RSA java签名验证失败

Question

这可能与以下内容重复： Java Signature.verify results in SignatureException: Signature encoding error Caused by IOException: Sequence tag error ，但答案没有回答我的问题。

有这个代码：

String RSA_CIPHER_ALGORITHM = "RSA/ECB/PKCS1Padding";
String RSA_KEY_FACTORY_ALGORITHM = "RSA";
String RSA_SIGNATURE_ALGORITHM = "SHA512withRSA";

KeyFactory keyFactory = KeyFactory.getInstance(RSA_KEY_FACTORY_ALGORITHM);
RSAPublicKey key = (RSAPublicKey)keyFactory.generatePublic(pubKeySpec);

Signature signature = Signature.getInstance(RSA_SIGNATURE_ALGORITHM);
signature.initVerify(key);
signature.update(data);

有这个错误：

java.security.SignatureException: Signature encoding error
at sun.security.rsa.RSASignature.engineVerify(RSASignature.java:204)
at java.security.Signature$Delegate.engineVerify(Signature.java:1219)
at java.security.Signature.verify(Signature.java:652)

...

Caused by: java.io.IOException: Sequence tag error
at sun.security.util.DerInputStream.getSequence(DerInputStream.java:297)
at sun.security.rsa.RSASignature.decodeSignature(RSASignature.java:229)
at sun.security.rsa.RSASignature.engineVerify(RSASignature.java:195)
... 45 common frames omitted

Answer 1

当您的签名确实包含 PKCS#1 compatible padding（第 4 步和第 5 步），但它不包含所用哈希方法的 DER 编码标识符时，通常会发生这种情况。此编码标识符以一个代表 ASN.1 SEQUENCE 的 DER 标签开头（第 1 步和第 2 步）。

您可以使用原始 RSA 密码查看编码：

// setup
Signature sigAlg = Signature.getInstance("SHA512withRSA");
sigAlg.initSign(keyPair.getPrivate());
byte[] signature = sigAlg.sign();

// check padding manually
Cipher rsaRaw = Cipher.getInstance("RSA/ECB/NoPadding");
// encrypt or decrypt is actually the same operation for raw RSA
rsaRaw.init(Cipher.ENCRYPT_MODE, keyPair.getPublic());
byte[] paddedSig = rsaRaw.doFinal(signature);
// using Bouncy Castle's hex encoder, you can use any encoder
System.out.println(Hex.toHexString(paddedSig));

然后您实际上可以看到序列字节（值30，在一大堆FF 字节（填充）和一个值00 的单个字节之后。如果它是当然是一个有效的签名：

0001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff003051300d060960864801650304020305000440cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

您可能只会得到代表哈希值的 64 个字节。