Signature not verified though the correct public key and signature file are being used

问题

result variable in the below class is always returning false though I am using the correct signature file and the public key.

public class VeriGen {

    static FileInputStream fin;

    public static void main(String args[]) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        KeyStore msCertStore = KeyStore.getInstance("Windows-MY", "SunMSCAPI");
        msCertStore.load(null, null);
        X509Certificate c = ((X509Certificate) msCertStore.getCertificate("Software View Certificate Authority"));
        PublicKey pubKey = c.getPublicKey();


        File file = new File("C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\ProcessExplorer.zip");
        fin = new FileInputStream(file);
        byte fileContent[] = new byte[(int) file.length()];

        File signedData = new File(
                "C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\SignedProcessExplorer.sig");
        fin = new FileInputStream(signedData);
        byte signedContent[] = new byte[(int) signedData.length()];

        boolean result = verifySig(fileContent, pubKey, signedContent);
        System.out.println("result is : " + result);
    }

    public static boolean verifySig(byte[] data, PublicKey key, byte[] sig) throws Exception {
        Signature signer = Signature.getInstance("SHA1WithRSA", "BC");
        signer.initVerify(key);
        signer.update(data);
        return (signer.verify(sig));

    }
}

Below is the code I used to sign the file.

public class SigGen {

    static final String KEYSTORE_FILE = "C:\\Users\\mayooranM\\Desktop\\x.509-sample-keys-and-certificates\\generation-tool\\swviewca.p12";
    static final String KEYSTORE_INSTANCE = "PKCS12";
    static final String KEYSTORE_PWD = "swviewcastoresecret";
    static final String KEYSTORE_ALIAS = "swviewca";
    static FileInputStream fin = null;

    public static void main(String args[]) throws Exception {
        Security.addProvider(new BouncyCastleProvider());

        File file = new File("C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\ProcessExplorer.zip");
        fin = new FileInputStream(file);
        byte fileContent[] = new byte[(int) file.length()];

        KeyStore ks = KeyStore.getInstance(KEYSTORE_INSTANCE);
        ks.load(new FileInputStream(KEYSTORE_FILE), KEYSTORE_PWD.toCharArray());
        Key key = ks.getKey(KEYSTORE_ALIAS, KEYSTORE_PWD.toCharArray());

        // Sign
        PrivateKey privKey = (PrivateKey) key;
        byte[] signedData = signData(fileContent, privKey);

        FileOutputStream fos = new FileOutputStream(
                "C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\SignedProcessExplorer.sig");
        fos.write(signedData);
        fos.close();

    }

    public static byte[] signData(byte[] data, PrivateKey key) throws Exception {
        Signature signer = Signature.getInstance("SHA1WithRSA", "BC");
        signer.initSign(key);
        signer.update(data);
        return (signer.sign());
    }


}

What am I doing wrong here? Please advice.

回答1:

In the code you posted, it looks like you're never actually reading the file; fin is assigned but never used, and the signedContentand fileContent arrays are created, but never filled.

来源：https://stackoverflow.com/questions/35870544/signature-not-verified-though-the-correct-public-key-and-signature-file-are-bein