Java SHA1withRSA verification is always false, why?

I'm doing a SHA1withRSA verification method but the result is always false, is it something I coded wrong or are the public keys wrong or something?

Here's the code:

Signature signature = Signature.getInstance("SHA1withRSA");
File file = this.getPublicKey();
byte keyBytes = Files.readAllBytes(file.toPath());

// Setup RSA key
X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(keyBytes);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
RSAPublicKey publicKey = (RSAPublicKey) keyFactory.generatePublic(pubKeySpec);

// verify signatures
byte signatureBytes = Base64.decodeBase64(this.firmaB64);
signature.initVerify(publicKey);
signature.update(this.parteFirmada.getBytes());
boolean result = signature.verify(signatureBytes);

Thanks a lot!

asked Nov 14 '18 at 11:23

Miluna

165

This this.parteFirmada.getBytes() may not give you the exact bytes that were originally signed. At least specify the character encoding explicitly, but better use the original bytes (before they were converted to a string).

– Henry
Nov 14 '18 at 12:30

Thanks for the hint. That string is originally from a larger string which contained both the parteFirmada String and the firmaB64 String, should I use substring from the original and get both of these strings and bytes arrays?

– Miluna
Nov 14 '18 at 13:05

What is actually signed are bytes, not a string. How do you get the parteFirmada? If it is transferred as string, be sure to use the exact same character encoding that was used by the signer.

– Henry
Nov 14 '18 at 13:09

Both the parteFirmada and firmaB64 comes from a single string which is split by # so the first element is the signed piece and the second one is the signature

– Miluna
Nov 14 '18 at 14:02

Probably the problem is in obtaining parteFirmada from that string. Make sure it corresponds with the original. Check also if you need to decode from base64 as you do with the signature

– pedrofb
Nov 14 '18 at 15:11

add a comment |

I'm doing a SHA1withRSA verification method but the result is always false, is it something I coded wrong or are the public keys wrong or something?

Here's the code:

Signature signature = Signature.getInstance("SHA1withRSA");
File file = this.getPublicKey();
byte keyBytes = Files.readAllBytes(file.toPath());

// Setup RSA key
X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(keyBytes);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
RSAPublicKey publicKey = (RSAPublicKey) keyFactory.generatePublic(pubKeySpec);

// verify signatures
byte signatureBytes = Base64.decodeBase64(this.firmaB64);
signature.initVerify(publicKey);
signature.update(this.parteFirmada.getBytes());
boolean result = signature.verify(signatureBytes);

Thanks a lot!

asked Nov 14 '18 at 11:23

Miluna

165

This this.parteFirmada.getBytes() may not give you the exact bytes that were originally signed. At least specify the character encoding explicitly, but better use the original bytes (before they were converted to a string).

– Henry
Nov 14 '18 at 12:30

Thanks for the hint. That string is originally from a larger string which contained both the parteFirmada String and the firmaB64 String, should I use substring from the original and get both of these strings and bytes arrays?

– Miluna
Nov 14 '18 at 13:05

What is actually signed are bytes, not a string. How do you get the parteFirmada? If it is transferred as string, be sure to use the exact same character encoding that was used by the signer.

– Henry
Nov 14 '18 at 13:09

Both the parteFirmada and firmaB64 comes from a single string which is split by # so the first element is the signed piece and the second one is the signature

– Miluna
Nov 14 '18 at 14:02

Probably the problem is in obtaining parteFirmada from that string. Make sure it corresponds with the original. Check also if you need to decode from base64 as you do with the signature

– pedrofb
Nov 14 '18 at 15:11

add a comment |

I'm doing a SHA1withRSA verification method but the result is always false, is it something I coded wrong or are the public keys wrong or something?

Here's the code:

Signature signature = Signature.getInstance("SHA1withRSA");
File file = this.getPublicKey();
byte keyBytes = Files.readAllBytes(file.toPath());

// Setup RSA key
X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(keyBytes);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
RSAPublicKey publicKey = (RSAPublicKey) keyFactory.generatePublic(pubKeySpec);

// verify signatures
byte signatureBytes = Base64.decodeBase64(this.firmaB64);
signature.initVerify(publicKey);
signature.update(this.parteFirmada.getBytes());
boolean result = signature.verify(signatureBytes);

Thanks a lot!

asked Nov 14 '18 at 11:23

Miluna

165

I'm doing a SHA1withRSA verification method but the result is always false, is it something I coded wrong or are the public keys wrong or something?

Here's the code:

Signature signature = Signature.getInstance("SHA1withRSA");
File file = this.getPublicKey();
byte keyBytes = Files.readAllBytes(file.toPath());

// Setup RSA key
X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(keyBytes);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
RSAPublicKey publicKey = (RSAPublicKey) keyFactory.generatePublic(pubKeySpec);

// verify signatures
byte signatureBytes = Base64.decodeBase64(this.firmaB64);
signature.initVerify(publicKey);
signature.update(this.parteFirmada.getBytes());
boolean result = signature.verify(signatureBytes);

Thanks a lot!

java security rsa sha1 verification

asked Nov 14 '18 at 11:23

Miluna

165

asked Nov 14 '18 at 11:23

Miluna

165

asked Nov 14 '18 at 11:23

Miluna

165

asked Nov 14 '18 at 11:23

Miluna

165

asked Nov 14 '18 at 11:23

Miluna

165

This this.parteFirmada.getBytes() may not give you the exact bytes that were originally signed. At least specify the character encoding explicitly, but better use the original bytes (before they were converted to a string).

– Henry
Nov 14 '18 at 12:30

Thanks for the hint. That string is originally from a larger string which contained both the parteFirmada String and the firmaB64 String, should I use substring from the original and get both of these strings and bytes arrays?

– Miluna
Nov 14 '18 at 13:05

What is actually signed are bytes, not a string. How do you get the parteFirmada? If it is transferred as string, be sure to use the exact same character encoding that was used by the signer.

– Henry
Nov 14 '18 at 13:09

Both the parteFirmada and firmaB64 comes from a single string which is split by # so the first element is the signed piece and the second one is the signature

– Miluna
Nov 14 '18 at 14:02

Probably the problem is in obtaining parteFirmada from that string. Make sure it corresponds with the original. Check also if you need to decode from base64 as you do with the signature

– pedrofb
Nov 14 '18 at 15:11

add a comment |

This this.parteFirmada.getBytes() may not give you the exact bytes that were originally signed. At least specify the character encoding explicitly, but better use the original bytes (before they were converted to a string).

– Henry
Nov 14 '18 at 12:30

Thanks for the hint. That string is originally from a larger string which contained both the parteFirmada String and the firmaB64 String, should I use substring from the original and get both of these strings and bytes arrays?

– Miluna
Nov 14 '18 at 13:05

What is actually signed are bytes, not a string. How do you get the parteFirmada? If it is transferred as string, be sure to use the exact same character encoding that was used by the signer.

– Henry
Nov 14 '18 at 13:09

Both the parteFirmada and firmaB64 comes from a single string which is split by # so the first element is the signed piece and the second one is the signature

– Miluna
Nov 14 '18 at 14:02

Probably the problem is in obtaining parteFirmada from that string. Make sure it corresponds with the original. Check also if you need to decode from base64 as you do with the signature

– pedrofb
Nov 14 '18 at 15:11

This this.parteFirmada.getBytes() may not give you the exact bytes that were originally signed. At least specify the character encoding explicitly, but better use the original bytes (before they were converted to a string).

– Henry
Nov 14 '18 at 12:30

Thanks for the hint. That string is originally from a larger string which contained both the parteFirmada String and the firmaB64 String, should I use substring from the original and get both of these strings and bytes arrays?

– Miluna
Nov 14 '18 at 13:05

What is actually signed are bytes, not a string. How do you get the parteFirmada? If it is transferred as string, be sure to use the exact same character encoding that was used by the signer.

– Henry
Nov 14 '18 at 13:09

Both the parteFirmada and firmaB64 comes from a single string which is split by # so the first element is the signed piece and the second one is the signature

– Miluna
Nov 14 '18 at 14:02

Probably the problem is in obtaining parteFirmada from that string. Make sure it corresponds with the original. Check also if you need to decode from base64 as you do with the signature

– pedrofb
Nov 14 '18 at 15:11

add a comment |

1 Answer
1

active

oldest

votes

I found that the string that I was verifying was not as the original string that was signed and hence that it was false. The verification code was good in case anyone is interested.

The string contained a timestamp and to pass the timestamp verification it was changed... that could never pass as verified!

Thanks for all the comments

answered Dec 24 '18 at 9:12

Miluna

165

add a comment |

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53299083%2fjava-sha1withrsa-verification-is-always-false-why%23new-answer', 'question_page');

);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

I found that the string that I was verifying was not as the original string that was signed and hence that it was false. The verification code was good in case anyone is interested.

The string contained a timestamp and to pass the timestamp verification it was changed... that could never pass as verified!

Thanks for all the comments

answered Dec 24 '18 at 9:12

Miluna

165

add a comment |

I found that the string that I was verifying was not as the original string that was signed and hence that it was false. The verification code was good in case anyone is interested.

The string contained a timestamp and to pass the timestamp verification it was changed... that could never pass as verified!

Thanks for all the comments

answered Dec 24 '18 at 9:12

Miluna

165

add a comment |

I found that the string that I was verifying was not as the original string that was signed and hence that it was false. The verification code was good in case anyone is interested.

The string contained a timestamp and to pass the timestamp verification it was changed... that could never pass as verified!

Thanks for all the comments

answered Dec 24 '18 at 9:12

Miluna

165

I found that the string that I was verifying was not as the original string that was signed and hence that it was false. The verification code was good in case anyone is interested.

The string contained a timestamp and to pass the timestamp verification it was changed... that could never pass as verified!

Thanks for all the comments

answered Dec 24 '18 at 9:12

Miluna

165

answered Dec 24 '18 at 9:12

Miluna

165

answered Dec 24 '18 at 9:12

Miluna

165

answered Dec 24 '18 at 9:12

Miluna

165

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Pfthb