Win a copy of Re-engineering Legacy Software this week in the Refactoring forum
or Docker in Action in the Cloud/Virtualization forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

OAEP cannot be used to sign or verify signatures

 
Stuart A. Burkett
Ranch Hand
Posts: 679
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
We've been using RSA BSafe as a JCE provider in our product. I've been investigating whether it's possible to remove BSafe and just use the standard JCE implementation included in the JRE. It all works fine apart from one place. I am trying to decrypt an encrypted key. This is the code.



keydata is a byte[] containing random bytes and encodedPublicKey is the encrypted key.

This works fine if we use the BSafe library (or even BouncyCastle) as the JCE provider but if I try using the standard JCE the call to Cipher.init throws up an error
OAEP cannot be used to sign or verify signatures

I googled that message and found the openjdk source code where the init method at line 243 throws this error if the mode is DECRYPT_MODE, the key is an RSAPublicKey and the padding type is not PAD_NONE or PAD_PKCS1.

I'm afraid I'm not an expert on encryption (and the people who wrote the code are not with the company anymore), but I was wondering if there is any way I can change this code but still maintain backwards compatibility i.e. be able to decrypt keys that have been encrypted using the RSA/ECB/OAEPWithSHA1AndMGF1Padding algorithm.

Any thoughts or suggestions are welcome.

Stuart
 
With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic