I need a reproducible way to generate the same password from an RSA private key and should not depend on the OpenSSL version and other thing that like a file format...
openssl dgst -sha256 -sign private.key -out signature /dev/null
I would like to know if the signature file will stay exactly the same (at the nearest octet) if I retry this command in the future?
In fact I have a PKI which generate one key for each system used for the secure boot to sign the EFI image (EFI stub + kernel + initrd). The system need to have the hand on the private key to regenerate the EFI image for each kernel upgrade. The private key is stored on the LUKS encrypted rootfs, un locked on the boot with the TPM.
The need: I would like to produce a 512bits long key, derived from the RSA key and stored on a LUKS slot, to be able to unlock my encrypted container with in additional to the TPM one.
With this, I can recover an encrypted disk from a crashed system, using the corresponded RSA private key from the PKI database.