Verify certificate using Bouncycastle (J2ME)

May be problem is in encoding of TBS structure that I'm getting with

byte[] tbs_byte = tbs.getEncoded()?

If I'm not mistaken, PKIX standarts expect from TBS structure to be in DER encoding. TBSCertificateStructure.getEncoded() and TBSCertificateStructure.getDEREncoded() return equal byte arrays.

Is there some opportunity to solve this problem? May be I'm getting wrong with TBS structure, and I have to extract objects from it and build some special object? I dont know what I'm doing wrong.

nx_a at 2007-7-13 20:54:48 >

I found example code here: http://www-128.ibm.com/developerworks/library/j-midpds.html

Below is that code pieced together with some minor fixes (seems they

had outdated calls to verifySignature() and generateSignature()).

This program runs and returns true for me. Maybe this can

help you figure out what's going on with your code...

import java.math.BigInteger;

import java.security.SecureRandom;

import org.bouncycastle.crypto.AsymmetricCipherKeyPair;

import org.bouncycastle.crypto.digests.SHA1Digest;

import org.bouncycastle.crypto.engines.RSAEngine;

import org.bouncycastle.crypto.generators.RSAKeyPairGenerator;

import org.bouncycastle.crypto.params.RSAKeyGenerationParameters;

import org.bouncycastle.crypto.params.RSAKeyParameters;

import org.bouncycastle.crypto.params.RSAPrivateCrtKeyParameters;

import org.bouncycastle.crypto.signers.PSSSigner;

import org.bouncycastle.util.encoders.Base64;

public class RSASigBCLW {

private static BigInteger pubExp = new BigInteger("11", 16);

private static RSAPrivateCrtKeyParameters privKey;

private static RSAKeyParameters pubKey;

public static void main(String[] args) {

try {

_main(args);

} catch (Exception e) {

System.out.println("ERROR: " + e.getMessage());

}

}

/**

* @param args

*/

public static void _main(String[] args) throws Exception {

SecureRandom sr = new SecureRandom();

RSAKeyGenerationParameters RSAKeyGenPara = new RSAKeyGenerationParameters(

pubExp, sr, 1024, 80);

RSAKeyPairGenerator RSAKeyPairGen = new RSAKeyPairGenerator();

RSAKeyPairGen.init(RSAKeyGenPara);

AsymmetricCipherKeyPair keyPair = RSAKeyPairGen.generateKeyPair();

privKey = (RSAPrivateCrtKeyParameters) keyPair.getPrivate();

pubKey = (RSAKeyParameters) keyPair.getPublic();

String message = "this is a test message.";

String signature = getSignature(message);

boolean b = verify(message, signature, getMod(), getPubExp());

System.out.println("verify? =" + b);

}

// Public key specific parameter.

public static String getMod() throws Exception {

return (new String(Base64.encode(pubKey.getModulus().toByteArray())));

}

// General key parameter. pubExp is the same as pubKey.getExponent()

public static String getPubExp() throws Exception {

return (new String(Base64.encode(pubExp.toByteArray())));

}

static public String getSignature(String mesg) throws Exception {

SHA1Digest digEng = new SHA1Digest();

RSAEngine rsaEng = new RSAEngine();

PSSSigner signer = new PSSSigner(rsaEng, digEng, 64);

signer.init(true, privKey);

byte[] mbytes = mesg.getBytes();

signer.update(mbytes, 0, mbytes.length);

byte[] sig = signer.generateSignature();

String result = new String(Base64.encode(sig));

return result;

}

static public boolean verify(String mesg, String signature, String mod, String pubExp) {

BigInteger modulus = new BigInteger(Base64.decode(mod));

BigInteger exponent = new BigInteger(Base64.decode(pubExp));

SHA1Digest digEng = new SHA1Digest();

RSAEngine rsaEng = new RSAEngine();

RSAKeyParameters pubKey = new RSAKeyParameters(false, modulus, exponent);

PSSSigner signer = new PSSSigner(rsaEng, digEng, 64);

signer.init(false, pubKey);

byte[] mbytes = mesg.getBytes();

signer.update(mbytes, 0, mbytes.length);

boolean res = signer.verifySignature(Base64.decode(signature));

return res;

}

}

cdelikata at 2007-7-13 20:54:48 >

Hello i tried using the code below which was provided above but i get an

Uncaught exception java/lang/NoClassDefFoundError: org/bouncycastle/asn1/DERObject. error.

I use the netbeans obfuscator. can somebody please help

byte[] cert_decoded = Base64.decode(pem_cert);

ASN1InputStream ais = new ASN1InputStream(cert_decoded);

DERObject obj = ais.readObject();

ASN1Sequence seq = (ASN1Sequence)obj;

ais.close();

X509CertificateStructure cert = new X509CertificateStructure(seq);

// getting certificate signature

byte[] signature = cert.getSignature().getBytes();

// trying to get "to be signed" structure

TBSCertificateStructure tbs = cert.getTBSCertificate();

// is it correct? trying to get bytes array of TBS..

byte[] tbs_byte = tbs.getEncoded();

RSAEngine engine = new RSAEngine();

// Is it correct? Cert uses "RSAwithSHA1"..

SHA1Digest digest = new SHA1Digest();

// Public key i'v got before from signing CA cert...

PSSSigner signer = new PSSSigner(engine, digest, 0);

signer.init(false, pub);

signer.update(tbs_byte, 0, tbs_byte.length);

boolean istrue = signer.verifySignature(signature);

Can somebody please help.

princa at 2007-7-13 20:54:48 >