How to verify PGP detached signature using Bouncycastle

Question

I want to parse and verify an OpenPGP detached signature using Bouncycastle. The signature would be something like this:

And here is how I try to create CMSSignedData in Kotlin:

fun verifyDetached(signatureString: String, dataString: String): Boolean {
    val dataBytes = dataString.toByteArray()
    val signatureBytes = signatureString.toByteArray()
    val processableDataBytes = CMSProcessableByteArray(dataBytes)
    val ci = ContentInfo.getInstance(ASN1Sequence.fromByteArray(signatureBytes))
    val cms = CMSSignedData(processableDataBytes, ci)
    ...
}

When I pass the whole signature block into the function (including -----BEGIN PGP SIGNATURE-----) I get java.io.IOException: unknown tag 13 encountered.

When I remove signature wrappers and just pass in the signature content into the function I get java.io.IOException: Extra data detected in stream at org.bouncycastle.asn1.ASN1Primitive.fromByteArray.

When I directly pass signatureBytes to CMSSignedData constructor I get java.lang.IllegalArgumentException: unknown object in getInstance: org.bouncycastle.asn1.DLApplicationSpecific.

How should I verify this kind of signature using Bouncycastle?

**CMS is completely and totally different from and not related to PGP**. For PGP use the BouncyCastle implementation of PGP in bcpg, NOT the implementation of CMS in bcpkix. See e.g. https://stackoverflow.com/questions/42170230/verification-of-pgp-signature-using-bouncycastle https://stackoverflow.com/questions/57574714/how-to-sign-and-verify-the-file-in-java — dave_thompson_085, Aug 26 '20 at 15:48
Oh Thanks! it seems I confused APIs, I thought CMS API was supposed to handle both detached signatures for PGP and certificates context. thanks for your hint and links. Please post your answer so I can mark it as accepted answer. — Mohammad Rafigh, Aug 26 '20 at 17:49
Done. _Both_ CMS and PGP have detached signatures, but they are unrelated. CMS has either embedded or detached signatures, and the CMS implementation handles both. PGP has either embedded or detached signatures, plus in the armored format 'clearsigned' messages which contain both the data plus a signature in detached format (but since it's with the data not so truly detached), and the PGP implementation handles these. — dave_thompson_085, Aug 28 '20 at 05:21

score 2 · Accepted Answer · answered Aug 28 '20 at 05:18

CMS is completely and totally different from and not related to PGP. For PGP use the BouncyCastle implementation of PGP in bcpg, NOT the implementation of CMS in bcpkix. See e.g. Verification of PGP signature using BouncyCastle and How to sign and verify the file in JAVA .

How to verify PGP detached signature using Bouncycastle

1 Answers1