User Signature Verification

TL;DR

This guide shows you how to check if a user’s digital signature is valid, proving they really signed something. We’ll cover generating keys, signing data, and verifying the signature.

Generating Keys

1. Create a Key Pair: You need two keys – a private key (keep this secret!) and a public key (you can share this). We’ll use OpenSSL for this example.
2. Run the command:

   openssl genrsa -out private.pem 2048

   This creates a 2048-bit RSA private key and saves it to private.pem.

3. Extract the Public Key:

   openssl rsa -in private.pem -pubout -out public.pem

   This extracts the public key from your private key and saves it to public.pem.

Signing Data

1. Prepare the data: This is the message you want the user to sign. For example, a transaction ID or document hash. Let’s say our data is “Important Document”.
2. Sign the data using the private key:

   openssl dgst -sha256 -sign private.pem -out signature.bin <(echo 'Important Document')

   This calculates a SHA256 hash of the data, then signs it with your private.pem key and saves the signature to signature.bin. The redirection using <(echo …) is a simple way to pass the string as input.

Verifying the Signature

1. Verify the signature using the public key:

   openssl dgst -sha256 -verify public.pem -signature signature.bin <(echo 'Important Document')

   This calculates a SHA256 hash of the data again, then verifies it against the signature using your public.pem key.

2. Check the output:
   • If the verification is successful, you’ll see “Verified OK”. This means the signature is valid and the data hasn’t been tampered with since it was signed.
   • If the verification fails, you’ll get an error message. This indicates either the signature is invalid or the data has changed.

Important Considerations

• Key Security: Protect your private.pem file at all costs! Anyone with access to it can forge signatures. Use strong permissions and consider hardware security modules (HSMs) for extra protection.
• Hashing Algorithm: SHA256 is a common hashing algorithm, but you might choose others depending on your security requirements.
• Error Handling: Always check the output of OpenSSL commands for errors.
• Digital Certificates: For real-world applications, consider using digital certificates to bind signatures to specific identities.