i am using openssl 0.9.8g. inside RSA_verify() function decrypoted data is given to the d21_X509_SIG function. what does this function do and why we are doing this step while 开发者_高级运维signing and verifying the signature
The signature is actually not just for the hash (e.g. SHA-256), but for a data structure containing the hash plus some metadata (which hashing algorithm, some parameters and the hash length).
That's why after decrypting, the data is decoded into a X509_SIG object and the actual comparison against the reference only performed on sig->digest->data
.
精彩评论