openssl_sign() & openssl_verify() discrepancy

From: Date: Wed, 23 May 2012 18:29:57 +0000
Subject: openssl_sign() & openssl_verify() discrepancy
Groups: php.general 
Request: Send a blank email to php-general+get-317955@lists.php.net to get a copy of this message
I have run into a problem that I am altogether unfamiliar with. A scenario. I retrieve a users private key from a database. I then use the openssl_pkey_get_private() function to load it as a resource object and proceed to call the openssl_sign() function to obtain a digital signature of a string. No problem, I get a valid signature which I then base64 encode and store in a database. Now lets say a couple of days from now I load up the public key which corresponds to the private key which was used to originally sign the data to verify it and it does not work. The kicker is if I perform the very same routine without saving the signature and attempting to verify it it works without problems. Example script: /* this part works */ $id = openssl_pkey_get_private($key, $pass); openssl_sign($unsigned, $signed, $id); $id = openssl_pkey_get_public($pub); openssl_verify($unsigned, $signed, $id); /* this doesn't (here I use the existing signature instead of generating a new one) */ $id = openssl_pkey_get_public($pub); openssl_verify($unsigned, $signature, $id); /* below here is all of the existing variables the above uses */ $unsigned = "w9A5Tt8JA/GVBn89WwpvXnnVsHvyWbEDu5GdX36m+ZQ=:ek4L55qc/VKAmiYdlIQhow==:ek4L55qc/VKAmiYdlIQhow==:6IraS+ArqK+/Yc472tfFqmhk5VdIACUQPCR7+kbLoAEldjejS/P1cSa8EMHxcV2s:50dt57IoKeQZ7eiwoILMR3E91MtbCgt+xVn483+9J1cNzBQGll02Qj40RVhNM/Rh:qEFBUlZzNYZNb7nksj8Fhd8Du52RVDjMBwoT/O0tdzKGfGVOeK2xrpuq1OdoAo2CN63U+Fra4zcfkzwkD3QxDA==:1337713224" $pass = "$2a$07$31a9f929d102f5f0374deuu.cfoTJbmZtGKk92CuAOP63XaRUAVIW"; $signature = "h+SdcyxuQ9kpb2CXZRA/grJjlYj+drlOH2f7Ifsnt5A8dSj9lkMYU11rtjT9sdaEhf3rvoIl9JUMvkzc6dJ4DMypqgGniqbesbK6yf30FmPd0an+bTyIpeQFasmUwxtB1y6wBjIENEzEDTyb6QHPTAZg6ep2m/NjZFfUn/iiDOnDt71KQD1whouwtRZ0+UcDfPvtLQ3bAGw9C5ThDoIHRlg1kzVLrq40QsjA/3zYJE+PKwG9i1srI8zbP6uW/0t6mnUpGQrZmz6sdekkdCjjc7R9bIsFdyZ2Gisr6W1pBH64/X4nGaDkYX99ss8vYfuQMp+fLyZGgEKXuAwHjT02iQ=="; $key = "-----BEGIN ENCRYPTED PRIVATE KEY----- MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIgeRB2NhoaJgCAggA MBQGCCqGSIb3DQMHBAgk9XLQVrN2UQSCBMgNQWJWdwpXarX8Do5xPGSdEw526jai XlvAR0lX4QzkKGnx1Fe13r0Z7AwGsEyuZWhmiQTeL40sBGtKpqdwr3Eutj+W02Kg 7jlBcgeu5DnYeQHZ6kDUJD4o08LXtDlusTIjsVLOE0YtLA67M7X2GSJrCUOurW/r nPTYGwNt9Z59jtB/EwPqa7kxvhPF0OTZ/6+5NRmWczPnF5KAltLaH0PsR6JI9y9K ben/SZ6QYp4PTVva5HNDBXS2sYAW9AynA7ltEOzXtWTLK2SLcGsVuqWM/WBiTyKw MeRDPA4y6MwJDUuUvZNzNAi9FXy8c10shGSJBHyP4xBrn6DTEXEIrrsGhePRaCB1 GaH26K/q6yxq1HJdRttexHMK7GCyH325ufHT4Fup+FaJqkC0nAK6uuMbCqML4feC K73OVzCF9Sh2o43aaJR3Ktec5ACqW7SDSABirJMU+YQpE9Dyei5d6mo+3E1rulVr 7dfsjeLmJGx5SDf8ip+tEGj4VcVm48w7hWFAmi1KAif8YLbvFEaWwTYhJg0qrCPI eQuFVR8k6EDhGMKs2KnrfkUUhU4riosbryXACB1fi/oHmJmYAEBiYgFhYgwsNX/O QRqedbIPDYcTfCb/j0Z59kkN9Il5YuanzPvaU6zWDMBy6qo1SYdM0lstWH7RJodq eg/WAvKq1zwBPLoedt32UgTgHioQe4r8rVTwmQd0kFAVN+mdsdCtn7xCFliul042 n7bYWtVwiLeXecSOoY0G/0oJ7MhgddAbD9CJlLMoMmM669V+xQldoE0FKQUbrr3W vqOIoBWp1Bd8mQ0FHn5yn/blYYy0sgCEkuSvR+NqgBt620qJ+x7kIpnay9+tdDun v8bXz4gonA8+MGyf3yjwVNR6elZMGH/SxK1dQn65lK1AsPFKTHy+2TC5UgBw1zhe +DjkKkilgsL3TaIKIxr/aDctqja9PfxiZek5GkDRuJN1rk3StW75hpnCyJdIQYXo q4mpdR7MYfknH7l8hsMBGYhDJNQ2iBJ/HZag4FWl2GWRQcqlJ0cZOWST+inMCTs5 UhEKYQoifKpZGLZ9vFUC1U6jiJ5SMmHp8LlEW4XlX1fbpYWU4xiLXjrCgATW9eLE Af3/q0bqBKggjNLqI4ShXjzBhExRKlVOceWxO2PJUzBKYkmENJ3oV1ykuPFp2cwO 2jhmMvCIL9ja3d8xQXc/WbCkmKOIm94PvAT7SmZksf7tvKNlhRrKS53ncGyWxhNp VwRtxQq/VnKJvyXWjImqE4bIeh3Ca1kzVoO0fmSS1la42hRXoXOlFOC59i3P9Tfs qazgCepsMB+PfRoiarnxCRrTHunnExbNw+0aCWR8J0B6X9jTyfbga6dTNNqJvHBI ffp9R9tDd+3trwC7RNbCLSv8E6qRKiNM1kv4UhP4avn0J21wnB0fjz32PASrArNe NCauY0+sSCwrE03nDhdt4NUhylAa6JTJZwQlNM6zwt7ITBOnVTQh0EoZl+fJRN9f QROdqPuvJUHaO1UbL05cm9bqpovs7+vn2UxkpMTkQ/lyS8Vfl5DbqX6dCKz3/3pP KK7LjZegt9Ey2wZB/9OiKGyOPiXPwzXcXR/evC6TFeIA07/8018PRjdjefZV26c4 M4g= -----END ENCRYPTED PRIVATE KEY-----"; $pub = "-----BEGIN PUBLIC KEY----- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyEFetjn8mpkqHTgtKATK Gu7dgG6UXHD+Ft8UO6WoWgVGhnjgk+SlNI+4RG9BvCaG4jbPueu4nb15oO4aObQg RXZ7el2gjgEYu90qRILsDSzouoGFc/qPe6tNOUZ/ZXR3kBTm9t3CAW4bNDsnfUnP YFQVdFco03Pbz8vejc0SVSC8l2lw+ZSkMYDzDmhv09Uk1zh1kc/ACOU0AoofEaUM 2eyekwcQiVwzKksGjW70eOuI2QtgpIwuvQSS/BAcymYKkxJZVxUMPCwdBwY+Pyo+ +lD4yGeki0E7x72uQy0bzulxa6iXhQOYFQEcShxyJEF6YN/R/XSIQBLTi9biWvGg 6QIDAQAB -----END PUBLIC KEY-----";

« previous php.general (#317955) next »