为什么golang的RSA签名结果和OpenSSL命令的不一样？

Question

最近在项目中遇到RSA签名。希望有经验的兄弟帮忙

我使用的OpenSSL（版本1.0.2u）命令：

echo -n -e "test\n"|openssl dgst -sha256 -sign ./apiclient_key.pem| openssl base64 -A

结果如下

pyoBMuN8UqRGLVR7YcQ11yn+dQ9rSU/fB7obQhs27eotvd51q+E8BqxB6AYQDTnlqAQnOiR1rnuxPjlGkAOaPxpCqfhS5VGblh3HuNNHiycdKKa5mM1XyaWROiL7YpyYHRUcblkICW4XEN8v5wyFHxQ+TZfBN8fdqmlLdSczZ66YnIUgaWjBkdC1UH9GqMOQkySaQbgxjh4WhWvVE4umlKz+lAj9OLBhqI/ZXcs6gPFIpyNl8hlMPi6QOxFDSPZmQZl9G7mzx4E0lBoCY5XJtm5VwG3IYTryKZvSF0/GjVyR6QA3/sY25WCPL6f/y0biovk+mJ2KvPvPX26hK4DYug==

我的签名相关golang代码：

// get private key
bPrivateKey, err := ioutil.ReadFile("./apiclient_key.pem")
if err != nil || bPrivateKey == nil {
    log.Println(err)
    return
}
block, _ := pem.Decode(bPrivateKey)
if block == nil {
    return
}
pKeyInterface, err := x509.ParsePKCS8PrivateKey(block.Bytes)
if err != nil {
    log.Println(err)
    return
}
pKey, ok := pKeyInterface.(*rsa.PrivateKey)
if !ok {
    return
}
// sign
strForSign = "test\n"
shaForSign := sha256.New()
shaForSign.Write([]byte(strForSign))
hashedForSign := shaForSign.Sum(nil)
rawSignature, err := rsa.SignPKCS1v15(rand.Reader, pKey, crypto.SHA256, hashedForSign)
if err != nil {
    log.Println(err)
    return
}
signature := base64.StdEncoding.EncodeToString(rawSignature)
log.Println(signature)

结果如下

NcW5pBmUfHqVNus1PTDjGOilazWkcyxquGc/Ldu5IAjg/gAIQOKBGp7rs8thec/THhWKjZOJtZ1Xvv85vc+bG5bB4IuCZp+wkUMgDC3kFuTPjtLEBBnlhshZ1nS0Haq5BuS6aWAF9sIz6Ulq9dLMjaOAACijwEltdOdkRo8Z5V01CZMOPM3FI0dVvTGOvXxsMvLjw3XPAxNpajXhxTTGZB5jElDkTb61U/cZ9tM+iVpd7Oo+vxvgCsrx2VhV4gURrxndj3V6Nc2iNV2bByrgw8XK1htzkqLqZpWo8JF8i5LdMrfaMukn6aikhWKFOo2icatjowiSQAAXrj9EnnrbQA==

apicclient_key.pem文档内容如下：

Answer 1

$ echo -n -e "test\n" | openssl dgst -sha256 -sign ./apiclient_key.pem | openssl base64 -A
NcW5pBmUfHqVNus1PTDjGOilazWkcyxquGc/Ldu5IAjg/gAIQOKBGp7rs8thec/THhWKjZOJtZ1Xvv85vc+bG5bB4IuCZp+wkUMgDC3kFuTPjtLEBBnlhshZ1nS0Haq5BuS6aWAF9sIz6Ulq9dLMjaOAACijwEltdOdkRo8Z5V01CZMOPM3FI0dVvTGOvXxsMvLjw3XPAxNpajXhxTTGZB5jElDkTb61U/cZ9tM+iVpd7Oo+vxvgCsrx2VhV4gURrxndj3V6Nc2iNV2bByrgw8XK1htzkqLqZpWo8JF8i5LdMrfaMukn6aikhWKFOo2icatjowiSQAAXrj9EnnrbQA==%

我会仔细检查一下运行 shell 中的 openssl 命令。 stdout 的任何无关输出都会更改签名。

我从 1.0.2n-fips 和 openssl-3.0.0-alpha6 以及运行你本地的 Go 代码得到了“NcW..”签名。

为什么golang的RSA签名结果和OpenSSL命令的不一样？

Why is the RSA signature result of golang different from that of OpenSSL command?

openssl

rsa

sign

go