Decrypt with the public key using openssl in commandline
<p>I want to 'manually' compare a digest/hash of a message with the decrypted signature value on this digest.</p>

<p>For this, I want to decrypt the signature value (the signed digest) of the message with the public key that belongs to the private key the digest was signed with in the first place. </p>

<p>I have the following items: </p>

<ul>
<li>The digest value in base64 of the message (calculated with SHA256)</li>
<li>The signature value on the digest in base64 that has been signed with the private
key (using SHA256 with RSA Encryption)</li>
<li>The public key in .pem format belonging to the private key</li>
<li>I have the actual message (it is in XML containing multiple signatures on different sections of the document). I already verified the signatures using the XML security library. I'm interested in only decrypting the signature value with the public key.</li>
</ul>

<p>I'm kind of stuck of how I can achieve this using openssl. </p>

<p>I'm trying variations on the commands described <a href="https://www.openssl.org/docs/manmaster/apps/rsautl.html" rel="nofollow noreferrer">here</a> and <a href="https://stackoverflow.com/questions/14327517/openssl-rsa-using-a-public-key-to-decrypt">here</a>, however I'm kind of lost. </p>

<p>I suppose I should convert the signature from base64 value to octet using:</p>

<p><code>base64 --d sigfile &gt; sigfile_octet</code>?</p>

<p>Then I'm using the command:</p>

<p><code>openssl rsautl -inkey pubkey.pem -pubin -in sigfile_octet</code></p>

<p>Does this give me the decrypted signature value in octet? 
What are the next steps I need to perform to compare it with the base64 digest? </p>

<p>p.s. I already verified the signature using <a href="https://www.aleksey.com/xmlsec/" rel="nofollow noreferrer">Aleksey's XML security library</a>, so I know the digest should match the decrypted signature value.</p>

<p>Your help would be very much appreciated!!</p>

<p>Kind regards,</p>

<p>Diederik</p>