虽然正在使用正确的公钥和签名文件，但签名未验证

Question

虽然我使用正确的签名文件和公钥，但下面的类中的结果变量始终返回false。

public class VeriGen { 

    static FileInputStream fin; 

    public static void main(String args[]) throws Exception { 
     Security.addProvider(new BouncyCastleProvider()); 

     KeyStore msCertStore = KeyStore.getInstance("Windows-MY", "SunMSCAPI"); 
     msCertStore.load(null, null); 
     X509Certificate c = ((X509Certificate) msCertStore.getCertificate("Software View Certificate Authority")); 
     PublicKey pubKey = c.getPublicKey(); 


     File file = new File("C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\ProcessExplorer.zip"); 
     fin = new FileInputStream(file); 
     byte fileContent[] = new byte[(int) file.length()]; 

     File signedData = new File(
       "C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\SignedProcessExplorer.sig"); 
     fin = new FileInputStream(signedData); 
     byte signedContent[] = new byte[(int) signedData.length()]; 

     boolean result = verifySig(fileContent, pubKey, signedContent); 
     System.out.println("result is : " + result); 
    } 

    public static boolean verifySig(byte[] data, PublicKey key, byte[] sig) throws Exception { 
     Signature signer = Signature.getInstance("SHA1WithRSA", "BC"); 
     signer.initVerify(key); 
     signer.update(data); 
     return (signer.verify(sig)); 

    } 
} 

下面是我用来签署文件的代码。

public class SigGen { 

    static final String KEYSTORE_FILE = "C:\\Users\\mayooranM\\Desktop\\x.509-sample-keys-and-certificates\\generation-tool\\swviewca.p12"; 
    static final String KEYSTORE_INSTANCE = "PKCS12"; 
    static final String KEYSTORE_PWD = "swviewcastoresecret"; 
    static final String KEYSTORE_ALIAS = "swviewca"; 
    static FileInputStream fin = null; 

    public static void main(String args[]) throws Exception { 
     Security.addProvider(new BouncyCastleProvider()); 

     File file = new File("C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\ProcessExplorer.zip"); 
     fin = new FileInputStream(file); 
     byte fileContent[] = new byte[(int) file.length()]; 

     KeyStore ks = KeyStore.getInstance(KEYSTORE_INSTANCE); 
     ks.load(new FileInputStream(KEYSTORE_FILE), KEYSTORE_PWD.toCharArray()); 
     Key key = ks.getKey(KEYSTORE_ALIAS, KEYSTORE_PWD.toCharArray()); 

     // Sign 
     PrivateKey privKey = (PrivateKey) key; 
     byte[] signedData = signData(fileContent, privKey); 

     FileOutputStream fos = new FileOutputStream(
       "C:\\Users\\mayooranM\\Desktop\\SignatureVerificationTest\\SignedProcessExplorer.sig"); 
     fos.write(signedData); 
     fos.close(); 

    } 

    public static byte[] signData(byte[] data, PrivateKey key) throws Exception { 
     Signature signer = Signature.getInstance("SHA1WithRSA", "BC"); 
     signer.initSign(key); 
     signer.update(data); 
     return (signer.sign()); 
    } 


} 

我在这里做错了什么？请指教。

Answer 1

在你发布的代码中，它看起来像你从来没有真正阅读过这个文件; fin已分配但从未使用，并且signedContent和fileContent数组已创建，但从未填充过。