File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
http://aspose.com/file-tools
The moose likes Security and the fly likes different RSA key size generates  a digital signature with the same charachter lengeth?!! Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Engineering » Security
Bookmark "different RSA key size generates  a digital signature with the same charachter lengeth?!!" Watch "different RSA key size generates  a digital signature with the same charachter lengeth?!!" New topic
Author

different RSA key size generates a digital signature with the same charachter lengeth?!!

Rob Lee
Greenhorn

Joined: Jun 03, 2012
Posts: 12
Hello, new member over here with a noob question

I have the following Simple code to generate a digital signature, as far as I can understand only a hash of the message get encrypted but when I change the key size I still get the same length of characters in the digital signature! below is the code:



the output is:
Singature:[B@10b4199
true

but when changing the key size to 2048 the output has the same length!



the output this time is
Singature:[B@13a328f
true

I was expecting the digital signature length to increase but only the processing time has(which just natural), why is that?

thanks in advance
Rob Lee
Greenhorn

Joined: Jun 03, 2012
Posts: 12
up!
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 42263
    
  64
Please read PatienceIsAVirtue and UseCodeTags. I have applied the latter for you.


Ping & DNS - my free Android networking tools app
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 42263
    
  64
You seem to assume that "sig.verify(signatureBytes).toString()" returns something useful; obviously, it does not.
Rob Lee
Greenhorn

Joined: Jun 03, 2012
Posts: 12
Hello Dittmer,

Thank you for your reply

You seem to assume that "sig.verify(signatureBytes).toString()" returns something useful; obviously, it does not.
well that is not included in the code above, but anyway the result is"true"

My question is basically why the signature length has not increased when I changed the key size from 1024 to 2048?

Wikipedia says"If the unlock/decryption key is the one published then the system serves as a signature verifier of documents locked by the owner of the private key. Although in this latter case, since encrypting the entire message is relatively expensive computationally, in practice just a hash of the message is encrypted for signature verification purposes."

so my understanding is the message will be hashed to a fixed character length no matter how long the message is(which is 32 characters using MD5). Then this hash will get encrypted (RSA encryption) in my example. I have tried both key sizes and still got the same length of characters in the signature, I was expecting it to increase by using 2048 bit but it has not(the output is 10 characters long regardless of the size of the key) and this is what is puzzling me.

Can you please clarify what I am missing/misunderstanding?
Ulf Dittmer
Marshal

Joined: Mar 22, 2005
Posts: 42263
    
  64
You seem to assume that "sig.verify(signatureBytes).toString()" returns something useful; obviously, it does not.
well that is not included in the code above

Sorry about that, copy/paste error. That should have read:

You seem to assume that "Base64.encodeBase64(signatureBytes).toString()" returns something useful; obviously, it does not.
Rob Lee
Greenhorn

Joined: Jun 03, 2012
Posts: 12
Sorry about that, copy/paste error. That should have read:

You seem to assume that "Base64.encodeBase64(signatureBytes).toString()" returns something useful; obviously, it does not.


Make as much errors as you want mate.....I am here to benefit from your experience not the opposite

still in the code I did not include the(.toString()). I have only used the Apache encoding scheme which has outputted the signature and the rest of the code has verified it with the public key to be true(matching).

I feel that you have not understood my question because it has nothing to do with your appreciated response. I repeat my question is why the signature character length has not increased when using a bigger key? it is the encryption of the fixed length hash what I mean.

Please be more generous by responding with a bit more lengthy explanation. I am a beginner and I do not understand the hints behind those"telegraphic responses"


Tim Moores
Rancher

Joined: Sep 21, 2011
Posts: 2408
still in the code I did not include the(.toString()).

Yes, you did. That's what System.out.println does - it calls the toString method. Sometimes that method returns something useful, but in this case it doesn't. It certainly does not do what you would have liked to happen, which is to print the contents of the byte[]. You need to find some other way of examining what the result contains - maybe assign it to a variable, and then look at its length and contents.

I am a beginner

I don't mean to sound rude, but that being the case you should not be in charge of implementing security. It's all too easy to put in place insecure systems, especially if you come by them in a trial-and-error approach.
Rob Lee
Greenhorn

Joined: Jun 03, 2012
Posts: 12
Hello Tim,

thank you very much now I understand what I have been doing wrong. I am very pleased thank you again. here is the code if someone encounter the same problem. please note that this is a just a simple example!



Now I do get different results from different sizes of key.

I don't mean to sound rude, but that being the case you should not be in charge of implementing security. It's all too easy to put in place insecure systems, especially if you come by them in a trial-and-error approach.


No am not in charge. I have BSC in information Systems(more oriented towards the people and the business side of computing). but recently I have applied for a job in a company that's main operation is securing data and voice communication for some international military organizations. it is a junior job but I wanted to study about cryptography to ease up the training period and make a good impression(i hope so). My main problem is that I am from Sudan and we have no access for those in-depth materials.Moreover because of the U.S embargo in Sudan we are not permitted to download java from oracle website but fortunately I have used some proxies to do so.

anyway thank you very much for your help. I really do appreciate it
 
I agree. Here's the link: http://aspose.com/file-tools
 
subject: different RSA key size generates a digital signature with the same charachter lengeth?!!