openssl creates invalid signature if run by a different user

Posted by divB on Super User See other posts from Super User or by divB
Published on 2013-07-01T10:09:07Z Indexed on 2013/07/01 10:23 UTC
Read the original article Hit count: 262

Very strange problem here: openssl successfully creates signatures but only those created as root are valid whereas created by another user (www-data) are invalid! All files are readable and there are not error messages:

# echo -ne Test | openssl dgst -ecdsa-with-SHA1 -sign activation.key > /tmp/asRoot.der
# su www-data
$ echo -ne Test | openssl dgst -ecdsa-with-SHA1 -sign activation.key > /tmp/asWww-data.der
$ uname -a
Linux linux 2.6.32-5-openvz-amd64 #1 SMP Mon Feb 25 01:16:25 UTC 2013 i686 GNU/Linux
$ cat /etc/debian_version
6.0.7

Both files (asRoot.der and asWww-data.der) are transfered to a different computer for verification with the public key:

$ echo -ne Test | openssl dgst -verify activation.pub -keyform DER -signature asRoot.der
Verified OK
$ echo -ne Test | openssl dgst -verify activation.pub -keyform DER -signature asWww-data.der
Verification Failure

That can't be true! What's wrong here?

© Super User or respective owner

Related posts about openssl

Related posts about digital-signature