how to do verify using java.security.Signature

Question

I have a key pair already, public and private. How do I actually use the java.security.Signature to do verification of a string I signed with one of the keys?

Edit:

I have both the keys as Strings. The verify method, it is actually

verify(byte[] signature)

The javadoc says:

verify(byte[] signature) Indicates whether the given signature can be verified using the public key or a certificate of the signer.

How would I make that signature recognize which public/private key to use for that verifying, before I call the verify method? In other words, how do I turn my string keys into key objects that would get accepted by signature?

Is there by any chance a method named verify in that class? If so perhaps you have a more specific question. — President James K. Polk
– President James K. Polk, Commented Feb 10, 2012 at 0:21

Community · Accepted Answer · 2020-06-20 09:12:55Z

8

Use KeyFactory to translate key specifications to objects.
Call Signature.getInstance(algName) to get a signature instance.
Use Signature's initVerify method to associate a key for signature verification.
Use update to feed the Signature bytes.
Finally, call verify.
Profit

From the KeyFactory javadoc:

The following is an example of how to use a key factory in order to instantiate a DSA public key from its encoding. Assume Alice has received a digital signature from Bob. Bob also sent her his public key (in encoded format) to verify his signature. Alice then performs the following actions:
X509EncodedKeySpec bobPubKeySpec = new X509EncodedKeySpec(bobEncodedPubKey);
KeyFactory keyFactory = KeyFactory.getInstance("DSA");
PublicKey bobPubKey = keyFactory.generatePublic(bobPubKeySpec);
Signature sig = Signature.getInstance("DSA");
sig.initVerify(bobPubKey);
sig.update(data);
sig.verify(signature);

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Feb 10, 2012 at 1:35

Mike Samuel

121k30 gold badges230 silver badges255 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

sammiwei Over a year ago

Thanks for the reply. So in my case, I would change "DSA" to "RSA", right?

Mike Samuel Over a year ago

@sammiwei, I don't know whether it's "RSASSA-PSS" or what the appropriate algorithm name is to your situation, but you are correct in that you need to substitute the correct name for "DSA" in two places in that example.

Osagui Aghedo Over a year ago

Algorithm names -> docs.oracle.com/javase/7/docs/technotes/guides/security/…

Collectives™ on Stack Overflow

how to do verify using java.security.Signature

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related