title: Signing a large file using OpenSSL
body: <p>I need to sign a large binary file containing a firmware and then validate this signature at the target device receiving it. After reading some articles I concluded a way to do this, but I am not sure whether it's supposed to be done this way. Below is what I've done so far:</p>
  
  <p>Sender generates a private key:</p>
  
  <pre><code>$ openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 -out privkey-ID.pem
  </code></pre>
  
  <p>Sender generates the public key using the private key:</p>
  
  <pre><code>$ openssl pkey -in privkey-ID.pem -out pubkey-ID.pem -pubout
  </code></pre>
  
  <p>Sender generates the digest and sign the file using it:</p>
  
  <pre><code>$ openssl dgst -sha256 -sign privkey-ID.pem -out out.sha256 rootfs.jffs2
  </code></pre>
  
  <p>Receiver verifies the signature:</p>
  
  <pre><code>$ openssl dgst -sha256 -verify pubkey-ID.pem -signature out.sha256 rootfs.jffs2
  </code></pre>
  
  <p>On executing the 4th step I am getting a "Verification OK" response but I am not sure if it's done correctly.</p>
  
  <p>Also the requirement is to use a symmetric key for signing. As far as I understand signing with a symmetric key means one must use the same key at both the sender and the receiver, but here I am signing with a private key and verifying with a public key.</p>
  
  <p>Clarifications on the above points is greatly appreciated.</p>