Class: OpenSSL::PKey::PKey (Ruby 2.7.5)
Description: Class : OpenSSL::PKey::PKey - Ruby 2.7.5

### Home Classes Methods

### In Files

- openssl/ossl_pkey.c

### Parent

Object

### Methods

- ::new
- #sign
- #verify

### Class/Module Index

Quicksearch

- IO
- IO::WaitReadable
- IO::WaitWritable
- Integer
- OpenSSL
- OpenSSL::ASN1
- OpenSSL::ASN1::ASN1Data
- OpenSSL::ASN1::ASN1Error
- OpenSSL::ASN1::Constructive
- OpenSSL::ASN1::ObjectId
- OpenSSL::ASN1::Primitive
- OpenSSL::BN
- OpenSSL::BNError
- OpenSSL::Buffering
- OpenSSL::Cipher
- OpenSSL::Cipher::Cipher
- OpenSSL::Cipher::CipherError
- OpenSSL::Config
- OpenSSL::ConfigError
- OpenSSL::Digest
- OpenSSL::Digest::DigestError
- OpenSSL::Engine
- OpenSSL::Engine::EngineError
- OpenSSL::ExtConfig
- OpenSSL::HMAC
- OpenSSL::HMACError
- OpenSSL::KDF
- OpenSSL::KDF::KDFError
- OpenSSL::Netscape
- OpenSSL::Netscape::SPKI
- OpenSSL::Netscape::SPKIError
- OpenSSL::OCSP
- OpenSSL::OCSP::BasicResponse
- OpenSSL::OCSP::CertificateId
- OpenSSL::OCSP::OCSPError
- OpenSSL::OCSP::Request
- OpenSSL::OCSP::Response
- OpenSSL::OCSP::SingleResponse
- OpenSSL::OpenSSLError
- OpenSSL::PKCS12
- OpenSSL::PKCS12::PKCS12Error
- OpenSSL::PKCS5
- OpenSSL::PKCS7
- OpenSSL::PKCS7::PKCS7Error
- OpenSSL::PKCS7::RecipientInfo
- OpenSSL::PKCS7::SignerInfo
- OpenSSL::PKey
- OpenSSL::PKey::DH
- OpenSSL::PKey::DHError
- OpenSSL::PKey::DSA
- OpenSSL::PKey::DSAError
- OpenSSL::PKey::EC
- OpenSSL::PKey::EC::Group
- OpenSSL::PKey::EC::Group::Error
- OpenSSL::PKey::EC::Point
- OpenSSL::PKey::EC::Point::Error
- OpenSSL::PKey::ECError
- OpenSSL::PKey::PKey
- OpenSSL::PKey::PKeyError
- OpenSSL::PKey::RSA
- OpenSSL::PKey::RSAError
- OpenSSL::Random
- OpenSSL::Random::RandomError
- OpenSSL::SSL
- OpenSSL::SSL::SSLContext
- OpenSSL::SSL::SSLError
- OpenSSL::SSL::SSLErrorWaitReadable
- OpenSSL::SSL::SSLErrorWaitWritable
- OpenSSL::SSL::SSLServer
- OpenSSL::SSL::SSLSocket
- OpenSSL::SSL::Session
- OpenSSL::SSL::Session::SessionError
- OpenSSL::SSL::SocketForwarder
- OpenSSL::X509
- OpenSSL::X509::Attribute
- OpenSSL::X509::AttributeError
- OpenSSL::X509::CRL
- OpenSSL::X509::CRLError
- OpenSSL::X509::Certificate
- OpenSSL::X509::CertificateError
- OpenSSL::X509::Extension
- OpenSSL::X509::ExtensionError
- OpenSSL::X509::ExtensionFactory
- OpenSSL::X509::Name
- OpenSSL::X509::Name::RFC2253DN
- OpenSSL::X509::NameError
- OpenSSL::X509::Request
- OpenSSL::X509::RequestError
- OpenSSL::X509::Revoked
- OpenSSL::X509::RevokedError
- OpenSSL::X509::Store
- OpenSSL::X509::StoreContext
- OpenSSL::X509::StoreError

No matching classes.

# OpenSSL::PKey::PKey

An abstract class that bundles signature creation (`PKey#sign`) and validation (`PKey#verify`) that is common to all implementations except `OpenSSL::PKey::DH`

- `OpenSSL::PKey::RSA`

- `OpenSSL::PKey::DSA`

- `OpenSSL::PKey::EC`

### Public Class Methods

new → self click to toggle source

Because `PKey` is an abstract class, actually calling this method explicitly will raise a NotImplementedError.

                   static VALUE
    ossl_pkey_initialize(VALUE self)
    {
        if (rb_obj_is_instance_of(self, cPKey)) {
            ossl_raise(rb_eTypeError, "OpenSSL::PKey::PKey can't be instantiated directly");
        }
        return self;
    }

### Public Instance Methods

sign(digest, data) → String click to toggle source

To sign the String data, digest, an instance of `OpenSSL::Digest`, must be provided. The return value is again a String containing the signature. A `PKeyError` is raised should errors occur. Any previous state of the `Digest` instance is irrelevant to the signature outcome, the digest instance is reset to its initial state during the operation.

## Example¶ ↑

    data = 'Sign me!'
    digest = OpenSSL::Digest::SHA256.new
    pkey = OpenSSL::PKey::RSA.new(2048)
    signature = pkey.sign(digest, data)

                   static VALUE
    ossl_pkey_sign(VALUE self, VALUE digest, VALUE data)
    {
        EVP_PKEY *pkey;
        const EVP_MD *md;
        EVP_MD_CTX *ctx;
        unsigned int buf_len;
        VALUE str;
        int result;

        pkey = GetPrivPKeyPtr(self);
        md = ossl_evp_get_digestbyname(digest);
        StringValue(data);
        str = rb_str_new(0, EVP_PKEY_size(pkey));

        ctx = EVP_MD_CTX_new();
        if (!ctx)
            ossl_raise(ePKeyError, "EVP_MD_CTX_new");
        if (!EVP_SignInit_ex(ctx, md, NULL)) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_SignInit_ex");
        }
        if (!EVP_SignUpdate(ctx, RSTRING_PTR(data), RSTRING_LEN(data))) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_SignUpdate");
        }
        result = EVP_SignFinal(ctx, (unsigned char *)RSTRING_PTR(str), &buf_len, pkey);
        EVP_MD_CTX_free(ctx);
        if (!result)
            ossl_raise(ePKeyError, "EVP_SignFinal");
        rb_str_set_len(str, buf_len);

        return str;
    }

verify(digest, signature, data) → String click to toggle source

To verify the String signature, digest, an instance of `OpenSSL::Digest`, must be provided to re-compute the message digest of the original data, also a String. The return value is `true` if the signature is valid, `false` otherwise. A `PKeyError` is raised should errors occur. Any previous state of the `Digest` instance is irrelevant to the validation outcome, the digest instance is reset to its initial state during the operation.

## Example¶ ↑

    data = 'Sign me!'
    digest = OpenSSL::Digest::SHA256.new
    pkey = OpenSSL::PKey::RSA.new(2048)
    signature = pkey.sign(digest, data)
    pub_key = pkey.public_key
    puts pub_key.verify(digest, signature, data) # => true

                   static VALUE
    ossl_pkey_verify(VALUE self, VALUE digest, VALUE sig, VALUE data)
    {
        EVP_PKEY *pkey;
        const EVP_MD *md;
        EVP_MD_CTX *ctx;
        int siglen, result;

        GetPKey(self, pkey);
        ossl_pkey_check_public_key(pkey);
        md = ossl_evp_get_digestbyname(digest);
        StringValue(sig);
        siglen = RSTRING_LENINT(sig);
        StringValue(data);

        ctx = EVP_MD_CTX_new();
        if (!ctx)
            ossl_raise(ePKeyError, "EVP_MD_CTX_new");
        if (!EVP_VerifyInit_ex(ctx, md, NULL)) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_VerifyInit_ex");
        }
        if (!EVP_VerifyUpdate(ctx, RSTRING_PTR(data), RSTRING_LEN(data))) {
            EVP_MD_CTX_free(ctx);
            ossl_raise(ePKeyError, "EVP_VerifyUpdate");
        }
        result = EVP_VerifyFinal(ctx, (unsigned char *)RSTRING_PTR(sig), siglen, pkey);
        EVP_MD_CTX_free(ctx);
        switch (result) {
        case 0:
            ossl_clear_error();
            return Qfalse;
        case 1:
            return Qtrue;
        default:
            ossl_raise(ePKeyError, "EVP_VerifyFinal");
        }
    }