Foundations of Network and Computer Security John Black CSCI 6268/TLEN 5550, Spring 2013

Verifying my Sig I signed the first two “chunks” of my message (encrypted session key, encrypted message) I used base64 first, removed all newlines, hashed with sha1, then signed the hash This was all discussed in the project 2 slides

Generating a Sig Suppose I have the encrypted session key in “key.enc” and the symmetrically encrypted message in “msg.enc” then to sign I might use $ cat key.enc msg.enc | tr -d '\n' | openssl sha1 | openssl rsautl -sign -inkey jrblack-priv.pem | openssl base64 -e

To Verify a Sig You want to verify, so 1) Extract the sig from the message into a file called “sig” Remember to un-base64 it 2) Extract the first two chunks, delete newlines, hash, and save the output to “expected” 3) Run openssl rsautl –verify –in sig –inkey senders_cert.pem -certin 4) Compare the output to “expected”. If they match, you’re good