PHP's openssl_sign generates different signature than SSCrypto's sign
- by pascalj
I'm writing an OS X client for a software that is written in PHP. This software uses a simple RPC interface to receive and execute commands. The RPC client has to sign the commands he sends to ensure that no MITM can modify any of them.
However, as the server was not accepting the signatures I sent from my OS X client, I started investigating and found out that PHP's openssl_sign function generates a different signature for a given private key/data combination than the Objective-C SSCrypto framework (which is only a wrapper for the openssl lib):
SSCrypto *crypto = [[SSCrypto alloc] initWithPrivateKey:self.localPrivKey];
NSData *shaed = [self sha1:@"hello"];
[crypto setClearTextWithData:shaed];
NSData *data = [crypto sign];
generates a signature like CtbkSxvqNZ+mAN...
The PHP code
openssl_sign("hello", $signature, $privateKey);
generates a signature like 6u0d2qjFiMbZ+...
(For my certain key, of course. base64 encoded)
I'm not quite shure why this is happening and I unsuccessfully experimented with different hash-algorithms. As the PHP documentation states SHA1 is used by default.
So why do these two functions generate different signatures and how can I get my Objective-C part to generate a signature that PHPs openssl_verify will accept?
Note: I double checked that the keys and the data is correct!
