title: RSA PKCS #1 v1.5 Signature gives extra octet in Python compared to openssl
body: <p>I want to sign a message according to the RSA-SHA1 Signature Method in OAuth 1 RFC Section <a href="https://www.rfc-editor.org/rfc/rfc5849#section-3.4.3" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc5849#section-3.4.3</a> using Python. I'm trying to verify that I am on the right track by comparing results with that of openssl.</p>
  <p>Now I suddenly found myself with an extra octet and since my knowledge of cryptography is limited at best I need some help. From looking through source of crypto and the man pages of openssl and the fact that the output is strikingly similar I reckon I am at least using the right algorithm.</p>
  <p>When using openssl rsautl however, then I am not even close...</p>
  <pre><code>$ openssl genrsa -out private.pem 1024
  
  $ cat message
  Lorem ipsum
  
  $ cat sign.py
  from Crypto.PublicKey import RSA
  from Crypto.Signature import PKCS1_v1_5
  from Crypto.Hash import SHA
  key = RSA.importKey(open(&quot;private.pem&quot;).read())
  message = open(&quot;message&quot;).read()[:-1] # skip last newline
  h = SHA.new(message)
  p = PKCS1_v1_5.new(key)
  signature = p.sign(h)
  signature_trim = p.sign(h)[:-1] # will give same output as openssl dgst -sign
  print signature    # remove print when not using hexdump
  </code></pre>
  <p>Output from Python</p>
  <pre><code>$ python sign.py | hexdump
  0000000 1346 38af 89a8 d203 ee26 0cfa a4bc 3a6c
  0000010 44fd a436 2c50 03ba 7c84 333a 910a 843e
  0000020 f71b 5731 1d2a 8895 9f5c 86b1 1838 7de9
  0000030 5c13 d7e5 a019 6ad1 e5a5 d4d5 bd6f 0032
  0000040 f320 c5ad fc41 da2c a9c3 2d9a cdce f6d6
  0000050 4ef4 6dbd 1ba2 edc1 648e 184a 2e6c e746
  0000060 fd92 ba61 b4da f607 d7a4 fbef 8230 378d
  0000070 a143 b444 c711 7121 6e08 9d88 bb05 0d25
  0000080 000a                                   
  0000081
  </code></pre>
  <p>Output from signing using openssl dgst (not sure if this really is rsa pkcs #1 v1.5)</p>
  <pre><code>$ echo -n $(cat message) | openssl dgst -sign private.pem | hexdump
  0000000 1346 38af 89a8 d203 ee26 0cfa a4bc 3a6c
  0000010 44fd a436 2c50 03ba 7c84 333a 910a 843e
  0000020 f71b 5731 1d2a 8895 9f5c 86b1 1838 7de9
  0000030 5c13 d7e5 a019 6ad1 e5a5 d4d5 bd6f 0032
  0000040 f320 c5ad fc41 da2c a9c3 2d9a cdce f6d6
  0000050 4ef4 6dbd 1ba2 edc1 648e 184a 2e6c e746
  0000060 fd92 ba61 b4da f607 d7a4 fbef 8230 378d
  0000070 a143 b444 c711 7121 6e08 9d88 bb05 0d25
  0000080
  </code></pre>
  <p>In sign.py I then remove the signature print and verify the signature against its public key. Since trimming the signature will fail the verification I get the idea that It should not be done but I have been wrong before.</p>
  <pre><code>pubkey = key.publickey()
  pp = PKCS1_v1_5.new(pubkey)
  print pp.verify(h, signature)         # True
  print pp.verify(h, signature_trim)    # False
  </code></pre>
  <p>Output from openssl rsautl (not sure if this is pkcs #1 v1.5 either)</p>
  <pre><code>$ echo -n $(cat message) | openssl dgst -sha1 | openssl rsautl -sign -inkey private.pem  | hexdump
  0000000 14a4 f02c 527f 26f9 29f6 281c 3185 4a1a
  0000010 def8 052b b620 cca2 38d9 a389 0b44 112a
  0000020 283c ebff 4228 6f77 7a65 9d53 4b98 a073
  0000030 bbd9 1aca 3447 a917 d7c3 0968 63c4 6806
  0000040 6112 6f36 2d38 a770 5afa a8e0 adf3 4bef
  0000050 120c cc10 5194 75ad bdda 91e6 fd79 8f4c
  0000060 b864 efb8 cc88 a4da e977 b488 6241 15fb
  0000070 e105 1d11 8627 75bd 345b 34da 538f a8db
  0000080
  </code></pre>
  <p>I am clearly doing something wrong and now I wonder by just how much. Except from base64 encoding and the face that &quot;Lorem ipsum&quot; is not a valid signature base string...</p>
  <p><strong>...what do I need to modify in order to make this a valid RSA-SHA1 signature?</strong></p>