Question

I want a user to sign a document using asymetric key.

I read the tut here http://docs.oracle.com/javase/tutorial/security/toolfilex/index.html

I don’t understand why the tut requested to put the doc in a jar and afterwards sign the jar. How can I do this at runtime for a user who would upload any document to sign if I need to put it in a jar ?

Is there any other tut from SUN to do a real digital signature ?

Answer 1

Your question is answered in the introduction page of the tutorial. You would indeed use an API rather than the JDK tools (which are designed to sign jar files) to do such a thing in an application, at runtime:

You can use the JDK Security API, tools, or a combination to generate
keys and signatures and to import certificates. You can use these API
or tool features to securely exchange documents with others. To use
the tools for document exchange, the document(s) must be placed in a
JAR (Java ARchive) file, which may be created by the jar tool.

[…]

The Generating and Verifying Signatures shows you how to use the JDK
Security API to sign documents.