5 Replies Latest reply: Aug 15, 2011 4:42 PM by EJP RSS

    Signature is corrupted. Could not verify  HELP!

    881186
      Hi,

      i have a big problem i write a small code who creates a PKCS7 signed file. The PKCS7 contains a self signed X509Certificate witch i create with openssl and the PKCS7 contains a Message like "Hello". Second i write a small prog who extracts the Signed Certifiacte and the Message. The Certifcate are checkes against the CA Certifictate witch i also have created witch Openssl.

      If i try to verify the Certificate the complier runs the error Signature is corrupted. Have someone an solutions vor this problem?

      First i create a KeyPair
      Then i create wirh the Key a Certificate Signing Request


      After this i create a Certifiacte but witch key i must use for this to make some certifiacte ?


      thank you
        • 1. Re: Signature is corrupted. Could not verify  HELP!
          EJP
          the complier runs the error Signature is corrupted
          Compilers don't do that. Maybe your program code threw such an exception.

          In which case the data has been corrupted between signing and verifying. By your code.
          • 2. Re: Signature is corrupted. Could not verify  HELP!
            881186
            The data are corrupted in the verifing process in my code.

            i dont unterstand the process of creating a certificate i think my signature of both certificate are for example :

            this is the Signature of the Cert that i packed in the PKCS7 data
            0000: 56 6C 49 40 30 19 CD A4 32 8E FC F9 81 CD 6D 9C VlI@0...2.....m.
            0010: 74 18 DB 64 64 D8 12 14 89 1A B0 51 64 4D 07 E8


            this is the Signature of the CA Cert i save on my localdrive

            0000: A8 3A C5 71 1D C1 23 7B 31 7............. and so on

            i try to do somthing in my code


            Signature sig = Signature.getInstance(algname);
            PublicKey key = this.Certificate.getPublicKey(); // is the public Key of my Cert not the CA
            sig.initVerify(key);
            sig.update(dataSigned); // my Data for example "Hello"

            and then i try somthing :

            if (sig.verify(signerInfo.getEncryptedDigest())) {

            // and here is the problem
            }

            can me anybody explain how i create a CA and the cert that have the rigtht signature?

            greets Leno
            • 3. Re: Signature is corrupted. Could not verify  HELP!
              881186
              have no-one any idea?
              sorry for my bad english : ) .
              shall i explain the problem again ?
              • 4. Re: Signature is corrupted. Could not verify  HELP!
                Arshad Noor
                I would recommend studying this paper - Introduction to Public Key Cryptography - at https://developer.mozilla.org/en/Introduction_to_Public-Key_Cryptography, and then going through the example code at http://www.bouncycastle.org to understand how a CA certificate is created, how an end-entity certificate is created, etc.

                Arshad Noor
                StrongAuth, Inc.
                • 5. Re: Signature is corrupted. Could not verify  HELP!
                  EJP
                  The data are corrupted in the verifing process in my code.
                  I don't know why you think that. It is much more likely that the data has been corrupted between signing and verification. Storing it in a String for example can do that, or a file corruption.

                  Until you show us what happens between signing and verification we may never know.