Home/ Questions/Q 6120855
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T15:42:58+00:00

I am trying to digitally sign an http – web response. Essentially, I create

  • 0

I am trying to digitally sign an http – web response. Essentially, I create the HTML and multipart content-type response, sign the response then append the digital signature to the response. I think I am close but off a few steps as this is not a true PGP signature since the appended signature is actually HEXtoString. Big thing is to be able to represent the signature correctly so that response can be interpreted correctly. Could use some suggestions here as I am fairly green with this. Thanks in advance.. below is snippets of code I am using now.

    StringBuffer myResponse = new StringBuffer("");
            myResponse.append(getHttpHeader());
            KeyPair pair2 = loadKeyPair();//loads a key pair from generated files

    if (signer==null)
        signer = Signature.getInstance("MD5withRSA");
    signer.initSign(pair2.getPrivate());
    signer.update(message.getBytes());
    byte[] b = signer.sign();
    FileOutputStream sigfos = new FileOutputStream(getFileLocation(0,localTest));
    sigfos.write(b);
    sigfos.close();
    //verify
    signer.initVerify(pair2.getPublic());//pubKey);
    signer.update(message.getBytes());
    if (signer.verify(b)){
        myResponse.append(message);
    }

    StringBuffer signed= new StringBuffer("");
    signed.append(boundary);
    signed.append(CRLF);
    signed.append("content-type: application/pgp-signature");
    signed.append(CRLF);
    signed.append("-----BEGIN PGP MESSAGE-----");
    signed.append(CRLF);
    signed.append("Version: 1");//update this
    signed.append(CRLF);
    signed.append(CRLF);

    signed.append(digSignature);//generated as HexString representation of signed file from above
    signed.append(CRLF);

    signed.append("-----END PGP MESSAGE-----");
    signed.append(CRLF);
    signed.append(boundary+"--");

            myResponse.append (signed);
            ServletOutputStream.println(myResponse);

The resulting “signature” that is transmitted is a byte-hashing hexToString representation of the signed files. I am using standard java classes, but not sure if other libraries would give me a true PGP representation with characters outside of the 0-9a-f representation. ideas??

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This issue is due to a NAESB-EDI standard. Where a file has been submitted in an http request and we are required to produce a particular response. We are using SSL and the original payload is supposed to be encrypted. The response is plain html (of 4 items) with an additional digital signature of the response. What I have figured to do is to create the response, have existing pgp software create the signature based upon the generated response and then append the signature to the response. Thus I am not using MD5 anymore and I am not exposing keys to public use (except to those that we specifically trade). So James answer is partially correct and without SSL, this offers little if any protection against sniffing since the response is clear text. Yet without the required information in the request, they would not even get a proper response. Likely wouldnt get a response (let alone a proper one).

    • 0