General¶

Some signature implementations only accumulate the input data and do no further processing before verifying it (they expect the input to be a digest), while others compress the data, typically by internally producing a digest, and signing the result, which is then verified against a given signature. Some of them support both modes of operation at the same time. The caller is expected to know how the chosen algorithm is supposed to behave and under what conditions.

For example, an RSA implementation can be expected to only expect a digest as input, while ED25519 can be expected to process the input with a hash, i.e. to produce the digest internally, and while RSA-SHA256 can be expected to handle either mode of operation, depending on if the operation was initialized with EVP_PKEY_verify_init_ex2() or with EVP_PKEY_verify_message_init().

Similarly, an RSA implementation usually expects additional details to be set, like the message digest algorithm that the input is supposed to be digested with, as well as the padding mode (see EVP_PKEY_CTX_set_signature_md(3) and EVP_PKEY_CTX_set_rsa_padding(3) and similar others), while an RSA-SHA256 implementation usually has these details pre-set and immutable.

The functions described here can't be used to combine separate algorithms. In particular, neither EVP_PKEY_CTX_set_signature_md(3) nor the OSSL_PARAM parameter "digest" (OSSL_SIGNATURE_PARAM_DIGEST) can be used to combine a signature algorithm with a hash algorithm to process the input. In other words, it's not possible to specify a ctx pre-loaded with an RSA pkey, or an algo that fetched "RSA" and try to specify SHA256 separately to get the functionality of RSA-SHA256. If combining algorithms in that manner is desired, please use EVP_DigestVerifyInit(3) and associated functions, or EVP_VerifyInit(3) and associated functions.

Performing multiple verifications¶

When initialized using EVP_PKEY_verify_init_ex() or EVP_PKEY_verify_init_ex2(), EVP_PKEY_verify() can be called more than once on the same context to have several one-shot operations performed using the same parameters.

When initialized using EVP_PKEY_verify_message_init(), it's not possible to call EVP_PKEY_verify() multiple times.

On EVP_PKEY_CTX_set_signature()¶

Some signature algorithms (such as LMS) require the signature verification data be specified before verifying the message. Other algorithms allow the signature to be specified late. To allow either way (which may depend on the application's flow of input), the signature to be verified against must be specified using this function when using EVP_PKEY_verify_message_update() and EVP_PKEY_verify_message_final() to perform the verification.

RSA with PKCS#1 padding for SHA256¶

Verify signature using PKCS#1 padding and a SHA256 digest as input:

 #include <openssl/evp.h>
 #include <openssl/rsa.h>
 EVP_PKEY_CTX *ctx;
 unsigned char *md, *sig;
 size_t mdlen, siglen;
 EVP_PKEY *verify_key;
 /*
  * NB: assumes verify_key, sig, siglen md and mdlen are already set up
  * and that verify_key is an RSA public key
  */
 ctx = EVP_PKEY_CTX_new(verify_key, NULL /* no engine */);
 if (ctx == NULL)
     /* Error occurred */
 if (EVP_PKEY_verify_init(ctx) <= 0)
     /* Error */
 if (EVP_PKEY_CTX_set_rsa_padding(ctx, RSA_PKCS1_PADDING) <= 0)
     /* Error */
 if (EVP_PKEY_CTX_set_signature_md(ctx, EVP_sha256()) <= 0)
     /* Error */
 /* Perform operation */
 ret = EVP_PKEY_verify(ctx, sig, siglen, md, mdlen);
 /*
  * ret == 1 indicates success, 0 verify failure and < 0 for some
  * other error.
  */

RSA-SHA256 with a pre-computed digest¶

Verify a digest with RSA-SHA256 using one-shot functions. To be noted is that RSA-SHA256 is assumed to be an implementation of "sha256WithRSAEncryption", for which the padding is pre-determined to be RSA_PKCS1_PADDING, and the input digest is assumed to have been computed using SHA256.

 #include <openssl/evp.h>
 #include <openssl/rsa.h>
 EVP_PKEY_CTX *ctx;
 /* md is a SHA-256 digest in this example. */
 unsigned char *md, *sig;
 size_t mdlen = 32, siglen;
 EVP_PKEY *signing_key;
 /*
  * NB: assumes verify_key, sig, siglen, md and mdlen are already set up
  * and that verify_key is an RSA public key
  */
 ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
 alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);
 if (ctx == NULL)
     /* Error occurred */
 if (EVP_PKEY_verify_init_ex2(ctx, alg, NULL) <= 0)
     /* Error */
 /* Determine buffer length */
 if (EVP_PKEY_verify(ctx, sig, siglen, md, mdlen) <= 0)
     /* Error or signature doesn't verify */
 /* Perform operation */
 ret = EVP_PKEY_verify(ctx, sig, siglen, md, mdlen);
 /*
  * ret == 1 indicates success, 0 verify failure and < 0 for some
  * other error.
  */

RSA-SHA256, one-shot¶

Verify a document with RSA-SHA256 using one-shot functions. To be noted is that RSA-SHA256 is assumed to be an implementation of "sha256WithRSAEncryption", for which the padding is pre-determined to be RSA_PKCS1_PADDING.

 #include <openssl/evp.h>
 #include <openssl/rsa.h>
 EVP_PKEY_CTX *ctx;
 /* in the input in this example. */
 unsigned char *in, *sig;
 /* inlen is the length of the input in this example. */
 size_t inlen, siglen;
 EVP_PKEY *signing_key;
 EVP_SIGNATURE *alg;
 /*
  * NB: assumes signing_key, in and inlen are set up before
  * the next step. signing_key must be an RSA private key,
  * in must point to data to be digested and signed, and
  * inlen must be the size of the data in bytes.
  */
 ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
 alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);
 if (ctx == NULL || alg == NULL)
     /* Error occurred */
 if (EVP_PKEY_verify_message_init(ctx, alg, NULL) <= 0)
     /* Error */
 /* Perform operation */
 ret = EVP_PKEY_verify(ctx, sig, siglen, in, inlen);
 /*
  * ret == 1 indicates success, 0 verify failure and < 0 for some
  * other error.
  */

RSA-SHA256, using update and final¶

This is the same as the previous example, but allowing stream-like functionality.

 #include <openssl/evp.h>
 #include <openssl/rsa.h>
 EVP_PKEY_CTX *ctx;
 /* in is the input in this example. */
 unsigned char *in, *sig;
 /* inlen is the length of the input in this example. */
 size_t inlen, siglen;
 EVP_PKEY *signing_key;
 EVP_SIGNATURE *alg;
 /*
  * NB: assumes signing_key, in and inlen are set up before
  * the next step. signing_key must be an RSA private key,
  * in must point to data to be digested and signed, and
  * inlen must be the size of the data in bytes.
  */
 ctx = EVP_PKEY_CTX_new(signing_key, NULL /* no engine */);
 alg = EVP_SIGNATURE_fetch(NULL, "RSA-SHA256", NULL);
 if (ctx == NULL || alg == NULL)
     /* Error occurred */
 if (EVP_PKEY_verify_message_init(ctx, alg, NULL) <= 0)
     /* Error */
 /* We have the signature, specify it early */
 EVP_PKEY_CTX_set_signature(ctx, sig, siglen);
 /* Perform operation */
 while (inlen > 0) {
     if (EVP_PKEY_verify_message_update(ctx, in, inlen)) <= 0)
         /* Error */
     if (inlen > 256) {
         inlen -= 256;
         in += 256;
     } else {
         inlen = 0;
     }
 }
 ret = EVP_PKEY_verify_message_final(ctx);
 /*
  * ret == 1 indicates success, 0 verify failure and < 0 for some
  * other error.
  */