Help required on Encryption and Signing.

Question

Hello All,
Client:
Client is having his own Private key and the public key of the Server.
Server:
Server is having his own Private key and the public keys of all the clients.
When a client wants to send a document to the server with both encryption and signed,
then he will encrypt the document with the server's public key and then sign the encrypted document
with his own Private key.
And then sends it to the server.
When the server receives the signed object from the client, he has to verify the signature with
the public key of the client and he has to decrypt the document with the Pirvate key of the server.
How can we verify the signature?
By just saying,
Signature sig = Signature.getInstance("SHA1withRSA");
sig.initVerify(kp.getPublic());
boolean verifies = sig.verify(realSig);
where "realSig" is the signed object.
In this case i am unable to verify the signature. Even if i succeeded here in verifying the signature,
how do i decrypt the signed object.
My question is,
When the client sends signed object to server, does he sends anything else along with it?
Say for example if he sends the encrypted document along with the signed object then if i say,
Signature sig = Signature.getInstance("SHA1withRSA");
sig.initVerify(kp.getPublic());
sig.update(cipherText);
boolean verifies = sig.verify(realSig);
where "cipherText" is the encrypted document.
In this case i am able to verify the document and since i will have the encrypted document
along with the signed object i will decrypt this using the Private key of the server.
So is it must and should that i need to send the encrypted document everytime along with the signed object to the server.
Thanks and have a nice time.

Answer 1

I have two suggestions for you
First read a good book about cryptography. Even using secure cryptographic algorithms is no guarantee that your solution is secure. Without thorough understanding of cryptography and security someone might break in due to some implementation mistake in your security mechanism. My recommendations: "Applied Cryptography" written by Bruce Schneier and "An Introduction to Cryptography (IntrotoCrypto.pdf)" by Phil Zimmermann, Network Associates. This PDF document can be downloaded as part of the free PGP product from http://www.pgp.com, http://www.pgpi.com or http://www.nai.com
Second take a serious look at S/MIME. S/MIME allows information to be wrapped in signed and/or encrypted data blocks in a secure way. The S/MIME standard is around for a few years and has been thoroughly reviewed. Bouncycastle (www.bouncycastle.org) contains an library for creating and handling S/MIME data. Never invent your own formats when a standard is available. More information about S/MIME can be found at RSA labs (www.rsa.com or www.rsalabs.com).