I would like to sign and verify a pdf with elliptic curve. I got some code but it dosen't work.

Create private key:

openssl ecparam -genkey -name secp384r1 -noout -out private.pem

Create public key:

openssl ec -in private.pem -pubout -out public.pem

Sign file:

openssl dgst -ecdsa-with-SHA1 test.pdf > hash openssl dgst
openssl dgst -ecdsa-with-SHA1 -inkey private.pem -keyform PEM -in hash > signature

Verify file:

openssl dgst -ecdsa-with-SHA1 -verify public.pem -signature signature.bin data

The part to sign and verify dosen't work.

  • 1
    Just a caution for incoming readers: native PDF signatures according to ISO 32000 do not simply calculate the hash over the entire raw file. So in the current question, the file test.pdf could be interpreted as if it had any other extension, e.g. .txt. This means that the signature will be calculated over the entire raw file and it won't produce a native PDF signature, i.e. the type of signature that can be interpreted by Adobe Acrobat. – Jaime Hablutzel Jan 27 '19 at 22:39

I think you are not actually signing the file, but signing the hash.

I tried the following and it gave me the desired output:

Create signature:
openssl dgst -ecdsa-with-SHA1 -sign private.pem test.pdf > signature.bin

Verify signature:
openssl dgst -ecdsa-with-SHA1 -verify public.pem -signature signature.bin test.pdf
  • How do you do it in an OpenSSL session, for the case you use an engine? – lalebarde Dec 4 '14 at 15:14

Since -ecda-with-SHA1 is not in the man for dgst and there is no -ecda-with-SHA256 I would recommend :

Sign :

openssl dgst -sha1 -sign private.pem test.pdf > signature.bin

Verify :

openssl dgst -sha1 -verify public.pem -signature signature.bin test.pdf
  • source : stackoverflow.com/questions/22856059/… – Olivier Lasne Feb 7 '16 at 23:49
  • Wouldn't work. $ openssl dgst -sha1 -sign private.pem test.pdf > signature.bin Error Signing Data 8123:error:0606B06E:digital envelope routines:EVP_SignFinal:wrong public key type:/BuildRoot/Library/Caches/com.apple.xbs/Sources/OpenSSL098/OpenSSL098-64.50.6/src/crypto/evp/p_sign.c:99: – Tankman六四 Nov 25 '17 at 22:04

Or if you need an engine, you can also do it in an OpenSSL session:

OpenSSL> engine -vvvv -t dynamic -pre SO_PATH:someengine.so -pre ID:someengine -pre LIST_ADD:1 -pre LOAD
OpenSSL> dgst -ecdsa-with-SHA1 -out signature.bin -sign private.pem test.pdf
OpenSSL> dgst -ecdsa-with-SHA1 -verify public.pem -signature signature.bin test.pdf

dgst offers also the -engine option, but here it takes the engine loaded earlier. If required, simply add -engine someengine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.