Is there a way to verify a signed digest within Postgres? - postgresql

Question

The following command was run and the content of content_file, signature_file and id_rsa.pub (or pem) are inserted into a Postgres database.
openssl dgst -sign id_rsa content_file > signature_file
Is there any way to verify that the signature corresponds with the content/public key within Postgres?
I have looked at the pgcrypto functions however the only relevant function seems to be pgp_pub_decrypt which requires the secret key.
Basically I am looking to perform the following in Postgres:
openssl dgst -verify .\id_rsa.pem -signature .\signature_file .\content_file

Answer 1

As per Craig's suggestion, I ended up using plpythonu to solve this.
CREATE OR REPLACE FUNCTION api.verify(
p_data text,
p_signature text,
p_publickey text
)
RETURNS boolean AS
$$
try:
import rsa
pubkey = rsa.PublicKey.load_pkcs1(p_publickey)
signature = bytearray.fromhex(p_signature)
verified = rsa.verify(p_data, signature, pubkey)
return verified
except:
return False
$$ LANGUAGE plpythonu VOLATILE
SECURITY DEFINER;
With my lack of python knowledge, the hardest part of this was actually setting up the required python packages (Docker environment in my case). Here is the relevant excerpt from the Dockerfile:
FROM postgres:9.6
# Install necessary python packages to work with postgres
RUN apt-get update \
&& apt-get install -y --no-install-recommends \
"postgresql-plpython-$PG_MAJOR" \
&& apt-get install -y python-pip python-dev
# Install python rsa module for signature verification
RUN pip install rsa
The function worked given the following parameters:
-- Generate private key. Provide secure passphrase when prompted.
openssl genrsa -aes256 -out private.pem 4096
--Export public KEY
openssl rsa -in private.pem -RSAPublicKey_out -out public.pem
--Sign data. Provide secure passphrase when prompted.
--Remove first line (RSA-SHA256(data.txt)=) when passing into database verify function.
openssl dgst -hex -sign private.pem data.txt > signature.txt