doumeng3188 2011-10-30 15:22
浏览 119

有人可以告诉我openssl_sign示例有什么问题

Here's php demo code to sign data with private 2048 bit dsa key:

$priv_key = '-----BEGIN DSA PRIVATE KEY-----
MIIDVQIBAAKCAQEA/uhSKJA6k5sSnYo+uBgi+mzJ72hqZrWgc+dNLpiiKoHsqDZ6
7kGW0J3wnhU0FxpV2SVL57SfG6dC7GvwsJYBidSEJqe3bARP8WI4yL9wm1PVTqFD
4zNkj1+zUZDWQWpJxaA8I10sJR08/WbwgD63bD6jg4JiPaowFMOrufYAW92hjANQ
D7eZ+t0GXAoDB5L6q8btVRfJrGOvkdDN6eyzc7kpJEVC9g1J9Q6glnHQRIGdW4Ot
ys/bpv2mGMfEykyTWhcMSLaAZ0YLTyKRfjYm8g7dCFWo3i8Fu0Jr+N3IWZI9Jgw5
lGyUSX8x89gjMsqtcOzcrjOtC51oAh+pio8jaQIhAM2VbbgAoxSSVO3Nd5y2mPiO
k62rr9cCj4tNy0MtYG3rAoIBABnMeAAeJpNpe3UhmWrGSJN/nQe76FSIhV/0wsu4
Xu65tW610i+uf8t0ZDqHCrbF9LSvk6vPiBydKhOmmStCa/aJJZhCKYI9/8WgtXG8
kSvAzLTNnozSLeHkapZHJwqY1wT+qxElheXjHJBRzgXVqwB+0CeJokJYlWiaPfuN
n3H1GDekuYXSFAaK4bC4TEsctQH1/403ljSbv99aXVDTVSnW0hdbokyLSPsiJjvz
w6GkyEiK/j6V2dTrIRn2X2ftzbTsE+0vEenHosIzJwM8+zUrhLvVvPBARWnbmsQ/
YstGs7WERGQzkFSsuPsWCN53Os4NnBEPiYg8//Cy1EHat3ACggEAD3mqwlAaPixs
Up49/HYlGqrU4e862rWY7mb5XRJ7AY9t70C5hhZrVO/DTgpGkwO0Yi/cYo6W0g//
cP73Nb2KZwaiyTCet2VsXb0H/8gvi8OqlidEpormedYW1T0DoyVrw57gXF0hp0D8
scfZBg0hFM/hHlmqHPKYiZtDp5imk5TeSyIoLdyJjW8jII2ni8ryStjvZ61aAPyK
VH8in3DpVANpn3MSGv1Hv1RYxaago71fVUyOkm1/pFNqBNIwBAxBIUsIPdNpjoGB
bLKXDshCfdXkQJxnx80nVDslEkv10BapLqIr98uswU/bBYMduF6Xrg5pdugDG3Cw
X8n3glog8QIgayYvNGvBvrDp9piq8RDg9mQJsd4IFBlpF7MnqIc749M=
-----END DSA PRIVATE KEY-----
';

$pkeyid = openssl_get_privatekey($priv_key);
if(empty($pkeyid)){
    die("Can't load key id");
}
$data = $_GET['i'];
// compute signature
if(!openssl_sign($data, $signature, $pkeyid,OPENSSL_ALGO_SHA1)){
    echo "Failed to sign data: $data";
}
// free the key from memory
openssl_free_key($pkeyid);
echo $signature;

The script always fails at openssl_sign. I'm getting no errors or failures, just FALSE at the output of openssl_sign and the $signature is empty

I've generated the key with

openssl dsaparam -out dsaparam.pem 2048
openssl gendsa -out privkey.pem dsaparam.pem

What could be wrong?

  • 写回答

1条回答 默认 最新

  • doujia6433 2012-12-04 16:24
    关注

    When using DSA to sign things, you need to use OPENSSL_ALGO_DSS1 not OPENSSL_ALGO_SHA1 as the hashing algorithm.

    The help file for the OpenSSL command-line version of this says:

    If you wish to sign or verify data using the DSA algorithm then the dss1 digest must be used.

    This is an idiosyncrasy of the OpenSSL library, DSS1 is actually the same algorithm as SHA1 but OpenSSL insists that you call is DSS1 if you're using it with DSA!

    评论

报告相同问题?

悬赏问题

  • ¥100 set_link_state
  • ¥15 虚幻5 UE美术毛发渲染
  • ¥15 CVRP 图论 物流运输优化
  • ¥15 Tableau online 嵌入ppt失败
  • ¥100 支付宝网页转账系统不识别账号
  • ¥15 基于单片机的靶位控制系统
  • ¥15 真我手机蓝牙传输进度消息被关闭了,怎么打开?(关键词-消息通知)
  • ¥15 装 pytorch 的时候出了好多问题,遇到这种情况怎么处理?
  • ¥20 IOS游览器某宝手机网页版自动立即购买JavaScript脚本
  • ¥15 手机接入宽带网线,如何释放宽带全部速度