Question

I would like to begin with the fact that before a few days i did not have any knowledge about signing and verifying data until we got this exception.

There is a droid application that runs on a mobile phone(lets call it PA as in Phone App) which communicates with a REST API project remotely (lets call this RA). PA signs all data using the RSAKey API (http://www9.atwiki.jp/kurushima/pub/jsrsa/) and PA verifies using the Signature Class in java. Obviously, there are private and public keys involved.

PA to RA works smoothly on my local box and fails when the communication is to RA being on actual test server. Please note my local box is Windows and test server Unix.

The reason is simple – the verify method(http://download.oracle.com/javase/1.4.2/docs/api/java/security/Signature.html#verify(byte%5B%5D)) of Signature class just returns false. But the question is why? Why if it works on my local box?

Any help would be appreciated. Thanks.

Answer 1

I don’t know what Strelok meant above but the issue is resolved.

The problem was that the URL that was being signed had a host name in it and it passed through apache before it reached the rest api. Apache settings changed the hostname to ip address. So the URL that was signed was different from what was being verified.

By changing the apache settings the issue was resolved.

Thanks for reading.