Signature failed to verify

Hi there,

I'm having a problem verify a signature using my public key. I get the following error when I run call the method verifies from Signature object:

Verifies = false

My code below any help is much appreciated:

publicstaticvoid main(String[] args)throws Exception{

FileInputStream fis =new FileInputStream("C:\\test.txt");

String strTXT = doLookup("123._cisco.com");

String strPublicKey = strTXT.replaceAll("(?s)^.*p\\=([^;]*);?.*\"$","$1").replaceAll("(?s)\\s","");

System.out.println("strTxt: " + strTXT);

System.out.println("strPublicKey is: " + strPublicKey);

byte [] publicKey = Base64.decode(strPublicKey);

byte [] signature = Base64.decode("dXj0ycQM1ekdhlfO0GfhSXZQsfG0S7jrTv6s0aCFLQLduPW4CwC8UNYnHN6fE5pZU3MPpiYYmmJabR7yg3MQb7AM5HQzm0q+HrJFX86V/SB9Zuhkl37DJegPK8TPMZ0Bsynrp=");

KeyFactory keyFactory = KeyFactory.getInstance("RSA");

X509EncodedKeySpec publicKeySpec =new X509EncodedKeySpec(publicKey);

PublicKey specPublicKey = keyFactory.generatePublic(publicKeySpec);

System.out.println("public key is: " + specPublicKey.getFormat());

System.out.println("pub key algorithm is: " + specPublicKey.getAlgorithm());

//Need to create a Signature object that uses the same signature algorithm to generate

//the signature.

Signature rsa = Signature.getInstance("SHA1WITHRSA");

//initialize the Signature object.

rsa.initVerify(specPublicKey);

System.out.println("publicKey is: " + specPublicKey.toString());

System.out.println("Calling rsa.verify");

/*Supply the Signature Object With the Data to be Verified*/

BufferedInputStream bufins =new BufferedInputStream(fis);

byte[] buffer =newbyte[1024];

int len;

while(bufins.available() !=0){

len = bufins.read(buffer);

rsa.update(buffer, 0, len);

};

bufins.close();

boolean verifies = rsa.verify(signature);

System.out.println("Verifies = " + Boolean.toString(verifies));

Code output:

strTxt: TXT: "g=*; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg8yo6rDhsNiwUfVR37HgF4bWqoG13Nd9XLT+Z0VLzCkWJZOdzGNQnnm7ujoQ8gbxeDvIo9RG5I3eZteBwD91Nf6P/E9lvJQDL2Qnz4EXH/CVW9DeEfvY1UJN9kc6q6KkYEPWssvVvlDOp2slbEKZCJtaPvVuGCAqfaps8J0FjOQIDAQAB"

strPublicKey is: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg8yo6rDhsNiwUfVR37HgF4bWqoG13Nd9XLT+Z0VLzCkWJZOdzGNQnnm7ujoQ8gbxeDvIo9RG5I3eZteBwD91Nf6P/E9lvJQDL2Qnz4EXH/CVW9DeEfvY1UJN9kc6q6KkYEPWssvVvlDOp2slbEKZCJtaPvVuGCAqfaps8J0FjOQIDAQAB

public key is: X.509

pub key algorithm is: RSA

publicKey is: Sun RSA public key, 1024 bits

Calling rsa.verify

Verifies = false

[3820 byte] By [jana.nguyen@gmail.coma] at [2007-11-27 5:09:05]
# 1

Are you sure the signature is valid?

while(bufins.available() !=0) {

len = bufins.read(buffer);

rsa.update(buffer, 0, len);

};

should be

while((len = bufins.read(buffer)) > 0) {

rsa.update(buffer, 0, len);

};

otherwise the final rsa.update() call contains a len of -1. And this is a misuse of available().

ejpa at 2007-7-12 10:28:40 > top of Java-index,Security,Cryptography...
# 2
Hi ejp,Thanks for the prompt response. I made the changes you've specify, but same result :( Verifies failed.I'm not sure if the signature I got is valid, but it should be. I got it from an email sent to me using DKIM-Signature header, the header contains the
jana.nguyen@gmail.coma at 2007-7-12 10:28:40 > top of Java-index,Security,Cryptography...
# 3
Fair enough. What's all that replaceAll() stuff doing to the public key?
ejpa at 2007-7-12 10:28:40 > top of Java-index,Security,Cryptography...
# 4

Hi ejp,

It strips out marks headers such as sstrTxt: TXT: "g=*; k=rsa; t=y; p=

and gives me a bare public key.

For example, the output for public key without the replaceAll call gives me:

strTxt: TXT: "g=*; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg8yo6rDhsNiwUfVR37HgF4bWqoG13Nd9XLT+Z0VLzCkWJZOdzGNQnnm7ujoQ8gbxeDvIo9RG5I3eZteBwD91Nf6P/E9lvJQDL2Qnz4EXH/CVW9DeEfvY1UJN9kc6q6KkYEPWssvVvlDOp2slbEKZCJtaPvVuGCAqfaps8J0FjOQIDAQAB"

Output for public key with the replaceAll call gives me:

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg8yo6rDhsNiwUfVR37HgF4bWqoG13Nd9XLT+Z0VLzCkWJZOdzGNQnnm7ujoQ8gbxeDvIo9RG5I3eZteBwD91Nf6P/E9lvJQDL2Qnz4EXH/CVW9DeEfvY1UJN9kc6q6KkYEPWssvVvlDOp2slbEKZCJtaPvVuGCAqfaps8J0FjOQIDAQAB

jana.nguyen@gmail.coma at 2007-7-12 10:28:40 > top of Java-index,Security,Cryptography...