Verify signature issue between jsrsasign ECDSA sample web and openssl tool

I followed the steps in “https://kjur.github.io/jsrsasign/sample/sample-ecdsa.html”:

openssl ecparam -genkey -name secp256r1 -out k.pem

And I get:

"using curve name prime256v1 instead of secp256r1"

Then

    $ openssl ec -in k.pem -noout -text
read EC key
Private-Key: (256 bit)
priv:
    f5:01:5a:53:76:9d:b2:85:05:fc:0f:1f:70:ea:f1:
    a3:ec:59:ef:69:23:74:cf:bf:4d:7f:31:c3:8d:1b:
    96:bb
pub:
    04:e5:8c:01:e7:1a:a7:67:cd:5a:ec:d1:5b:8e:40:
    1b:98:d2:e1:db:92:dc:a0:22:07:4b:ea:17:71:c6:
    b6:f0:3f:81:2d:7e:b4:b4:d1:51:50:82:d6:36:f2:
    81:ec:65:e9:77:e1:12:59:43:25:94:1b:dc:94:48:
    31:a1:bb:86:17
ASN1 OID: prime256v1
NIST CURVE: P-256

Then I filled “f5015a53769db28505fc0f1f70eaf1a3ec59ef692374cfbf4d7f31c38d1b96bb” to web EC private key (hex), and “04e58c01e71aa767cd5aecd15b8e401b98d2e1db92dca022074bea1771c6b6f03f812d7eb4b4d1515082d636f281ec65e977e112594325941bdc944831a1bb8617” to EC public key(hex).

Keep the message in ‘aaa’, curve name is secp256r1 and signature Algorithm in SHA256with ECDSA.

Then click sign message, now I get a signature value(hex):
“3045022035721330a91c3c6d861c7a23815ea22a4eba12c8dc892800b6493364e24ec266022100de0fc18d0eed05e204786732de1c44b2e78cd53ecbf6e110c501d94ebd36f162”

Then I change it to sign bin file by this:

printf "3045022035721330a91c3c6d861c7a23815ea22a4eba12c8dc892800b6493364e24ec266022100de0fc18d0eed05e204786732de1c44b2e78cd53ecbf6e110c501d94ebd36f162" | xxd -r -p > web_sign.bin 

echo "aaa" > message.txt
openssl ec -in k.pem -pubout -out pk.pem

Finally, I use the files o verify the signature:

openssl dgst -sha256 -verify pk.pem -signature web_sign.bin message.txt

But I get this:

Verification failure

It cost me a long time to debug, but I really don’t know what’s wrong in my process.

Thanks for your help in advance.

  • echo ADDS A NEWLINE unless you have a version that supports -n (not all do) and you use it (which you didn’t). This has been asked and answered at least a hundred times. DON”T ADD A NEWLINE if you want your signature to verify.

    – 

  • @dave_thompson_085 Thank you so much dave. I can’t believe I ignored this newline break issue. After removed the NEWLINE, it did work for me!

    – 

Leave a Comment