1

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography.

If I understand correctly then the public key and the private key in an asymmetric cryptographic key pair are inverse functions. Ergo, if the private key is the function F, then the public key is G=F^(-1), and F(G(x))=x.

If I understand correctly then a digitally signed email consists of: a) a plaintext message, let's call it M; b) some cyphertext, let's call it C.

Lets suppose that H is a publicly known hash function, such as sha1.

When sending a digitally signed email I would first hash the original plaintext message: H(M)=M'. Then I would scramble-up the hash value using my private key: F(M')=C.

Now when I send the email I include both M and C. If the integrity of the digitally signed email has not been compromised, then the recipient will find that G(C) = H(M).

My question is not regarding the underlying theory, because I think I understand it well enough. (If what I described above is incorrect then please tell me.) Infact, my question is in regards to implementation and manual verification of the workflow. What programs\commands are available to implement each step that was described above? I have satisfactorilly used the following command at the linux command line to invoke the sha1 hash function:

echo -n "hello world" | sha1sum | awk '{print $1}'

I need a command to transform some text using the function that is my private key. And I need a command to transforms some text using the function that is my public key. I prefer something that enables me manually verify each step of the process.

EDIT I know that a pre-built tool like gpg is a more practical way to do digital signatures in an actual use-case. My goal is to have an alternative workflow that generates the same results as gpg. It is important to be able to cross-validate the process. Furthermore, I would like to be able to teach some hypothetical underling about digital signatures, and to do this I want to be able to break-down the process into a series of well understood steps. And because the main purpose is to do cross-validation, and not to actually authenticate\non-repudiate some important communication, therefore the inherrent weaknesses of this approach does not concern me.

  • 3
    Why would you want to do this all on the command line, and not use a pre-built tool like gpg that's specifically geared towards crypto and digital signatures and has a defined protocol? – Steve Sether Oct 28 '15 at 18:47
  • This answer is probably what you want (assuming you have openssl on your system). – puzzlepalace Oct 28 '15 at 18:47
  • 1
    Why not using a already available crypto library like OpenSSL or GPG instead of reinventing the wheel ? – Kami Oct 28 '15 at 18:53
  • The public and private keys are not functions. They are input to - in this case - signature verification and signature generation functions. As you can e.g. sign multiple files the functions (not the keys) are sometimes referred to as "keyed functions" after you have provided the key to them. Some crap API's don't distinguish between data and algorithm, but that's a problem of the API's and doesn't change this comment. – Maarten Bodewes Oct 29 '15 at 23:51
-1

You can use openssl from the command line to do public key encryption (and decryption). See https://www.openssl.org/docs/manmaster/apps/rsautl.html for more info, and see https://stackoverflow.com/questions/5140425/openssl-command-line-to-verify-the-signature for an example.

  • True, but the question is not exactly about that. You need to provide more info on how you would use that to sign/verify signatures. – Maarten Bodewes Oct 29 '15 at 23:48
  • Maarten, Good suggestion. I edited my answer to provide a link to an example that contains the actual openssl commands used for creating and verifying digital signatures. – mti2935 Oct 30 '15 at 19:08
2

You're probably not going to be happy about this answer, but - as pointed out in the comments to your question - it's a bad idea of reinventing the wheel when there are already libraries and commands available for that purpose e.g. OpenSSL, GnuPG, etc.

The risks in rolling out your own crypto implementation are multiple:

  • Leaking plaintext
  • Code prone to any kind of attack e.g. buffer overflows
  • Bad performances caused by non-optimized code
  • Diminished security (as calculations rely on multiple Linux commands written by third parties)

If you really want to do this you should code in a low-level language like C and not use Linux commands, but still, it's a bad idea because of the points above. Writing code that works is difficult; writing crypto code that's strong and bug-free is extremely hard, and should be left to experts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.