尽管正在使用正确的公钥和签名文件，但仍未验证签名 [英] Signature not verified though the correct public key and signature file are being used

问题描述

结果变量在下面的类总是返回false，虽然我使用正确的签名文件和公共密钥。

result variable in the below class is always returning false though I am using the correct signature file and the public key.

public class VeriGen {

    static FileInputStream fin;

    public static void main(String args[]) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        KeyStore msCertStore = KeyStore.getInstance("Windows-MY", "SunMSCAPI");
        msCertStore.load(null, null);
        X509Certificate c = ((X509Certificate) msCertStore.getCertificate("Software View Certificate Authority"));
        PublicKey pubKey = c.getPublicKey();


        File file = new File("C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\ProcessExplorer.zip");
        fin = new FileInputStream(file);
        byte fileContent[] = new byte[(int) file.length()];

        File signedData = new File(
                "C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\SignedProcessExplorer.sig");
        fin = new FileInputStream(signedData);
        byte signedContent[] = new byte[(int) signedData.length()];

        boolean result = verifySig(fileContent, pubKey, signedContent);
        System.out.println("result is : " + result);
    }

    public static boolean verifySig(byte[] data, PublicKey key, byte[] sig) throws Exception {
        Signature signer = Signature.getInstance("SHA1WithRSA", "BC");
        signer.initVerify(key);
        signer.update(data);
        return (signer.verify(sig));

    }
}

public class SigGen {

    static final String KEYSTORE_FILE = "C:\\Users\\mayooranM\\Desktop\\x.509-sample-keys-and-certificates\\generation-tool\\swviewca.p12";
    static final String KEYSTORE_INSTANCE = "PKCS12";
    static final String KEYSTORE_PWD = "swviewcastoresecret";
    static final String KEYSTORE_ALIAS = "swviewca";
    static FileInputStream fin = null;

    public static void main(String args[]) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        File file = new File("C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\ProcessExplorer.zip");
        fin = new FileInputStream(file);
        byte fileContent[] = new byte[(int) file.length()];

        KeyStore ks = KeyStore.getInstance(KEYSTORE_INSTANCE);
        ks.load(new FileInputStream(KEYSTORE_FILE), KEYSTORE_PWD.toCharArray());
        Key key = ks.getKey(KEYSTORE_ALIAS, KEYSTORE_PWD.toCharArray());

        // Sign
        PrivateKey privKey = (PrivateKey) key;
        byte[] signedData = signData(fileContent, privKey);

        FileOutputStream fos = new FileOutputStream(
                "C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\SignedProcessExplorer.sig");
        fos.write(signedData);
        fos.close();

    }

    public static byte[] signData(byte[] data, PrivateKey key) throws Exception {
        Signature signer = Signature.getInstance("SHA1WithRSA", "BC");
        signer.initSign(key);
        signer.update(data);
        return (signer.sign());
    }


}

这里做错了？请求建议。

What am I doing wrong here? Please advice.

推荐答案

在您发布的代码中，看起来您从未真正读过文件; fin 已分配但从未使用， signedContent 和 fileContent 数组已创建，但从未填充。

In the code you posted, it looks like you're never actually reading the file; fin is assigned but never used, and the signedContentand fileContent arrays are created, but never filled.

这篇关于尽管正在使用正确的公钥和签名文件，但仍未验证签名的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！