URG: Problem checking signature

Question

Hi there!
Im in a serious problem. I have to use an applet that use MS cryptoAPI to sign with IE some data in client side.
Now i have to develop a servlet that can check if that signature is ok or not, the problem is that signature is not valid! Wow! I am cheking the signature this way:
------------------- BEGIN CODE ---------------------
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
String sign = "MIIE2wY ... yhA=";
String text = "1234567890";
Signature sig = Signature.getInstance( cert.getSigAlgName(), "BC");
sig.initVerify(cert.getPublicKey());
sig.update(texto.getBytes(), 0, texto.getByes().length );
System.out.println(" OK?: " + sig.verify(firma.getBytes() ));
------------------- END CODE ---------------------
Ive heard about problems with compatibility with MS crypto API, but it isnt my choice!!
How could i implement an applet that could sing text in cliente side applet with explorer using a Class 2 certificate instaled in explorer.
Thanks all!
ps: please, it is urgent

Answer 1

Hi,
original_text = "Hello how are you";
sign_text = "some junk values"; // signed value of
original_text
Signature sig = Signature.getInstance( "your
signature", "encoding" );
sig.initVerify( public_key );
sig.update( original_text );
boolean b1 = sign.verify( sign_text );
System.out.println( "Verify result = " + b1 );
There shouldn't be any issues.
You should know that on the applet you have used the
Class 2 certificate as Private Key. Hence you will
need the corresponding Certificate using which you
will generate the PublicKey for verification.
Hope this explains ...
- Nil.Thanks Nil, but I know now what was the problem. I signed the text using a Class 2 certificate in client, with an applet. This applet has been given to me by my boss and it uses "microsoft cryptoapi", so i cant check it directly.
Do you know how to get certificate store in windows os? I think that if i could acces to certificate store with java and not using "MS API" i wouldnt have problems.
To try to get the store i tried this code from Almanac
--------------- BEGIN CODE ----------------
try {
// Load the keystore in the user's home directory
File file = new File(System.getProperty("user.home") + File.separatorChar ".keystore");
FileInputStream is = new FileInputStream(file);
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
String password = "my-keystore-password";
keystore.load(is, password.toCharArray());
// List the aliases
Enumeration enum = keystore.aliases();
for (; enum.hasMoreElements(); ) {
String alias = (String)enum.nextElement();
// Does alias refer to a private key?
boolean b = keystore.isKeyEntry(alias);
// Does alias refer to a trusted certificate?
b = keystore.isCertificateEntry(alias);
is.close();
} catch (java.security.cert.CertificateException e) {
} catch (NoSuchAlgorithmException e) {
} catch (FileNotFoundException e) {
// Keystore does not exist
} catch (KeyStoreException e) {
} catch (IOException e) {
--------------- END CODE ----------------
But i can find the file.
Thanks again.
My email is [email protected].