diff options
Diffstat (limited to 'secure/usr.bin/openssl/man/rsautl.1')
| -rw-r--r-- | secure/usr.bin/openssl/man/rsautl.1 | 78 |
1 files changed, 40 insertions, 38 deletions
diff --git a/secure/usr.bin/openssl/man/rsautl.1 b/secure/usr.bin/openssl/man/rsautl.1 index 0ba4a9d..a46de46 100644 --- a/secure/usr.bin/openssl/man/rsautl.1 +++ b/secure/usr.bin/openssl/man/rsautl.1 @@ -1,8 +1,7 @@ -.\" Automatically generated by Pod::Man version 1.15 -.\" Wed Feb 19 16:49:36 2003 +.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.14 .\" .\" Standard preamble: -.\" ====================================================================== +.\" ======================================================================== .de Sh \" Subsection heading .br .if t .Sp @@ -15,12 +14,6 @@ .if t .sp .5v .if n .sp .. -.de Ip \" List item -.br -.ie \\n(.$>=3 .ne \\$3 -.el .ne 3 -.IP "\\$1" \\$2 -.. .de Vb \" Begin verbatim text .ft CW .nf @@ -28,15 +21,14 @@ .. .de Ve \" End verbatim text .ft R - .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. | will give a -.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used -.\" to do unbreakable dashes and therefore won't be available. \*(C` and -.\" \*(C' expand to `' in nroff, nothing in troff, for use with C<> +.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to +.\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C' +.\" expand to `' in nroff, nothing in troff, for use with C<>. .tr \(*W-|\(bv\*(Tr .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ @@ -56,10 +48,10 @@ . ds R" '' 'br\} .\" -.\" If the F register is turned on, we'll generate index entries on stderr -.\" for titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and -.\" index entries marked with X<> in POD. Of course, you'll have to process -.\" the output yourself in some meaningful fashion. +.\" If the F register is turned on, we'll generate index entries on stderr for +.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index +.\" entries marked with X<> in POD. Of course, you'll have to process the +.\" output yourself in some meaningful fashion. .if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" @@ -68,14 +60,13 @@ . rr F .\} .\" -.\" For nroff, turn off justification. Always turn off hyphenation; it -.\" makes way too many mistakes in technical documents. +.\" For nroff, turn off justification. Always turn off hyphenation; it makes +.\" way too many mistakes in technical documents. .hy 0 .if n .na .\" .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2). .\" Fear. Run. Save yourself. No user-serviceable parts. -.bd B 3 . \" fudge factors for nroff and troff .if n \{\ . ds #H 0 @@ -135,13 +126,12 @@ . ds Ae AE .\} .rm #[ #] #H #V #F C -.\" ====================================================================== +.\" ======================================================================== .\" .IX Title "RSAUTL 1" -.TH RSAUTL 1 "0.9.7a" "2003-02-19" "OpenSSL" -.UC +.TH RSAUTL 1 "2005-02-25" "0.9.7d" "OpenSSL" .SH "NAME" -rsautl \- \s-1RSA\s0 utility +rsautl \- RSA utility .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\fBopenssl\fR \fBrsautl\fR @@ -165,46 +155,46 @@ The \fBrsautl\fR command can be used to sign, verify, encrypt and decrypt data using the \s-1RSA\s0 algorithm. .SH "COMMAND OPTIONS" .IX Header "COMMAND OPTIONS" -.Ip "\fB\-in filename\fR" 4 +.IP "\fB\-in filename\fR" 4 .IX Item "-in filename" This specifies the input filename to read data from or standard input if this option is not specified. -.Ip "\fB\-out filename\fR" 4 +.IP "\fB\-out filename\fR" 4 .IX Item "-out filename" specifies the output filename to write to or standard output by default. -.Ip "\fB\-inkey file\fR" 4 +.IP "\fB\-inkey file\fR" 4 .IX Item "-inkey file" the input key file, by default it should be an \s-1RSA\s0 private key. -.Ip "\fB\-pubin\fR" 4 +.IP "\fB\-pubin\fR" 4 .IX Item "-pubin" the input file is an \s-1RSA\s0 public key. -.Ip "\fB\-certin\fR" 4 +.IP "\fB\-certin\fR" 4 .IX Item "-certin" the input is a certificate containing an \s-1RSA\s0 public key. -.Ip "\fB\-sign\fR" 4 +.IP "\fB\-sign\fR" 4 .IX Item "-sign" sign the input data and output the signed result. This requires and \s-1RSA\s0 private key. -.Ip "\fB\-verify\fR" 4 +.IP "\fB\-verify\fR" 4 .IX Item "-verify" verify the input data and output the recovered data. -.Ip "\fB\-encrypt\fR" 4 +.IP "\fB\-encrypt\fR" 4 .IX Item "-encrypt" encrypt the input data using an \s-1RSA\s0 public key. -.Ip "\fB\-decrypt\fR" 4 +.IP "\fB\-decrypt\fR" 4 .IX Item "-decrypt" decrypt the input data using an \s-1RSA\s0 private key. -.Ip "\fB\-pkcs, \-oaep, \-ssl, \-raw\fR" 4 +.IP "\fB\-pkcs, \-oaep, \-ssl, \-raw\fR" 4 .IX Item "-pkcs, -oaep, -ssl, -raw" the padding to use: PKCS#1 v1.5 (the default), PKCS#1 \s-1OAEP\s0, special padding used in \s-1SSL\s0 v2 backwards compatible handshakes, or no padding, respectively. For signatures, only \fB\-pkcs\fR and \fB\-raw\fR can be used. -.Ip "\fB\-hexdump\fR" 4 +.IP "\fB\-hexdump\fR" 4 .IX Item "-hexdump" hex dump the output data. -.Ip "\fB\-asn1parse\fR" 4 +.IP "\fB\-asn1parse\fR" 4 .IX Item "-asn1parse" asn1parse the output data, this is useful when combined with the \&\fB\-verify\fR option. @@ -219,16 +209,19 @@ Sign some data using a private key: .Vb 1 \& openssl rsautl -sign -in file -inkey key.pem -out sig .Ve +.PP Recover the signed data .PP .Vb 1 \& openssl rsautl -verify -in sig -inkey key.pem .Ve +.PP Examine the raw signed data: .PP .Vb 1 \& openssl rsautl -verify -in file -inkey key.pem -raw -hexdump .Ve +.PP .Vb 8 \& 0000 - 00 01 ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................ \& 0010 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................ @@ -239,17 +232,19 @@ Examine the raw signed data: \& 0060 - ff ff ff ff ff ff ff ff-ff ff ff ff ff ff ff ff ................ \& 0070 - ff ff ff ff 00 68 65 6c-6c 6f 20 77 6f 72 6c 64 .....hello world .Ve +.PP The PKCS#1 block formatting is evident from this. If this was done using encrypt and decrypt the block would have been of type 2 (the second byte) and random padding data visible instead of the 0xff bytes. .PP It is possible to analyse the signature of certificates using this utility in conjunction with \fBasn1parse\fR. Consider the self signed -example in certs/pca-cert.pem . Running \fBasn1parse\fR as follows yields: +example in certs/pca\-cert.pem . Running \fBasn1parse\fR as follows yields: .PP .Vb 1 \& openssl asn1parse -in pca-cert.pem .Ve +.PP .Vb 18 \& 0:d=0 hl=4 l= 742 cons: SEQUENCE \& 4:d=1 hl=4 l= 591 cons: SEQUENCE @@ -270,21 +265,25 @@ example in certs/pca-cert.pem . Running \fBasn1parse\fR as follows yields: \& 612:d=2 hl=2 l= 0 prim: NULL \& 614:d=1 hl=3 l= 129 prim: BIT STRING .Ve +.PP The final \s-1BIT\s0 \s-1STRING\s0 contains the actual signature. It can be extracted with: .PP .Vb 1 \& openssl asn1parse -in pca-cert.pem -out sig -noout -strparse 614 .Ve +.PP The certificate public key can be extracted with: .PP .Vb 1 \& openssl x509 -in test/testx509.pem -pubout -noout >pubkey.pem .Ve +.PP The signature can be analysed with: .PP .Vb 1 \& openssl rsautl -in sig -verify -asn1parse -inkey pubkey.pem -pubin .Ve +.PP .Vb 6 \& 0:d=0 hl=2 l= 32 cons: SEQUENCE \& 2:d=1 hl=2 l= 12 cons: SEQUENCE @@ -293,6 +292,7 @@ The signature can be analysed with: \& 16:d=1 hl=2 l= 16 prim: OCTET STRING \& 0000 - f3 46 9e aa 1a 4a 73 c9-37 ea 93 00 48 25 08 b5 .F...Js.7...H%.. .Ve +.PP This is the parsed version of an \s-1ASN1\s0 DigestInfo structure. It can be seen that the digest used was md5. The actual part of the certificate that was signed can be extracted with: @@ -300,13 +300,15 @@ be extracted with: .Vb 1 \& openssl asn1parse -in pca-cert.pem -out tbs -noout -strparse 4 .Ve +.PP and its digest computed with: .PP .Vb 2 \& openssl md5 -c tbs \& MD5(tbs)= f3:46:9e:aa:1a:4a:73:c9:37:ea:93:00:48:25:08:b5 .Ve +.PP which it can be seen agrees with the recovered value above. .SH "SEE ALSO" .IX Header "SEE ALSO" -dgst(1), rsa(1), genrsa(1) +\&\fIdgst\fR\|(1), \fIrsa\fR\|(1), \fIgenrsa\fR\|(1) |
