title: Why OpenSSL tools can successfully verify a not signed file?
body: <p>I have two files with the same content: msg.txt and msg2.txt. The msg.txt was signed, msg2.txt - was not signed. But I see both files passes the signature validation.</p>
  
  <p>Why is it so? I thought if I sign a file, the signature should be attached somewhere to the file. But <code>hexdump</code> shows there is no difference between the files.</p>
  
  <p>msg.txt</p>
  
  <pre><code>$ hexdump -C msg.txt
  00000000 48 69 0a                     |Hi.|
  00000003
  </code></pre>
  
  <p>msg2.txt</p>
  
  <pre><code>$ hexdump -C msg2.txt 
  00000000 48 69 0a                     |Hi.|
  00000003
  </code></pre>
  
  <p>Now every new file which contains "Hi" word only can be successfully verified. What if another user creates a file with a "Hi" word?!</p>
  
  <h1>Steps to reproduce:</h1>
  
  <ol>
  <li>Create a self-signed PEM certificate-key pair</li>
  </ol>
  
  <pre><code>openssl req -x509 -sha512 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 
  </code></pre>
  
  <ol start="2">
  <li>Create files</li>
  </ol>
  
  <pre><code>$ echo "Hi" &gt; msg.txt
  $ echo "Hi" &gt; msg2.txt
  </code></pre>
  
  <ol start="3">
  <li>Sign msg.txt</li>
  </ol>
  
  <pre><code>$ openssl dgst -sha512 -sign key.pem -out /tmp/signature msg.txt
  $ openssl base64 -in /tmp/signature -out signature
  </code></pre>
  
  <ol start="4">
  <li>Verify msg.txt signature</li>
  </ol>
  
  <pre><code>$ openssl base64 -d -in signature -out /tmp/signature
  $ openssl x509 -pubkey -noout -in cert.pem &gt; pubkey.pem
  $ openssl dgst -sha512 -verify pubkey.pem -signature /tmp/signature msg.txt
  Verified OK
  </code></pre>
  
  <ol start="5">
  <li>Verify msg2.txt signature</li>
  </ol>
  
  <pre><code>$ openssl dgst -sha512 -verify pubkey.pem -signature /tmp/signature msg2.txt
  Verified OK
  </code></pre>