDjoMU9GdWSkPsQ8DSELpxKUhHNwKneKi8NkIzy0Hrw9GGvGfeWUTzZhg1XWYcOso4oRqN6kWyX5BLAbdDV+uncmv0kFqp5PlRobNpjPgqdvjp6vrME7HGN4yLW0eIN1alOBYRFPzS/J4O7Ds0LzRILCmToo4dhGy/DI109CdVSdNQdzuGJ4bZoTGnRiXKmupUf3arJAq+zRCtIFd/k4LCVr9tZQIjOgkpjOForjbsgkXnFrq8WAop6f9qk3cb9tJuExzqdi5LhjplO5xm8VjxqEkwB/HI+3aiF0xzgzMf6DrUyCUQx20ewWaaOubBonvg==

Second Server using OpenSSL -

echo "This is Sample Text"| openssl dgst -sha1 -sign tkt_privkey_rsa.pem | openssl enc -base64 -A

Output – nyGcKeXHTK85/MuydT9Y/cd/rbR1ojAQmfFiVvDvEs46qOhIFAv8H4kbaQO63TUyXFlKV1nTiHaPrBnBfW2iKZXSDrcThO3R5znYwvA1RamxmHz5OVRQjGzBdStO43pRML4xGpa9keBj4RCEFM1NlDot4IUrVenyerQhEnymTaaVamIVmVyxYpm2/9b85umqXo/BsATKP174Amqd52X+ED1Cr/CbXVmErvOmxjMdPm9iEYgnWnRc74z6MQzt62gcP3uHuaFlR3U0dRNq51Vr1Z9vZ44NILSRqMZMIU//XZ7bwnnoraj3LeJ9pPzTNdN2Wv3BOYyFXxBi08O/Q517GA==

Try `echo -n "This is Sample Text"`. Echo adds a new line at the end by default. `echo -n` doesn't add a new line. — Aamir Rizwan, Nov 23 '17 at 11:04

score 2 · Accepted Answer · edited Jun 20 '20 at 09:12

2

The sha1 digest in Java code is not needed. SHA1withRSA signature algorithm will do it, so you are hashing twice

Remove

 MessageDigest sha1 = MessageDigest.getInstance("SHA1");
 byte[] digest = sha1.digest(My_Message.getBytes());

And use directly sign.update(messageBytes);

See also this if you have problems Why are the RSA-SHA256 signatures I generate with OpenSSL and Java different?

SHA-1 is no longer considered secure. You should not use it

edited Jun 20 '20 at 09:12

Community

1
1

answered Nov 22 '17 at 20:07

pedrofb

37,271
5
94
142

Plus Unix `echo "stuff"` outputs `stuff` PLUS NEWLINE, which is different from just `stuff` -- and has a different signature. Depending on your OS and/or shell, using `-n` or `\c` _may_ avoid this, but `printf '%s' "stuff"` is more portable and reliable. Windows is worse; `echo "stuff"` outputs `"stuff"` including the quotemarks plus CRLF, and the closest fix is a hack using `set /p`. Plus for non-ASCII text there's the risk of different encodings. It's better to use a file where you can control or at least know exactly what the input is. – dave_thompson_085 Nov 22 '17 at 20:24
Check the `echo` problem commented by @dave_thomson_085. You could also try `openssl dgst -sha1 -sign tkt_privkey_rsa.pem< data.txt ` – pedrofb Nov 22 '17 at 20:39

Signature differs in JAVA and OpenSSL CLI

1 Answers1