Class: OpenSSL::PKey::PKey (Ruby 2.7.2)
Description: Class : OpenSSL::PKey::PKey - Ruby 2.7.2

### Home Classes Methods

### In Files

- openssl/ossl_pkey.c

### Parent

Object

### Methods

- ::new
- #sign
- #verify

### Class/Module Index

Quicksearch

- IO
- IO::WaitReadable
- IO::WaitWritable
- Integer
- OpenSSL
- OpenSSL::ASN1
- OpenSSL::ASN1::ASN1Data
- OpenSSL::ASN1::ASN1Error
- OpenSSL::ASN1::Constructive
- OpenSSL::ASN1::ObjectId
- OpenSSL::ASN1::Primitive
- OpenSSL::BN
- OpenSSL::BNError
- OpenSSL::Buffering
- OpenSSL::Cipher
- OpenSSL::Cipher::Cipher
- OpenSSL::Cipher::CipherError
- OpenSSL::Config
- OpenSSL::ConfigError
- OpenSSL::Digest
- OpenSSL::Digest::DigestError
- OpenSSL::Engine
- OpenSSL::Engine::EngineError
- OpenSSL::ExtConfig
- OpenSSL::HMAC
- OpenSSL::HMACError
- OpenSSL::KDF
- OpenSSL::KDF::KDFError
- OpenSSL::Netscape
- OpenSSL::Netscape::SPKI
- OpenSSL::Netscape::SPKIError
- OpenSSL::OCSP
- OpenSSL::OCSP::BasicResponse
- OpenSSL::OCSP::CertificateId
- OpenSSL::OCSP::OCSPError
- OpenSSL::OCSP::Request
- OpenSSL::OCSP::Response
- OpenSSL::OCSP::SingleResponse
- OpenSSL::OpenSSLError
- OpenSSL::PKCS12
- OpenSSL::PKCS12::PKCS12Error
- OpenSSL::PKCS5
- OpenSSL::PKCS7
- OpenSSL::PKCS7::PKCS7Error
- OpenSSL::PKCS7::RecipientInfo
- OpenSSL::PKCS7::SignerInfo
- OpenSSL::PKey
- OpenSSL::PKey::DH
- OpenSSL::PKey::DHError
- OpenSSL::PKey::DSA
- OpenSSL::PKey::DSAError
- OpenSSL::PKey::EC
- OpenSSL::PKey::EC::Group
- OpenSSL::PKey::EC::Group::Error
- OpenSSL::PKey::EC::Point
- OpenSSL::PKey::EC::Point::Error
- OpenSSL::PKey::ECError
- OpenSSL::PKey::PKey
- OpenSSL::PKey::PKeyError
- OpenSSL::PKey::RSA
- OpenSSL::PKey::RSAError
- OpenSSL::Random
- OpenSSL::Random::RandomError
- OpenSSL::SSL
- OpenSSL::SSL::SSLContext
- OpenSSL::SSL::SSLError
- OpenSSL::SSL::SSLErrorWaitReadable
- OpenSSL::SSL::SSLErrorWaitWritable
- OpenSSL::SSL::SSLServer
- OpenSSL::SSL::SSLSocket
- OpenSSL::SSL::Session
- OpenSSL::SSL::Session::SessionError
- OpenSSL::SSL::SocketForwarder
- OpenSSL::X509
- OpenSSL::X509::Attribute
- OpenSSL::X509::AttributeError
- OpenSSL::X509::CRL
- OpenSSL::X509::CRLError
- OpenSSL::X509::Certificate
- OpenSSL::X509::CertificateError
- OpenSSL::X509::Extension
- OpenSSL::X509::ExtensionError
- OpenSSL::X509::ExtensionFactory
- OpenSSL::X509::Name
- OpenSSL::X509::Name::RFC2253DN
- OpenSSL::X509::NameError
- OpenSSL::X509::Request
- OpenSSL::X509::RequestError
- OpenSSL::X509::Revoked
- OpenSSL::X509::RevokedError
- OpenSSL::X509::Store
- OpenSSL::X509::StoreContext
- OpenSSL::X509::StoreError
- unknown

No matching classes.

# OpenSSL::PKey::PKey

An abstract class that bundles signature creation (PKey#sign) and validation (PKey#verify) that is common to all implementations except OpenSSL::PKey::DH

- OpenSSL::PKey::RSA

- OpenSSL::PKey::DSA

- OpenSSL::PKey::EC

### Public Class Methods

new → self click to toggle source

Because PKey is an abstract class, actually calling this method explicitly will raise a NotImplementedError.

                   static VALUE
    ossl_pkey_initialize(VALUE self)
    {
        if (rb_obj_is_instance_of(self, cPKey)) {
            ossl_raise(rb_eTypeError, "OpenSSL::PKey::PKey can't be instantiated directly");
        }
        return self;
    }

### Public Instance Methods

sign(digest, data) → String click to toggle source

To sign the String data, digest, an instance of OpenSSL::Digest, must be provided. The return value is again a String containing the signature. A PKeyError is raised should errors occur. Any previous state of the Digest instance is irrelevant to the signature outcome, the digest instance is reset to its initial state during the operation.

## Example¶ ↑

    data = 'Sign me!'
    digest = OpenSSL::Digest::SHA256.new
    pkey = OpenSSL::PKey::RSA.new(2048)
    signature = pkey.sign(digest, data)

                   static VALUE
    ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
    {
        EVP_PKEY *pkey;
        const EVP_MD *md;
        EVP_MD_CTX *ctx;
        unsigned int buf_len;
        VALUE str;
        int result;

        pkey = GetPrivPKeyPtr(self);
        md = ossl_evp_get_digestbyname(digest);
        StringValue(data);
        str = rb_str_new(0, EVP_PKEY_size(pkey));

        ctx = EVP_MD_CTX_new();
        if (!ctx)
            ossl_raise(ePKeyError, "EVP_MD_CTX_new");
        if (!EVP_SignInit_ex(ctx, md, NULL)) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_SignInit_ex");
        }
        if (!EVP_SignUpdate(ctx, RSTRING_PTR(data), RSTRING_LEN(data))) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_SignUpdate");
        }
        result = EVP_SignFinal(ctx, (unsigned char *)RSTRING_PTR(str), &buf_len, pkey);
        EVP_MD_CTX_free(ctx);
        if (!result)
            ossl_raise(ePKeyError, "EVP_SignFinal");
        rb_str_set_len(str, buf_len);

        return str;
    }

verify(digest, signature, data) → String click to toggle source

To verify the String signature, digest, an instance of OpenSSL::Digest, must be provided to re-compute the message digest of the original data, also a String. The return value is `true` if the signature is valid, `false` otherwise. A PKeyError is raised should errors occur. Any previous state of the Digest instance is irrelevant to the validation outcome, the digest instance is reset to its initial state during the operation.

## Example¶ ↑

    data = 'Sign me!'
    digest = OpenSSL::Digest::SHA256.new
    pkey = OpenSSL::PKey::RSA.new(2048)
    signature = pkey.sign(digest, data)
    pub_key = pkey.public_key
    puts pub_key.verify(digest, signature, data) # => true

                   static VALUE
    ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
    {
        EVP_PKEY *pkey;
        const EVP_MD *md;
        EVP_MD_CTX *ctx;
        int siglen, result;

        GetPKey(self, pkey);
        ossl_pkey_check_public_key(pkey);
        md = ossl_evp_get_digestbyname(digest);
        StringValue(sig);
        siglen = RSTRING_LENINT(sig);
        StringValue(data);

        ctx = EVP_MD_CTX_new();
        if (!ctx)
            ossl_raise(ePKeyError, "EVP_MD_CTX_new");
        if (!EVP_VerifyInit_ex(ctx, md, NULL)) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_VerifyInit_ex");
        }
        if (!EVP_VerifyUpdate(ctx, RSTRING_PTR(data), RSTRING_LEN(data))) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_VerifyUpdate");
        }
        result = EVP_VerifyFinal(ctx, (unsigned char *)RSTRING_PTR(sig), siglen, pkey);
        EVP_MD_CTX_free(ctx);
        switch (result) {
        case 0:
            ossl_clear_error();
            return Qfalse;
        case 1:
            return Qtrue;
        default:
            ossl_raise(ePKeyError, "EVP_VerifyFinal");
        }
    }