0

I'm trying to verify locally the signature of a commit. Following the answer in https://stackoverflow.com/a/68825309, I was able to split into two files the data being signed (commit) from its signature (sig), but I would like to redo all the elliptic curve computations to verify the signature externally (e.g., with SageMath) and not with gpg --verify sig commit.

I correctly extracted the r and s components of the signature, but I cannot get the correct hashed data. Applying sha256sum (I checked that the hash function is the correct one) to the commit file from the previous answer containing the date being signed does not give the correct hashed value for ECDSA. By using the command gpg --verify --debug=7 sig commit with the debug parameter, I can see both the r and s signature values (which are the correct values I have) and the hashed data but I don't know how this hashed data is generated.

Can someone please explain how the hashed data (z in the ECDSA specifications) is computed from the commit data?

Improve this question
4
  • Can you show us the SageMath code you've tried so far? Commented Aug 3, 2024 at 12:38
  • I have not tried it yet as I cannot collect the correct input values for the verification algorithm. Commented Aug 3, 2024 at 12:42
  • Did you try first importing the gpg key and then using git verify-commit? Commented Aug 3, 2024 at 13:31
  • I did. The signature is indeed valid using git, but there is no information about the actual values (even with -v). Commented Aug 3, 2024 at 13:47
Related questions
27140
How do I undo the most recent local commits in Git?
20362
How do I delete a Git branch locally and remotely?
11582
How do I undo 'git add' before commit?
Load 7 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.