java - 如何使用 java.security.Signature 进行验证

Question

我已经有了一对公钥和私钥。我如何实际使用 java.security.Signature 来验证我用其中一个 key 签名的字符串？

编辑:

我将两个键都作为字符串。验证方法，其实就是

verify(byte[] signature)

javadoc 说:

verify(byte[] signature) Indicates whether the given signature can be verified using the public key or a certificate of the signer.

在我调用验证方法之前，我如何让该签名识别用于该验证的公钥/私钥？换句话说，我如何将我的字符串键变成可以被签名接受的键对象？

Answer 1

1. 使用 KeyFactory 将关键规范转换为对象。
2. 调用Signature.getInstance(algName)获取签名实例。
3. 使用Signature的initVerify方法关联一个 key 进行签名验证。
4. 使用 update 提供 Signature 字节。
5. 最后，调用verify。
6. 利润

来自KeyFactory文档:

The following is an example of how to use a key factory in order to instantiate a DSA public key from its encoding. Assume Alice has received a digital signature from Bob. Bob also sent her his public key (in encoded format) to verify his signature. Alice then performs the following actions:

X509EncodedKeySpec bobPubKeySpec = new X509EncodedKeySpec(bobEncodedPubKey);
KeyFactory keyFactory = KeyFactory.getInstance("DSA");
PublicKey bobPubKey = keyFactory.generatePublic(bobPubKeySpec);
Signature sig = Signature.getInstance("DSA");
sig.initVerify(bobPubKey);
sig.update(data);
sig.verify(signature);