Please help I am stuck at "not a DSA public key"

Question

Hi
I am just starting with the certificate/security API so this may be a naive question. I have a certificate,private key signature & data from a third-party. I am using following program to verify the signature.
import java.io.*;
import java.security.*;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.spec.*;
import java.util.Collection;
import java.util.Iterator;
class VerSig {
    public static void main(String[] args) {
        /* Verify a DSA signature */
        if (args.length != 3) {
            System.out.println("Usage: VerSig publickeyfile signaturefile datafile");
        else try{
            InputStream inStream = new FileInputStream(args[0]);
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            Collection c = cf.generateCertificates(inStream);
            Iterator i = c.iterator();
            X509Certificate cert = null;
            while (i.hasNext()) {
                cert = (X509Certificate)i.next();
            inStream.close();
            PublicKey pubKey = null;
            if (cert != null)
                pubKey = cert.getPublicKey();
            // create a Signature object and initialize it with the public key
            Signature sig = Signature.getInstance("SHA1withDSA","SUN");
            sig.initVerify(pubKey);
            // Update and verify the data
            FileInputStream datafis = new FileInputStream(args[2]);
            BufferedInputStream bufin = new BufferedInputStream(datafis);
            byte[] buffer = new byte[1024];
            int len;
            while (bufin.available() != 0) {
                len = bufin.read(buffer);
                sig.update(buffer, 0, len);
            bufin.close();
            //input the signature bytes
            FileInputStream sigfis = new FileInputStream(args[1]);
            byte[] sigToVerify = new byte[sigfis.available()];
            sigfis.read(sigToVerify );
            sigfis.close();
            boolean verifies = sig.verify(sigToVerify);
            System.out.println("signature verifies: " + verifies);
        } catch (Exception e) {
            System.err.println("Caught exception " + e.toString());
} First of all :
1) I wrote "Signature sig = Signature.getInstance("SHA1withDSA","SUN");" because somewhere in the certificate, I saw Signature Algorithm: SHA1withDSA. Is this correct?
2)I am getting following exception after
Signature sig = Signature.getInstance("SHA1withDSA","SUN");"
sig.initVerify(pubKey);
Caught exception java.security.InvalidKeyException: not a DSA public key: algorithm = SHA1withDSA, params unparsed, unparsed keybits =
0000: 02 41 00 91 89 17 2D 83 2D 19 51 96 8F D3 A7 CE .A....-.-.Q.....
0010: 33 E7 B0 1F 6C 79 F4 91 3E B5 5E 81 92 42 65 BA 3...ly..>.^..Be.
0020: 56 F8 8B F4 FF 54 4F D6 ED 38 A4 71 BD BE D4 69 V....TO..8.q...i
0030: 21 02 E3 CD 48 96 BC B3 14 F4 42 90 4D 38 5C 78 !...H.....B.M8\x
0040: D3 26 58 .&X
what am I doing wrong?

Answer 1

Hi,
I am getting the same issue using JDK 1.4.2 regarding the "not a DSA public key" error.
I also tried using Bouncy Castle instead, but also fail at the verify step (although with a slightly different error):
"java.security.NoSuchAlgorithmException: no such algorithm: SHA
1with1.3.14.3.2.27 for provider BC"
My initial attempt using the Sun classes looks very much like the original example above. My Bouncy Castle implementation looks like:
Provider bc = new BouncyCastleProvider();
Security.insertProviderAt( bc, 1 );
try
// read PKCS#7 data from input stream
CMSSignedData sig = new CMSSignedData( request.getInputStream() );
CertStore certs = sig.getCertificatesAndCRLs( "Collection", "BC" );
SignerInformationStore signers = sig.getSignerInfos();
Collection c = signers.getSigners();
Iterator it = c.iterator();
while (it.hasNext())
SignerInformation signer = (SignerInformation)it.next();
Collection certCollection = certs.getCertificates( signer.getSID() );
Iterator certIt = certCollection.iterator();
X509Certificate cert = (X509Certificate)certIt.next();
logger.debug( "Cert = " + cert );
logger.debug( "Cert Sig Alg = " + cert.getSigAlgName() );
logger.debug( "Pub Key Alg = " + cert.getPublicKey().getAlgorithm() );
if ( signer.verify( cert, "BC" ) )
logger.debug( "Verified!" );
else
logger.debug( "Not verified." );
catch( Exception e )
e.printStackTrace();
return e.getMessage();
and provides the following output:
2006-04-26 14:06:46,882 - Cert =
[0] Version: 1
SerialNumber: 0
IssuerDN: CN=ID3
Start Date: Tue Sep 30 20:00:00 EDT 1997
Final Date: Thu Dec 31 19:00:00 EST 2037
SubjectDN: CN=ID3
Public Key: DSA Public Key
y: 9189172d832d1951968fd3a7ce33e7b01f6c79f4913eb55e81924265ba56f88bf4ff544fd6ed38a471bdbed4692102e3cd4896bcb314f442904d385c78d32658
Signature Algorithm: SHA1withDSA
Signature: 302c0214163774149d7a9ac672aa6beb0af7c5b1
bee965be02144c9bf7da70a24dc644f788a8096e
9ed1f1777741
2006-04-26 14:06:46,882 - Cert Sig Alg = SHA1withDSA
2006-04-26 14:06:46,882 - Pub Key Alg = DSA
06/04/26 14:06:46 java.security.NoSuchAlgorithmException: no such algorithm: SHA
1with1.3.14.3.2.27 for provider BC
06/04/26 14:06:46 at java.security.Security.getEngineClassName(Security.java:723)
06/04/26 14:06:46 at java.security.Security.getEngineClassName(Security.java:693)
06/04/26 14:06:46 at java.security.Security.getImpl(Security.java:1132)
06/04/26 14:06:46 at java.security.Signature.getInstance(Signature.java:218)
06/04/26 14:06:46 at org.bouncycastle.cms.CMSSignedHelper.getSignatureInst
ance(CMSSignedHelper.java:171)
06/04/26 14:06:46 at org.bouncycastle.cms.SignerInformation.doVerify(Signe
rInformation.java:261)
06/04/26 14:06:46 at org.bouncycastle.cms.SignerInformation.verify(SignerInformation.java:494)
...truncated...
I see that the original post is quite old. Was anyone able to figure out the issue? What am I missing?
Thanks,
Brian