How to verify a digital signature with openssl

Question

I'm using a thirdparty credit card processing service (Paybox) that, after a successful transaction, redirects back to the website with a signature in the URL as a security measure to prevent people from manipulating data. It's supposed to prove that the request originated from this service. So my success URL looks something like this:

/success.php?signature=[HUGE HASH]

I have no idea where to start with verifying this signature. This service does provide a public key, and I assume I need to create a private key, but I don't know much beyond that.

I'm pretty good with linux, and I know I'll have to run some openssl commands. I'm writing the verification script in PHP, which also has native openssl() functions.

If anyone could please push me in the right direction with some pseudo code, or even functional code, I'd be very grateful. Thanks.

Answer 1

You won't need any private key. The signature is made with Paybox's private key so you'll only need their public key, the data they've signed and the signature. Check their documentation to see which part of the data they have signed.

The PHP manual contains a complete example in the documentation of openssl_verify.