Java Python Message Signature and Verification

Question

My server is coded in Python and I am making a java client for this server.

I am Signing a message(data) using:

public static byte[] Sign(PrivateKey privateKey, byte[] data) throws Exception{
        System.out.println("Signing the key inside RSACrypto#Sign");
        Signature dsa = Signature.getInstance("SHA1withRSA");

        SecureRandom secureRandom =null;
        dsa.initSign(privateKey,secureRandom);
        dsa.update(data);
        return dsa.sign();
}

This returns a byteArray(named signed_data) , now I am encoding this signature using Base64.encodeBase64 and converting the byteArray(named my_byte_array) so formed into string using :

String str = new String(my_byte_array)

and sending this string to Server.

On server side, I receive this string , then Server verifies the signature using:

publicKey.verify(str(data), (long(base64.b64decode(my_byte_array)),))

using library http://gdata-python-client.googlecode.com/hg/pydocs/gdata.Crypto.PublicKey.RSA.html

when I try to print my_byte_array on both side they are same, and so is signed_data and base64.b64decode(my_byte_array)

but I am getting this error:

ValueError: invalid literal for long() with base 10: '\x8b\xa1\xbb\x19fO\xea\xe7\xa4B\xd4\xd2\xa1\xe3\xb9\xd0\x89n\xa2\xfe\xb5\xedsL\x02\xba\xad\x12!qjp\x0c%+Z\t\xa7\x12\x08\x90\xfaTk\xca\xd0\xae\xd8\xa9\xfa\xbb]>9\x1c\x80\xd0

As far as I can think, this error is arising because Java signs the message into byte and python expects it to be in Long.

Is there a way to solve this problem?

SquareRootOfTwentyThree · Accepted Answer · 2012-07-01 15:37:44Z

1

You have actually 2 problems.

The first one is that - according to the Java Cryptograpy Architecture API - the SHA1withRSA algorithm involves PKCS#1 v1.5 padding. At the Python side, you must use the same padding scheme to verify the signature; that can be achieved with PyCrypto's PKCS#1 v1.5 signature module (Crypto.Signature.PKCS1_v1_5).

The second problem is the one you point out: the verify method of an RSA PyCrypto object oddly requires the signature to be encoded as an integer. However, by using the module I mentioned above, the problem will go away, since it accepts byte strings.

answered Jul 1, 2012 at 15:37

SquareRootOfTwentyThree

7,79636 silver badges44 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

d34th4ck3r Over a year ago

is there any way to achieve this with NoPadding, on both Java and Python side ?

SquareRootOfTwentyThree Over a year ago

@d34th4ck3r There is a way, but padding is what makes an RSA signature secure, so it should always be used.

d34th4ck3r Over a year ago

Thanks, but on trying your method, verification always leads to false :(, Here is my code: gist.github.com/3036062

SquareRootOfTwentyThree Over a year ago

@d34th4ck3r It would help if your examples included the public key the signature and the sample data.

d34th4ck3r Over a year ago

I isolated this part of my code , on running it in pure java it seems to work fine, but when I am running the same code in android it always returns false.

|

Collectives™ on Stack Overflow

Java Python Message Signature and Verification

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related