Re: Prime239v1 self-signed certificate cannot be verified
David Hook <dgh-rTAZ0PM/[email protected]> Tue, 17 Dec 2019 19:22:36 +1100
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------BD22A7564CDA28028C0712F0
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit
Hi Eric,
Assuming the normal text signing hasn't resulted in anything weird, I'd
say the public key in the certificate is not the one for the private
key. I'd suggest regenerating them to check, it sounds like something is
out of sync.
Regards,
David
On 17/12/19 12:51 am, Eric Tournier wrote:
>
> Hi,
>
>
>
> I tried to sign some text data after issuing a ECDSA prime239v1
> certificate. The verification fails, here is the following code:
>
> Signature ecdsaVerify =
> Signature.getInstance("SHA256withECDSA",
> BouncyCastleProvider.PROVIDER_NAME);
>
> ecdsaVerify.initVerify(certificate.getPublicKey());
>
> ecdsaVerify.update(plaintext.getBytes("UTF-8"));
>
> boolean isValidSignature =
> ecdsaVerify.verify(Base64.decode(signatureAsString));
>
>
>
> The verification of my self-signed certificate with its own private
> key fails in this part of BC code
> (org.bouncycastle.crypto.signers.ECDSASigner):
>
> ECCurve curve = point.getCurve();
>
> if (curve != null)
>
> {
>
> BigInteger cofactor = curve.getCofactor();
>
> if (cofactor != null && cofactor.compareTo(EIGHT) <= 0)
>
> {
>
> ECFieldElement D =
> getDenominator(curve.getCoordinateSystem(), point);
>
> if (D != null && !D.isZero())
>
> {
>
> ECFieldElement X = point.getXCoord();
>
> while (curve.isValidFieldElement(r))
>
> {
>
> ECFieldElement R =
> curve.fromBigInteger(r).multiply(D);
>
> if (R.equals(X))
>
> {
>
> return true;
>
> }
>
> r = r.add(n);
>
> }
>
> return false;
>
> }
>
> }
>
> }
>
>
>
> The debug shows that in the inner while, we cannot find any
> ECFieldEleementR which is equal to X. As I havent any idea of what it
> means (I have to work on mathematical basis of ECDSA) :D I need some
> help :)
>
> The offending certificate is (Base64 format):
>
> -----BEGIN CERTIFICATE-----
>
> MIIBljCCAUGgAwIBAgISESE/0HMzJQ81M17SAVeO0cQmMAoGCCqGSM49BAMCMB0x
>
> GzAZBgNVBAMMEkhTU1Rlc3RUb0JlUmVtb3ZlZDAgFw0xOTA5MDEwMDAwMDFaGA8y
>
> MDU0MDkwMTAwMDAwMVowHTEbMBkGA1UEAwwSSFNTVGVzdFRvQmVSZW1vdmVkMFUw
>
> EwYHKoZIzj0CAQYIKoZIzj0DAQQDPgAEFXHeoI+jd/GHUbdGk/K9BsNkpAMce9AF
>
> DOzYcsoFYFnUyH5O7apm3jGu89b67m1htmzLC4I3AJPsSgUqo2MwYTAPBgNVHRMB
>
> Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBNjAdBgNVHQ4EFgQURoQKwgEzI0rLbwHh
>
> aykbLkF280QwHwYDVR0jBBgwFoAURoQKwgEzI0rLbwHhaykbLkF280QwCgYIKoZI
>
> zj0EAwIDQwAwQAIefcAQYSSqCtoE1waIgQijyZZOC7b3DFub8KP/i4lYAh5ckkpU
>
> cJgDR4UOjk/oa9PSc3I51q/Pv2T9PLoZdeI=
>
> -----END CERTIFICATE-----
>
>
>
> Last, obviously, when the keypair is generated in a soft way, by BC,
> everything works fine.
>
>
>
> Thanks in advance for your ideas and answers
>
> Éric
>
>
>
>
>
> *De :*Eric Tournier [mailto:[email protected]]
> *Envoyé :* vendredi 13 décembre 2019 09:47
> *À :* 'dgh-rTAZ0PM/[email protected]' <dgh-rTAZ0PM/[email protected]>;
> [email protected]
> *Objet :* RE: [dev-crypto] Prime239v1 self-signed certificate cannot
> be verified
>
>
>
> Hi everybody
>
>
>
> Thanks for the answer, David
>
> In fact OpenSSL is the only one which seems to verify the
> certificate without throwing an error, with the following:
>
> #openssl verify -CAfile prime239v1.cer prime239v1.cer
>
> As Im not an OpenSSL guru, I dont know if it is lying or not. In
> fact both BC and SUN say that they cannot verify my self-signed
> certificate with its own public key
>
>
>
> Ill try to sign something with the private key (which is in our
> HSM) and then verifying it. Then I go back here with the results
>
>
>
> Éric
>
>
>
> *De :*David Hook [mailto:dgh-rTAZ0PM/[email protected]]
> *Envoyé :* jeudi 12 décembre 2019 01:56
> *À :* [email protected] <mailto:[email protected]>
> *Objet :* Re: [dev-crypto] Prime239v1 self-signed certificate cannot
> be verified
>
>
>
>
>
> It looks alright to me as well. How are you verifying it in openSSL
> though? I've played around with the openssl verify command and it
> seems I can get it to print OK in a number of situations where I would
> not have expected it. Something clearly is not right here. Have you
> tried using java to sign a short message and then verify it? That
> would at least tell us if it's the signature or the certificate
> encoding that is the issue.
>
>
>
> Regards,
>
>
>
> David
>
>
>
>
>
--------------BD22A7564CDA28028C0712F0
Content-Type: text/html; charset=windows-1252
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Hi Eric,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Assuming the normal text signing hasn't
resulted in anything weird, I'd say the public key in the
certificate is not the one for the private key. I'd suggest
regenerating them to check, it sounds like something is out of
sync.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Regards,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">David</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 17/12/19 12:51 am, Eric Tournier
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:558d6eddb99d46b084f5041aa8098030-LolL45/IeJoIy7AD+B/[email protected]">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Texte brut Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.TextebrutCar
{mso-style-name:"Texte brut Car";
mso-style-priority:99;
mso-style-link:"Texte brut";
font-family:"Calibri",sans-serif;
mso-fareast-language:FR;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">
I tried to sign some text data after issuing a ECDSA
prime239v1 certificate. The verification fails, here is the
following code:<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> Signature
ecdsaVerify = Signature.getInstance("SHA256withECDSA",
BouncyCastleProvider.PROVIDER_NAME);<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
ecdsaVerify.initVerify(certificate.getPublicKey());<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
ecdsaVerify.update(plaintext.getBytes("UTF-8"));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> boolean
isValidSignature =
ecdsaVerify.verify(Base64.decode(signatureAsString));<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">
The verification of my self-signed certificate with its own
private key fails in this part of BC code
(org.bouncycastle.crypto.signers.ECDSASigner):<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> ECCurve curve
= point.getCurve();<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> if (curve !=
null)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> {<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> BigInteger
cofactor = curve.getCofactor();<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> if
(cofactor != null && cofactor.compareTo(EIGHT) <=
0)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> {<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
ECFieldElement D =
getDenominator(curve.getCoordinateSystem(), point);<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> if (D
!= null && !D.isZero())<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> {<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
ECFieldElement X = point.getXCoord();<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
while (curve.isValidFieldElement(r))<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> {<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
ECFieldElement R = curve.fromBigInteger(r).multiply(D);<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
if (R.equals(X))<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
{<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
return true;<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
}<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
r = r.add(n);<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">
return false;<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">
The debug shows that in the inner while, we cannot find any
</span><span style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">ECFieldEleement</span><span
style="color:#1F497D" lang="EN-US">
</span><span style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">R
</span><span style="color:#1F497D" lang="EN-US">which is equal
to </span><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">X.
</span><span style="font-size:12.0pt;color:#1F497D"
lang="EN-US">As I havent any idea of what it means (I have
to work on mathematical basis of ECDSA) :D I need some help
:)<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"> The
offending certificate is (Base64 format):<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">-----BEGIN
CERTIFICATE-----<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">MIIBljCCAUGgAwIBAgISESE/0HMzJQ81M17SAVeO0cQmMAoGCCqGSM49BAMCMB0x<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">GzAZBgNVBAMMEkhTU1Rlc3RUb0JlUmVtb3ZlZDAgFw0xOTA5MDEwMDAwMDFaGA8y<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">MDU0MDkwMTAwMDAwMVowHTEbMBkGA1UEAwwSSFNTVGVzdFRvQmVSZW1vdmVkMFUw<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">EwYHKoZIzj0CAQYIKoZIzj0DAQQDPgAEFXHeoI+jd/GHUbdGk/K9BsNkpAMce9AF<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">DOzYcsoFYFnUyH5O7apm3jGu89b67m1htmzLC4I3AJPsSgUqo2MwYTAPBgNVHRMB<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">Af8EBTADAQH/MA4GA1UdDwEB/wQEAwIBNjAdBgNVHQ4EFgQURoQKwgEzI0rLbwHh<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">aykbLkF280QwHwYDVR0jBBgwFoAURoQKwgEzI0rLbwHhaykbLkF280QwCgYIKoZI<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">zj0EAwIDQwAwQAIefcAQYSSqCtoE1waIgQijyZZOC7b3DFub8KP/i4lYAh5ckkpU<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">cJgDR4UOjk/oa9PSc3I51q/Pv2T9PLoZdeI=<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Courier
New";color:#1F497D" lang="EN-US">-----END
CERTIFICATE-----</span><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"> Last,
obviously, when the keypair is generated in a soft way, by
BC, everything works fine.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US">Thanks
in advance for your ideas and answers<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US">Éric<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:12.0pt;color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="color:windowtext;mso-fareast-language:FR">De :</span></b><span
style="color:windowtext;mso-fareast-language:FR"> Eric
Tournier [<a class="moz-txt-link-freetext" href="mailto:[email protected]">mailto:[email protected]</a>]
<br>
<b>Envoyé :</b> vendredi 13 décembre 2019 09:47<br>
<b>À :</b> '<a class="moz-txt-link-abbreviated" href="mailto:dgh-rTAZ0PM/[email protected]">dgh-rTAZ0PM/[email protected]</a>'
<a class="moz-txt-link-rfc2396E" href="mailto:dgh-rTAZ0PM/[email protected]"><dgh-rTAZ0PM/[email protected]></a>;
<a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a><br>
<b>Objet :</b> RE: [dev-crypto] Prime239v1 self-signed
certificate cannot be verified<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Hi everybody<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> Thanks for
the answer, David<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">
In fact OpenSSL is the only one which seems to verify the
certificate without throwing an error, with the following:
<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:10.0pt;font-family:"Courier
New";color:#1F497D" lang="EN-US">#openssl verify
-CAfile prime239v1.cer prime239v1.cer</span><span
style="font-family:"Courier New";color:#1F497D"
lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">
As Im not an OpenSSL guru, I dont know if it is lying or
not. In fact both BC and SUN say that they cannot verify my
self-signed certificate with its own public key<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">
Ill try to sign something with the private key (which is in
our HSM) and then verifying it. Then I go back here with the
results<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US">Éric<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D" lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span
style="color:windowtext;mso-fareast-language:FR">De :</span></b><span
style="color:windowtext;mso-fareast-language:FR"> David
Hook [<a href="mailto:dgh-rTAZ0PM/[email protected]"
moz-do-not-send="true">mailto:dgh-rTAZ0PM/[email protected]</a>]
<br>
<b>Envoyé :</b> jeudi 12 décembre 2019 01:56<br>
<b>À :</b> <a href="mailto:[email protected]"
moz-do-not-send="true">[email protected]</a><br>
<b>Objet :</b> Re: [dev-crypto] Prime239v1 self-signed
certificate cannot be verified<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span
style="font-size:12.0pt;mso-fareast-language:FR"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal">It looks alright to me as well. How are
you verifying it in openSSL though? I've played around with
the openssl verify command and it seems I can get it to
print OK in a number of situations where I would not have
expected it. Something clearly is not right here. Have you
tried using java to sign a short message and then verify it?
That would at least tell us if it's the signature or the
certificate encoding that is the issue.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">David<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p><o:p> </o:p></p>
</div>
</blockquote>
<p><br>
</p>
</body>
</html>
--------------BD22A7564CDA28028C0712F0--