Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

base64 decoding and verifying signature against a public key

Posted on 2011-03-19
1
Medium Priority
?
2,052 Views
Last Modified: 2012-08-14
Hello,

I have a message that has a signatured generated for it and I need to validate them against the public key file (/temp/publickey.p7b).  The message and signature were both first url encoded and then the signature was also BASE64-encoded.  I'm using the below to url decode first, then base64 decode the signature and then verify the signature against the public key.  I get an exception on  PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);
The signature algorithm used will be SHA-1 with RSA. SHA-1 is the message digest algorithm and RSA is the encryption algorithm.

Exception:
java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException: algid parse error, not a sequence
      at sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:188)
      at java.security.KeyFactory.generatePublic(KeyFactory.java:304)

Caused by: java.security.InvalidKeyException: IOException: algid parse error, not a sequence
      at sun.security.x509.X509Key.decode(X509Key.java:380)
      at sun.security.x509.X509Key.decode(X509Key.java:386)
      at sun.security.rsa.RSAPublicKeyImpl.<init>(RSAPublicKeyImpl.java:66)
      at sun.security.rsa.RSAKeyFactory.generatePublic(RSAKeyFactory.java:281)
      at sun.security.rsa.RSAKeyFactory.engineGeneratePublic(RSAKeyFactory.java:184)



public void decode(){
        String message="message string";
        String signature="signtaure encoded string";


        try{
            String messageDecoded=URLDecoder.decode(message, "UTF-8");
            String signatureUrlDecoded=URLDecoder.decode(signature, "UTF-8");
             
            byte[] decodedSignature = Base64.decodeBase64(signatureUrlDecoded.getBytes());
            String decodedSignatureString = new String(decodedSignature);
            
            FileInputStream publicKeyFile = new FileInputStream("/temp/publickey.p7b");
             
			byte[] encKey = new byte[publicKeyFile.available()];
			publicKeyFile.read(encKey);
			publicKeyFile.close();
			
			X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(encKey);
			KeyFactory keyFactory = KeyFactory.getInstance("RSA");
			PublicKey pubKey = keyFactory.generatePublic(pubKeySpec);
			
			Signature sig = Signature.getInstance("SHA1withRSA");
			sig.initVerify(pubKey);
			sig.update(messageDecoded.getBytes());
			boolean verifies = sig.verify(decodedSignature);
         }
         catch(Exception e){
             e.printStackTrace();
         }

	}

Open in new window

0
Comment
Question by:cgray1223
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 65

Accepted Solution

by:
btan earned 2000 total points
ID: 35174720
you may want to check out this API that parses a PKCS#7-formatted (or p7b) certificate reply stored in a file. From the generateCertificates, you will get Certificate instance which is DER-encoded instances of X.509 certificate. you will probably have to enumerate each cert in p7b (as typically it may have a collection) and populate into "encKey" instead

See more in
http://download.oracle.com/javase/1.5.0/docs/guide/security/CryptoSpec.html#ParseCert
http://download.oracle.com/javase/1.5.0/docs/guide/security/CryptoSpec.html#KeyFactoryEx
0

Featured Post

Enroll in October's Free Course of the Month

Do you work with and analyze data? Enroll in October's Course of the Month for 7+ hours of SQL training, allowing you to quickly and efficiently store or retrieve data. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this post we will learn how to make Android Gesture Tutorial and give different functionality whenever a user Touch or Scroll android screen.
The well known Cerber ransomware continues to spread this summer through spear phishing email campaigns targeting enterprises. Learn how it easily bypasses traditional defenses - and what you can do to protect your data.
Viewers learn how to read error messages and identify possible mistakes that could cause hours of frustration. Coding is as much about debugging your code as it is about writing it. Define Error Message: Line Numbers: Type of Error: Break Down…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
Suggested Courses

609 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question