Lab: sign, verify, then tamper

The previous lesson claimed that a signature proves authorship and detects modification, and that verification needs no secret. Three minutes of openssl turns all three claims into things you have seen.

1. 1

   Make a scratch directory and generate an Ed25519 private key.

   bash Copy

   mkdir -p /tmp/siglab && cd /tmp/siglab
   openssl genpkey -algorithm ed25519 -out private.pem

2. 2

   Derive the public key. This is the half you hand out, and it cannot be used to sign.

   bash Copy

   openssl pkey -in private.pem -pubout -out public.pem
   cat public.pem

3. 3

   Write a message worth being careful about, and sign it with the private key.

   bash Copy

   printf 'transfer 10 ETH to 0xAlice' > msg.txt
   openssl pkeyutl -sign -inkey private.pem -rawin -in msg.txt -out msg.sig
   wc -c < msg.sig   # 64 bytes, regardless of message length

4. 4

   Verify using only the public key. Note what you did not need: the private key, a shared secret, or a call to anyone.

   bash Copy

   openssl pkeyutl -verify -pubin -inkey public.pem -rawin -in msg.txt -sigfile msg.sig
   # -> Signature Verified Successfully

5. 5

   Now tamper. Change the recipient and check the original signature against it.

   bash Copy

   printf 'transfer 10 ETH to 0xMallory' > tampered.txt
   openssl pkeyutl -verify -pubin -inkey public.pem -rawin -in tampered.txt -sigfile msg.sig
   # -> Signature Verification Failure

6. 6

   Confirm the message was never hidden. The signature protects it; it does not conceal it.

   bash Copy

   cat msg.txt
   # -> transfer 10 ETH to 0xAlice

7. 7

   One more check, and it is the one that matters later. Generate a second, unrelated keypair and verify the original signature against it.

   bash Copy

   openssl genpkey -algorithm ed25519 -out other.pem
   openssl pkey -in other.pem -pubout -out other.pub
   
   openssl pkeyutl -verify -pubin -inkey other.pub \
     -rawin -in msg.txt -sigfile msg.sig

8. 8

   It fails, which is correct and is not the interesting part. The interesting part is what that implies.

   text Copy

   Signature Verification Failure

9. 9

   Clean up.

   bash Copy

   cd /tmp && rm -rf siglab

A signature carries no indication of which key produced it. Verification answers "was this signed by the key I am holding", and it can only answer that because you chose which key to check against. Choose the wrong one and a perfectly genuine signature is rejected; fail to pin down which one is correct and you will eventually accept a genuine signature from the wrong signer.

The signature stayed 64 bytes whatever you signed, because signing operates on a fixed-length hash of the message rather than the message itself. That is also why the hash function's collision resistance is part of the security of the scheme and not a separate concern.