I authenticate with an ePassport by sending an 8 byte challenge and getting an ECDSA signature. Before, I read the public key from the ePassport and then use it to verify the signature.

I read the public key from oPKEY which is a DER encoded array ({0x30, 0x82, 0x01, 0x33, 0x30, 0x81, 0xec, 0x06, 0x07, 0x2a, ...)

EVP_PKEY* pPubkey;
BIO* keyBio = BIO_new_mem_buf(&oPKEY[0], (int)oPKEY.size());
pPubkey = d2i_PUBKEY_bio(keyBio, NULL);

then I use EVP_DigestVerifyInit(ctx, NULL, md, NULL, pPubkey) to read the public Key pPubkey with md being the hash algorithm used. Here's the tricky part:

How do I know whether to take EVP_sha1(), EVP_sha224() etc. as md ?

I have two ePassports where the DER encoded public Key oKEY is of the same length (311 bytes) and also the signature length is the same (64 bytes). But one of them only verifies when I use EVP_sha1() in the EVP_DigestVerifyInit() and the onther one only verifies when I use EVP_sha256().

I have a third case but with a 279 bytes long PublicKey. And that one needs EVP_sha224() to verify.

Is there any way to tell from the Public Key which hash algorithm to use?



1 Answer 1


Asking "is there any way to tell from the public key which hash algorithm to use?" is kind of like asking "is there any to tell from the house key what kind of car the owner drives?"

The naïve answer is "no". Cryptographic keys hash algorithms are unrelated, aside from a correlation based on the age of the ciphers (in the same way house keys and car models are unrelated, except you can probably guess nobody using an 1800s style key drives a Porsche).

However, for some signatures, you can sort of determine the hash used by using the key. With RSA (but apparently not DSA or ECDSA, see @dave_thompson_085's comment below), you can (in some cases) use the public key to revert a signature to the cryptographic digest from which it was created. You could then look at the resulting digest and see how long it is, and use that to guess which hash algorithm was used to generate it. (This is analogous to being able to determine the car model by using the house key to check the owner's garage.)

Generally, a signature will come with some kind of indicator (either a plain-text string or an enumeration value) indicating both the signature algorithm and the hash algorithm.

  • The digest can be recovered from some (common) RSA signatures, but not from ECDSA (or DSA). Though for ECDSA the hash size typically should be very close to the field-and-curve size, because both need to be twice the desired strength (whereas for DSA the required size of p is more complicated). Nov 25, 2017 at 3:53
  • Ahh, my bad, I didn't know that wasn't a universal property of cryptographic signatures. Editing the answer...
    – CBHacking
    Nov 25, 2017 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.