310 lines
12 KiB
HTML
310 lines
12 KiB
HTML
|
<?xml version="1.0" ?>
|
||
|
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
|
||
|
|
<html xmlns="http://www.w3.org/1999/xhtml">
|
||
|
|
<head>
|
||
|
|
<title>openssl-dgst</title>
|
||
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
|
||
|
|
<link rev="made" href="mailto:root@localhost" />
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body style="background-color: white">
|
||
|
|
|
||
|
|
|
||
|
|
<!-- INDEX BEGIN -->
|
||
|
|
<div name="index">
|
||
|
|
<p><a name="__index__"></a></p>
|
||
|
|
|
||
|
|
<ul>
|
||
|
|
|
||
|
|
<li><a href="#name">NAME</a></li>
|
||
|
|
<li><a href="#synopsis">SYNOPSIS</a></li>
|
||
|
|
<li><a href="#description">DESCRIPTION</a></li>
|
||
|
|
<li><a href="#options">OPTIONS</a></li>
|
||
|
|
<li><a href="#examples">EXAMPLES</a></li>
|
||
|
|
<li><a href="#notes">NOTES</a></li>
|
||
|
|
<li><a href="#see_also">SEE ALSO</a></li>
|
||
|
|
<li><a href="#history">HISTORY</a></li>
|
||
|
|
<li><a href="#copyright">COPYRIGHT</a></li>
|
||
|
|
</ul>
|
||
|
|
|
||
|
|
<hr name="index" />
|
||
|
|
</div>
|
||
|
|
<!-- INDEX END -->
|
||
|
|
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="name">NAME</a></h1>
|
||
|
|
<p>openssl-dgst - perform digest operations</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="synopsis">SYNOPSIS</a></h1>
|
||
|
|
<p><strong>openssl</strong> <strong>dgst</strong>|<em>digest</em>
|
||
|
|
[<strong>-<em>digest</em></strong>]
|
||
|
|
[<strong>-help</strong>]
|
||
|
|
[<strong>-c</strong>]
|
||
|
|
[<strong>-d</strong>]
|
||
|
|
[<strong>-debug</strong>]
|
||
|
|
[<strong>-list</strong>]
|
||
|
|
[<strong>-hex</strong>]
|
||
|
|
[<strong>-binary</strong>]
|
||
|
|
[<strong>-r</strong>]
|
||
|
|
[<strong>-out</strong> <em>filename</em>]
|
||
|
|
[<strong>-sign</strong> <em>filename</em>]
|
||
|
|
[<strong>-keyform</strong> <strong>DER</strong>|<strong>PEM</strong>|<strong>P12</strong>|<strong>ENGINE</strong>]
|
||
|
|
[<strong>-passin</strong> <em>arg</em>]
|
||
|
|
[<strong>-verify</strong> <em>filename</em>]
|
||
|
|
[<strong>-prverify</strong> <em>filename</em>]
|
||
|
|
[<strong>-signature</strong> <em>filename</em>]
|
||
|
|
[<strong>-sigopt</strong> <em>nm</em>:<em>v</em>]
|
||
|
|
[<strong>-hmac</strong> <em>key</em>]
|
||
|
|
[<strong>-mac</strong> <em>alg</em>]
|
||
|
|
[<strong>-macopt</strong> <em>nm</em>:<em>v</em>]
|
||
|
|
[<strong>-fips-fingerprint</strong>]
|
||
|
|
[<strong>-engine</strong> <em>id</em>]
|
||
|
|
[<strong>-engine_impl</strong> <em>id</em>]
|
||
|
|
[<strong>-rand</strong> <em>files</em>]
|
||
|
|
[<strong>-writerand</strong> <em>file</em>]
|
||
|
|
[<em>file</em> ...]</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="description">DESCRIPTION</a></h1>
|
||
|
|
<p>This command output the message digest of a supplied file or files
|
||
|
|
in hexadecimal, and also generates and verifies digital
|
||
|
|
signatures using message digests.</p>
|
||
|
|
<p>The generic name, <strong>openssl dgst</strong>, may be used with an option specifying the
|
||
|
|
algorithm to be used.
|
||
|
|
The default digest is <strong>sha256</strong>.
|
||
|
|
A supported <em>digest</em> name may also be used as the sub-command name.
|
||
|
|
To see the list of supported algorithms, use <code>openssl list -digest-commands</code></p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="options">OPTIONS</a></h1>
|
||
|
|
<dl>
|
||
|
|
<dt><strong><a name="help" class="item"><strong>-help</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Print out a usage message.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="digest" class="item"><strong>-<em>digest</em></strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Specifies name of a supported digest to be used. To see the list of
|
||
|
|
supported digests, use the command <code>list --digest-commands</code>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="c" class="item"><strong>-c</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Print out the digest in two digit groups separated by colons, only relevant if
|
||
|
|
the <strong>-hex</strong> option is given as well.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="d_debug" class="item"><strong>-d</strong>, <strong>-debug</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Print out BIO debugging information.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="list" class="item"><strong>-list</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Prints out a list of supported message digests.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="hex" class="item"><strong>-hex</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Digest is to be output as a hex dump. This is the default case for a "normal"
|
||
|
|
digest as opposed to a digital signature. See NOTES below for digital
|
||
|
|
signatures using <strong>-hex</strong>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="binary" class="item"><strong>-binary</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Output the digest or signature in binary form.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="r" class="item"><strong>-r</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Output the digest in the "coreutils" format, including newlines.
|
||
|
|
Used by programs like <em>sha1sum(1)</em>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="out_filename" class="item"><strong>-out</strong> <em>filename</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Filename to output to, or standard output by default.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="sign_filename" class="item"><strong>-sign</strong> <em>filename</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Digitally sign the digest using the private key in "filename". Note this option
|
||
|
|
does not support Ed25519 or Ed448 private keys. Use the <em>openssl-pkeyutl(1)</em>
|
||
|
|
command instead for this.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="keyform_der_pem_p12_engine" class="item"><strong>-keyform</strong> <strong>DER</strong>|<strong>PEM</strong>|<strong>P12</strong>|<strong>ENGINE</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The format of the key to sign with; the default is <strong>PEM</strong>.
|
||
|
|
See <em>openssl(1)/Format Options</em> for details.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="sigopt_nm_v" class="item"><strong>-sigopt</strong> <em>nm</em>:<em>v</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Pass options to the signature algorithm during sign or verify operations.
|
||
|
|
Names and values of these options are algorithm-specific.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="passin_arg" class="item"><strong>-passin</strong> <em>arg</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The private key password source. For more information about the format of <em>arg</em>
|
||
|
|
see <em>openssl(1)/Pass Phrase Options</em>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="verify_filename" class="item"><strong>-verify</strong> <em>filename</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Verify the signature using the public key in "filename".
|
||
|
|
The output is either "Verification OK" or "Verification Failure".</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="prverify_filename" class="item"><strong>-prverify</strong> <em>filename</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Verify the signature using the private key in "filename".</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="signature_filename" class="item"><strong>-signature</strong> <em>filename</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>The actual signature to verify.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="hmac_key" class="item"><strong>-hmac</strong> <em>key</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Create a hashed MAC using "key".</p>
|
||
|
|
<p>The <em>openssl-mac(1)</em> command should be preferred to using this command line
|
||
|
|
option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="mac_alg" class="item"><strong>-mac</strong> <em>alg</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Create MAC (keyed Message Authentication Code). The most popular MAC
|
||
|
|
algorithm is HMAC (hash-based MAC), but there are other MAC algorithms
|
||
|
|
which are not based on hash, for instance <strong>gost-mac</strong> algorithm,
|
||
|
|
supported by the <strong>gost</strong> engine. MAC keys and other options should be set
|
||
|
|
via <strong>-macopt</strong> parameter.</p>
|
||
|
|
<p>The <em>openssl-mac(1)</em> command should be preferred to using this command line
|
||
|
|
option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="macopt_nm_v" class="item"><strong>-macopt</strong> <em>nm</em>:<em>v</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Passes options to MAC algorithm, specified by <strong>-mac</strong> key.
|
||
|
|
Following options are supported by both by <strong>HMAC</strong> and <strong>gost-mac</strong>:</p>
|
||
|
|
<dl>
|
||
|
|
<dt><strong><a name="key_string" class="item"><strong>key</strong>:<em>string</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Specifies MAC key as alphanumeric string (use if key contain printable
|
||
|
|
characters only). String length must conform to any restrictions of
|
||
|
|
the MAC algorithm for example exactly 32 chars for gost-mac.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="hexkey_string" class="item"><strong>hexkey</strong>:<em>string</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Specifies MAC key in hexadecimal form (two hex digits per byte).
|
||
|
|
Key length must conform to any restrictions of the MAC algorithm
|
||
|
|
for example exactly 32 chars for gost-mac.</p>
|
||
|
|
</dd>
|
||
|
|
</dl>
|
||
|
|
<p>The <em>openssl-mac(1)</em> command should be preferred to using this command line
|
||
|
|
option.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="fips_fingerprint" class="item"><strong>-fips-fingerprint</strong></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>Compute HMAC using a specific key for certain OpenSSL-FIPS operations.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="rand_files_writerand_file" class="item"><strong>-rand</strong> <em>files</em>, <strong>-writerand</strong> <em>file</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>See <em>openssl(1)/Random State Options</em> for details.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="engine_id" class="item"><strong>-engine</strong> <em>id</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>See <em>openssl(1)/Engine Options</em>.
|
||
|
|
The engine is not used for digests unless the <strong>-engine_impl</strong> option is
|
||
|
|
used or it is configured to do so, see <em>config(5)/Engine Configuration Module</em>.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="engine_impl_id" class="item"><strong>-engine_impl</strong> <em>id</em></a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>When used with the <strong>-engine</strong> option, it specifies to also use
|
||
|
|
engine <em>id</em> for digest operations.</p>
|
||
|
|
</dd>
|
||
|
|
<dt><strong><a name="file" class="item"><em>file</em> ...</a></strong></dt>
|
||
|
|
|
||
|
|
<dd>
|
||
|
|
<p>File or files to digest. If no files are specified then standard input is
|
||
|
|
used.</p>
|
||
|
|
</dd>
|
||
|
|
</dl>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="examples">EXAMPLES</a></h1>
|
||
|
|
<p>To create a hex-encoded message digest of a file:
|
||
|
|
openssl dgst -md5 -hex file.txt</p>
|
||
|
|
<p>To sign a file using SHA-256 with binary file output:
|
||
|
|
openssl dgst -sha256 -sign privatekey.pem -out signature.sign file.txt</p>
|
||
|
|
<p>To verify a signature:
|
||
|
|
openssl dgst -sha256 -verify publickey.pem \
|
||
|
|
-signature signature.sign \
|
||
|
|
file.txt</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="notes">NOTES</a></h1>
|
||
|
|
<p>The digest mechanisms that are available will depend on the options
|
||
|
|
used when building OpenSSL.
|
||
|
|
The <code>openssl list -digest-commands</code> command can be used to list them.</p>
|
||
|
|
<p>New or agile applications should use probably use SHA-256. Other digests,
|
||
|
|
particularly SHA-1 and MD5, are still widely used for interoperating
|
||
|
|
with existing formats and protocols.</p>
|
||
|
|
<p>When signing a file, this command will automatically determine the algorithm
|
||
|
|
(RSA, ECC, etc) to use for signing based on the private key's ASN.1 info.
|
||
|
|
When verifying signatures, it only handles the RSA, DSA, or ECDSA signature
|
||
|
|
itself, not the related data to identify the signer and algorithm used in
|
||
|
|
formats such as x.509, CMS, and S/MIME.</p>
|
||
|
|
<p>A source of random numbers is required for certain signing algorithms, in
|
||
|
|
particular ECDSA and DSA.</p>
|
||
|
|
<p>The signing and verify options should only be used if a single file is
|
||
|
|
being signed or verified.</p>
|
||
|
|
<p>Hex signatures cannot be verified using <strong>openssl</strong>. Instead, use "xxd -r"
|
||
|
|
or similar program to transform the hex signature into a binary signature
|
||
|
|
prior to verification.</p>
|
||
|
|
<p>The <em>openssl-mac(1)</em> command is preferred over the <strong>-hmac</strong>, <strong>-mac</strong> and
|
||
|
|
<strong>-macopt</strong> command line options.</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="see_also">SEE ALSO</a></h1>
|
||
|
|
<p><em>openssl-mac(1)</em></p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="history">HISTORY</a></h1>
|
||
|
|
<p>The default digest was changed from MD5 to SHA256 in OpenSSL 1.1.0.
|
||
|
|
The FIPS-related options were removed in OpenSSL 1.1.0.</p>
|
||
|
|
<p>
|
||
|
|
</p>
|
||
|
|
<hr />
|
||
|
|
<h1><a name="copyright">COPYRIGHT</a></h1>
|
||
|
|
<p>Copyright 2000-2019 The OpenSSL Project Authors. All Rights Reserved.</p>
|
||
|
|
<p>Licensed under the Apache License 2.0 (the "License"). You may not use
|
||
|
|
this file except in compliance with the License. You can obtain a copy
|
||
|
|
in the file LICENSE in the source distribution or at
|
||
|
|
<a href="https://www.openssl.org/source/license.html">https://www.openssl.org/source/license.html</a>.</p>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
|
||
|
|
</html>
|