DSA - different results with JDK 1.2.2 and 1.3.1

I have some code which we use to generate digital signatures.

We are looking to migrate JDK from 1.2.2 to 1.3.1. We are limited to these versions because we are using Oracle's JVM. I am getting different results when I run the same code under these different JDKs.

Has anyone got any ideas why this is the case?

The code is as follows:-

import java.io.*;

import java.security.*;

import java.security.spec.*;

import sun.misc.*;

class GenSig4 {

public static void main(String[] args) {

/* Generate a DSA signature */

if (args.length != 2) {

System.out.println("Usage: GenSig1 privateKeyFile nameOfFileToSign");

}

else try {

FileInputStream keyfis = new FileInputStream(args[0]);

byte[] encKey = new byte[keyfis.available()];

keyfis.read(encKey);

keyfis.close();

PKCS8EncodedKeySpec privKeySpec = new PKCS8EncodedKeySpec(encKey);

KeyFactory keyFactory = KeyFactory.getInstance("DSA");

PrivateKey privKey = keyFactory.generatePrivate(privKeySpec);

Signature dsa = Signature.getInstance("SHA1withDSA", "SUN");

dsa.initSign(privKey);

FileInputStream fis = new FileInputStream(args[1]);

BufferedInputStream bufin = new BufferedInputStream(fis);

byte[] buffer = new byte[1024];

int len;

while (bufin.available() != 0) {

len = bufin.read(buffer);

dsa.update(buffer, 0, len);

};

bufin.close();

byte[] realSig = dsa.sign();

/* save the signature in a file */

FileOutputStream sigfos = new FileOutputStream("sig");

sigfos.write(realSig);

sigfos.close();

//

// Get Base64 representation of signature from argument

//

String signature = new String();

BASE64Encoder encoder = new BASE64Encoder();

signature = encoder.encodeBuffer(realSig);

String hexStr="";

System.out.println( signature );

} catch (Exception e) {

System.err.println("Caught exception " + e.toString());

}

}

}

[2069 byte] By [Dustyba] at [2007-10-1 16:30:34]
# 1

What do you mean "getting different results"?

The signature result is not the hash result and is supposed to be differnet each time (even using the same jvm) else the pseudo random generator used is not working proper!!

read http://www.itl.nist.gov/fipspubs/fip186.htm for info if you like.

To get sure they work as they should, and I think the code you posted is allright, kust take the corresponding public key and do a provisional verification right after your signature generation.

babakNa at 2007-7-11 0:48:11 > top of Java-index,Security,Other Security APIs, Tools, and Issues...