Unable to verify signature in Java signed using Python

Question

Stuck at this point for last few days. A file is signed in python using pss(RSA) approach. Below is the link for reference: https://pycryptodome.readthedocs.io/en/latest/src/signature/pkcs1_pss.html

At Java client side, while verification, below mentioned approach is used: https://pycryptodome.readthedocs.io/en/latest/src/faq.html#are-rsassa-pss-signatures-compatible-with-java-or-openssl

Signing Approach: A hash value has been generated from the payload and the hash value is signed using pem private key. The signature bytes are then encoded to Base64 and sent to client for verification.

Verification Approach: Initially, a hash value is generated from the payload and then the signature bytes as received from the server side is decoded from Base64 and used for verification.

Both the hash values, viz, sent from Server side and generated at Client side, both are same. However, still the signature is unable to be verified.

Code snippet: Signing in python:

def sign_file(rsa, byte_buffer):
    mgf = lambda x, y: pss.MGF1(x, y, SHA256)
    h = SHA256.new(byte_buffer.getbuffer())
    print("Hash value: " ,h.hexdigest())
    signer = pss.new(rsa, mask_func=mgf, salt_bytes=len(h.digest()))
    print("Salt length: ", signer._saltLen)
    signature = b64encode(signer.sign(h))
    return signature

 # SIGN
    rsa_key = get_key(priv_key_file)
    signature = sign_file(rsa_key, encrypted)

Verification in Java:

public static String verify(String signedData, String signedHash, boolean debug, PublicKey publickey) {
        boolean successFlg = false;
        try {
            Security.addProvider(new BouncyCastleProvider());
            Signature ss = Signature.getInstance("SHA256withRSA/PSS");
            AlgorithmParameters pss1 = ss.getParameters();
            PSSParameterSpec pssParameterSpec = new PSSParameterSpec("SHA-256", "MGF1", new MGF1ParameterSpec("SHA-256"), 32, 1);
            ss.setParameter(pssParameterSpec);
            ss.initVerify(publickey);
            ss.update(signedHash.getBytes());
            successFlg = ss.verify(Base64.getDecoder().decode(signedData.getBytes()));
            if (debug) {
                System.out.println( "signature matched: " + successFlg);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return String.valueOf(successFlg);
    }

Salt length: 32

Generated hash value: 7ff8ce3dab21c615764682394c07fbc858a5713002f68c1fce520a3a93adbecd

Signed Data(as received from Server side)(Base64 encoded) E459mLf2PeAIMPFy4c3md+BT+AFMtDBsoyP1GjDgbMFc72Ccuvy9Y97vrjYJxilfaOtdaCdo8xQWURnaWjEdHRT3VL/A5bfqEata2L2v8DxnD7hPtSr5tRYVRvsTDm5ByJHR9uh0VwQTz19GOjvG/slHMH0uJJXSOpuMB/brZggMUspY87oGDDcL+z1JuI6elVQtw+weP2kWWQ5gIG/+WbT2MXiKptaq0cqq6sG5oQNni42KCUj2+HADqypqdlVuyk02CgYDe69WQwnb90qILdqiqnyIbRlhoT8Du/DHY+N15ShTUBght6oeqj/cfuUeMtVgIdIP3g+gH/JMdl2sdw==

Please help in the case.

Unable to verify signature in Java signed using Python

0 Answers