java - 无法在 Android 上验证 rsa 签名

Question

我正在尝试使用私钥签署加密消息并在 Java 中对其进行验证。这是我第一次使用加密和签名，所以我不确定它应该如何工作，我有点被困在这里。验证始终返回 false。

我在这里签名消息:

public byte[] rsaSign (byte[] data) {

byte[] cipherData = null;

try {

    RSAPrivateKeySpec keySpec = new RSAPrivateKeySpec(signModulus, signExponent);
    KeyFactory fact = KeyFactory.getInstance("RSA");
    PrivateKey privKey = fact.generatePrivate(keySpec);

    Signature s = Signature.getInstance("SHA1withRSA");
    s.initSign(privKey);

    s.update(data);

    return s.sign();
}

return cipherData;
}

在这里我尝试验证签名:

public boolean rsaVerify (byte[] data, byte[] signature) {

boolean success = false;

try {

    RSAPublicKeySpec keySpec = new RSAPublicKeySpec(signModulus, signPublicExponent);
    KeyFactory fact = KeyFactory.getInstance("RSA");
    PublicKey pubKey = fact.generatePublic(keySpec);

    Signature s = Signature.getInstance("SHA1withRSA");
    s.initVerify(pubKey);

    s.update(data);

    success = s.verify(signature);

    return success;

} 

return false;
}

有人能看出问题吗？ key 在 C# 中生成并在 java 中转换为 BigIntegers。

Answer 1

签名验证失败，因为您在验证方法中使用了不同的公钥。使用公钥验证签名是否与rsaSign()方法中使用的私钥一致。

希望对您有所帮助。请注意，此公钥与签名生成方法中使用的私钥是一致的:

/**
     * This method will sign message with RSA 2048 key
     * @return Void
     */
    public void rsaSign (String message) throws Exception {
        //key generation
        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
        SecureRandom random = SecureRandom.getInstance("SHA1PRNG", "SUN");
        keyGen.initialize(2048, random);

        KeyPair keyPair = keyGen.generateKeyPair();
        PrivateKey priv = keyPair.getPrivate();
        PublicKey pub   = keyPair.getPublic();

        System.out.println("RSAPub key Mod for Sign/Verify  : " + Helper.toHex(((RSAPublicKey)pub).getModulus().toByteArray()));
        System.out.println("RSAPub key Exp for Sign/Verify  : " + Helper.toHex(((RSAPublicKey)pub).getPublicExponent().toByteArray()));

        //sign
        Signature dsa   = Signature.getInstance(signALG);
        dsa.initSign(priv);

        dsa.update(Helper.toByte(message));
        byte[] realSig = dsa.sign();
        System.out.println("RSA Sign-Data   : " + Helper.toHex(realSig));
    }


/**
     * This method verify signature with RSA public key
     * @param message The plain message
     * @param rsaMOD RSA Public key Modulus in string
     * @param rsaEXP RSA Public key Exponent in string
     * @param rsaSignData Signature which will be verified
     * @return true if verifications success, false otherwise
     */
    public boolean rsaVerify(String message, String rsaMOD, String rsaEXP, String rsaSignData) throws Exception {
        BigInteger modBigInteger = new BigInteger(Helper.toByte(rsaMOD));
        BigInteger exBigInteger = new BigInteger(Helper.toByte(rsaEXP));

        RSAPublicKeySpec spec = new RSAPublicKeySpec(modBigInteger, exBigInteger);
        KeyFactory factory = KeyFactory.getInstance("RSA");
        PublicKey publicKey = factory.generatePublic(spec);

        Signature signature = Signature.getInstance(signALG);
        signature.initVerify(publicKey);
        signature.update(Helper.toByte(message));

        return signature.verify(Helper.toByte(rsaSignData));
    }