1 .\" Automatically generated by Pod::Man 4.07 (Pod::Simple 3.35)
4 .\" ========================================================================
5 .de Sp \" Vertical space (when we can't use .PP)
9 .de Vb \" Begin verbatim text
14 .de Ve \" End verbatim text
18 .\" Set up some character translations and predefined strings. \*(-- will
19 .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
20 .\" double quote, and \*(R" will give a right double quote. \*(C+ will
21 .\" give a nicer C++. Capital omega is used to do unbreakable dashes and
22 .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff,
23 .\" nothing in troff, for use with C<>.
25 .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
29 . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
30 . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
45 .\" Escape single quotes in literal strings from groff's Unicode transform.
49 .\" If the F register is >0, we'll generate index entries on stderr for
50 .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
51 .\" entries marked with X<> in POD. Of course, you'll have to process the
52 .\" output yourself in some meaningful fashion.
54 .\" Avoid warning from groff about undefined register 'F'.
60 . tm Index:\\$1\t\\n%\t"\\$2"
68 .\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
69 .\" Fear. Run. Save yourself. No user-serviceable parts.
70 . \" fudge factors for nroff and troff
79 . ds #H ((1u-(\\\\n(.fu%2u))*.13m)
85 . \" simple accents for nroff and troff
95 . ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
96 . ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
97 . ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
98 . ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
99 . ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
100 . ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
102 . \" troff and (daisy-wheel) nroff accents
103 .ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
104 .ds 8 \h'\*(#H'\(*b\h'-\*(#H'
105 .ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
106 .ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
107 .ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
108 .ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
109 .ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
110 .ds ae a\h'-(\w'a'u*4/10)'e
111 .ds Ae A\h'-(\w'A'u*4/10)'E
112 . \" corrections for vroff
113 .if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
114 .if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
115 . \" for low resolution devices (crt and lpr)
116 .if \n(.H>23 .if \n(.V>19 \
129 .\" ========================================================================
132 .TH RSAUTL 1 "2017-05-25" "1.0.2l" "OpenSSL"
133 .\" For nroff, turn off justification. Always turn off hyphenation; it makes
134 .\" way too many mistakes in technical documents.
138 rsautl \- RSA utility
140 .IX Header "SYNOPSIS"
141 \&\fBopenssl\fR \fBrsautl\fR
157 .IX Header "DESCRIPTION"
158 The \fBrsautl\fR command can be used to sign, verify, encrypt and decrypt
159 data using the \s-1RSA\s0 algorithm.
160 .SH "COMMAND OPTIONS"
161 .IX Header "COMMAND OPTIONS"
162 .IP "\fB\-in filename\fR" 4
163 .IX Item "-in filename"
164 This specifies the input filename to read data from or standard input
165 if this option is not specified.
166 .IP "\fB\-out filename\fR" 4
167 .IX Item "-out filename"
168 specifies the output filename to write to or standard output by
170 .IP "\fB\-inkey file\fR" 4
171 .IX Item "-inkey file"
172 the input key file, by default it should be an \s-1RSA\s0 private key.
173 .IP "\fB\-pubin\fR" 4
175 the input file is an \s-1RSA\s0 public key.
176 .IP "\fB\-certin\fR" 4
178 the input is a certificate containing an \s-1RSA\s0 public key.
181 sign the input data and output the signed result. This requires
182 and \s-1RSA\s0 private key.
183 .IP "\fB\-verify\fR" 4
185 verify the input data and output the recovered data.
186 .IP "\fB\-encrypt\fR" 4
188 encrypt the input data using an \s-1RSA\s0 public key.
189 .IP "\fB\-decrypt\fR" 4
191 decrypt the input data using an \s-1RSA\s0 private key.
192 .IP "\fB\-pkcs, \-oaep, \-ssl, \-raw\fR" 4
193 .IX Item "-pkcs, -oaep, -ssl, -raw"
194 the padding to use: PKCS#1 v1.5 (the default), PKCS#1 \s-1OAEP,\s0
195 special padding used in \s-1SSL\s0 v2 backwards compatible handshakes,
196 or no padding, respectively.
197 For signatures, only \fB\-pkcs\fR and \fB\-raw\fR can be used.
198 .IP "\fB\-hexdump\fR" 4
200 hex dump the output data.
201 .IP "\fB\-asn1parse\fR" 4
202 .IX Item "-asn1parse"
203 asn1parse the output data, this is useful when combined with the
204 \&\fB\-verify\fR option.
207 \&\fBrsautl\fR because it uses the \s-1RSA\s0 algorithm directly can only be
208 used to sign or verify small pieces of data.
210 .IX Header "EXAMPLES"
211 Sign some data using a private key:
214 \& openssl rsautl \-sign \-in file \-inkey key.pem \-out sig
217 Recover the signed data
220 \& openssl rsautl \-verify \-in sig \-inkey key.pem
223 Examine the raw signed data:
226 \& openssl rsautl \-verify \-in file \-inkey key.pem \-raw \-hexdump
228 \& 0000 \- 00 01 ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
229 \& 0010 \- ff ff ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
230 \& 0020 \- ff ff ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
231 \& 0030 \- ff ff ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
232 \& 0040 \- ff ff ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
233 \& 0050 \- ff ff ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
234 \& 0060 \- ff ff ff ff ff ff ff ff\-ff ff ff ff ff ff ff ff ................
235 \& 0070 \- ff ff ff ff 00 68 65 6c\-6c 6f 20 77 6f 72 6c 64 .....hello world
238 The PKCS#1 block formatting is evident from this. If this was done using
239 encrypt and decrypt the block would have been of type 2 (the second byte)
240 and random padding data visible instead of the 0xff bytes.
242 It is possible to analyse the signature of certificates using this
243 utility in conjunction with \fBasn1parse\fR. Consider the self signed
244 example in certs/pca\-cert.pem . Running \fBasn1parse\fR as follows yields:
247 \& openssl asn1parse \-in pca\-cert.pem
249 \& 0:d=0 hl=4 l= 742 cons: SEQUENCE
250 \& 4:d=1 hl=4 l= 591 cons: SEQUENCE
251 \& 8:d=2 hl=2 l= 3 cons: cont [ 0 ]
252 \& 10:d=3 hl=2 l= 1 prim: INTEGER :02
253 \& 13:d=2 hl=2 l= 1 prim: INTEGER :00
254 \& 16:d=2 hl=2 l= 13 cons: SEQUENCE
255 \& 18:d=3 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption
256 \& 29:d=3 hl=2 l= 0 prim: NULL
257 \& 31:d=2 hl=2 l= 92 cons: SEQUENCE
258 \& 33:d=3 hl=2 l= 11 cons: SET
259 \& 35:d=4 hl=2 l= 9 cons: SEQUENCE
260 \& 37:d=5 hl=2 l= 3 prim: OBJECT :countryName
261 \& 42:d=5 hl=2 l= 2 prim: PRINTABLESTRING :AU
263 \& 599:d=1 hl=2 l= 13 cons: SEQUENCE
264 \& 601:d=2 hl=2 l= 9 prim: OBJECT :md5WithRSAEncryption
265 \& 612:d=2 hl=2 l= 0 prim: NULL
266 \& 614:d=1 hl=3 l= 129 prim: BIT STRING
269 The final \s-1BIT STRING\s0 contains the actual signature. It can be extracted with:
272 \& openssl asn1parse \-in pca\-cert.pem \-out sig \-noout \-strparse 614
275 The certificate public key can be extracted with:
278 \& openssl x509 \-in test/testx509.pem \-pubkey \-noout >pubkey.pem
281 The signature can be analysed with:
284 \& openssl rsautl \-in sig \-verify \-asn1parse \-inkey pubkey.pem \-pubin
286 \& 0:d=0 hl=2 l= 32 cons: SEQUENCE
287 \& 2:d=1 hl=2 l= 12 cons: SEQUENCE
288 \& 4:d=2 hl=2 l= 8 prim: OBJECT :md5
289 \& 14:d=2 hl=2 l= 0 prim: NULL
290 \& 16:d=1 hl=2 l= 16 prim: OCTET STRING
291 \& 0000 \- f3 46 9e aa 1a 4a 73 c9\-37 ea 93 00 48 25 08 b5 .F...Js.7...H%..
294 This is the parsed version of an \s-1ASN1\s0 DigestInfo structure. It can be seen that
295 the digest used was md5. The actual part of the certificate that was signed can
299 \& openssl asn1parse \-in pca\-cert.pem \-out tbs \-noout \-strparse 4
302 and its digest computed with:
305 \& openssl md5 \-c tbs
306 \& MD5(tbs)= f3:46:9e:aa:1a:4a:73:c9:37:ea:93:00:48:25:08:b5
309 which it can be seen agrees with the recovered value above.
311 .IX Header "SEE ALSO"
312 \&\fIdgst\fR\|(1), \fIrsa\fR\|(1), \fIgenrsa\fR\|(1)