Android verify signature always returns false

Question

I'm trying to verify some signed content using ECDSA and spongycastle. Here is the code I'm using to generate the keypair with the brainpoolP512t1 ec curve:

public static KeyPair getKeyPairbrainpoolP512t1() throws Exception {
    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC", "SC");
    ECNamedCurveParameterSpec curveParameterSpec = ECNamedCurveTable.getParameterSpec("brainpoolP512t1");
    keyPairGenerator.initialize(curveParameterSpec, new SecureRandom());
    return keyPairGenerator.generateKeyPair();
}

Here is the code I'm using to sign and verify signatures:

private byte[] ecdsaSign(ECPrivateKey key, byte[] content) throws Exception {
    Signature ecdsaSign = Signature.getInstance("SHA256withECDSA", "SC");
    ecdsaSign.initSign(key);
    ecdsaSign.update(content);
    byte[] signature = ecdsaSign.sign();

    return signature;
}

public static boolean ecdsaVerify(ECPublicKey key, byte[] content, byte[] signature) throws Exception {
    Signature ecdsaVerify = Signature.getInstance("SHA256withECDSA", "SC");
    ecdsaVerify.initVerify(key);
    ecdsaVerify.update(content);
    boolean result = ecdsaVerify.verify(signature);
    return result;
}

I'm passing in the bytes of a simple string message that was signed using the private key, and also the public key in order to verify. I'm always getting false however. What am I doing wrong? Any help is deeply appreciated.

score 0 · Answer 1 · answered Jan 17 '18 at 21:44

Figured out what was wrong. I was exporting the keys to PEM in order to have them in string format prior to calling sign and verify, and then decoding back to private key original format. When I omitted this conversion and called Verify directly with the private key (without the PEM string back and forth conversion), the content got verified.

Android verify signature always returns false

1 Answers1