3

I have been experimenting with OpenSSL and OpenSSH and I have been unable to sign and verify using RSA key pairs.

I did the following

Generated key pairs:

$ ssh-genkey -b 2048 -t rsa <key-name>

I then created a message digest by:

$ openssl sha1 -sign <key-name> -out rsasign.bin ~/tmp/test.txt

I attempted to verify the signature using the corresponding public key:

$ openssl sha1 -verify <key-name>.pub -signature rsasign.bin ~/tmp/test.txt

Unfortunately, trying this returns the error:

unable to load key file

Can anyone see any problem with what I'm doing?

Thanks!

1 Answer 1

4

Firstly, I'm assuming you mean ssh-keygen, not ssh-genkey (also, my version requires the path be specified interactively, not via the command line, but the output's the same). :)

The problem is that OpenSSL uses a different format for public keys than SSH. You can still use SSH-generated keys, but you need to get the public key in a format that OpenSSL can understand. You can do this with the following command:

openssl rsa -in <key-name> -pubout -out public-key.pem

Where public-key.pem is the new file you'll create. Once I did this, the verification command you mentioned ran successfully, outputting only Verified OK for my test file.

Note that the above command requires the private key, not the public key; you can convert an SSH-style public key to an OpenSSL-style public key by running:

ssh-keygen -f <key-name>.pub -e -m public-key.pem

Where public-key.pem is once again the new file you'll create.

1
  • Thanks for the response. I'll try it out when I get a chance, but I'm pretty sure you got it.
    – Daeden
    Oct 14, 2013 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .