Problem signing data

Question

Hi,
I have the following code snippet. The signing of a 256 byte(2048 bit input stream) fails. The exception that I catch is ILLEGAL USE. I am just straight away passing the input stream for signing without any preprocessing of the i/p steam.
However, the signing fails. Anybody, who is familiar with this problem please help.
The code:
try{
          privKey = (RSAPrivateKey) KeyBuilder.buildKey(KeyBuilder.TYPE_RSA_PRIVATE, keySize, false);
     privKey.setExponent(privExponent, (short)0, (short)256);
     privKey.setModulus(privModulus, (short)0, (short)256);
     catch(CryptoException e){
if (e.getReason() == CryptoException.NO_SUCH_ALGORITHM)
ISOException.throwIt(ALGO_ERROR);
          else
if (e.getReason() == CryptoException.ILLEGAL_VALUE)
ISOException.throwIt(ILL_VAL);
          else
ISOException.throwIt(KEYGEN_FAILED);
     try{
     signature = Signature.getInstance(Signature.ALG_RSA_SHA_PKCS1, false);
          signature.init(privKey, Signature.MODE_SIGN);
          }catch(CryptoException e)
               ISOException.throwIt(SIGNINIT_ERROR);
     try{
          outputlen = signature.sign(buf, (short) 0, (short)length, outbuf, (short) 0);
          }catch(CryptoException e)
          if (e.getReason() == CryptoException.UNINITIALIZED_KEY)
ISOException.throwIt(ALGO_ERROR);
          else
if (e.getReason() == CryptoException.ILLEGAL_USE)
ISOException.throwIt(ILL_VAL);
          else
ISOException.throwIt(SIGNATURE_FAILED);
          }

Answer 1

Sorry, my previous post was a little inaccurate. The limitation is on RSA encryption. For a signature, your data is hashed (using SHA1 in this instance) and this hash is then encrypted with the private key.
What happens if you try to sign a few bytes (say 8)? Your code looks fine to me. I have tried something similar myself and it works. I use CRT keys as my card does not support non-crt private keys (that could even be part of the problem but I would expect the key building to fail then). You can try checking the key is initialised first (privKey.isInitialized())?
package oracle.forum;
import javacard.framework.APDU;
import javacard.framework.Applet;
import javacard.framework.ISO7816;
import javacard.framework.ISOException;
import javacard.security.KeyBuilder;
import javacard.security.KeyPair;
import javacard.security.Signature;
* @author sfarmer
public class Dummy extends Applet {
     public final static boolean ECHO = true;
     private Signature sig;
     private KeyPair keys;
     public Dummy() {
          sig = Signature.getInstance(Signature.ALG_RSA_SHA_PKCS1, false);
          keys = new KeyPair(KeyPair.ALG_RSA_CRT, KeyBuilder.LENGTH_RSA_2048);
          keys.genKeyPair();
     public static void install(byte[] bArray, short bOffset, byte bLength) {
          // GP-compliant JavaCard applet registration
          new oracle.forum.Dummy().register(bArray, (short) (bOffset + 1),
                    bArray[bOffset]);
     public void process(APDU apdu) {
          // Good practice: Return 9000 on SELECT
          if (selectingApplet()) {
               return;
          short lc = apdu.setIncomingAndReceive();
          byte[] buf = apdu.getBuffer();
          switch (buf[ISO7816.OFFSET_INS]) {
          case (byte) 0x00:
               sig.init(keys.getPrivate(), Signature.MODE_SIGN);
               short len = sig.sign(buf, ISO7816.OFFSET_CDATA, lc, buf, (short) 0);
               apdu.setOutgoingAndSend((short) 0, len);
               break;
          default:
               // good practice: If you don't know the INStruction, say so:
               ISOException.throwIt(ISO7816.SW_INS_NOT_SUPPORTED);
}Cheers,
Shane