签名后获取签名数据
当我研究 Java 中的签名文件时，我经常读到您对文件进行哈希处理并将哈希值附加到实际文件，进行加密，然后将其发送到（例如）服务器。在服务器中，您解密文件，获取文件，创建它的哈希值，如果新哈希值等于客户端的哈希值，则该文件实际上是客户端的文件。
但现在我必须在我的项目中实现它，我只能找到使用 java.security.Signature （就像这个），在这些示例中，他们对文件进行签名，然后将文件和签名的文件发送到验证，而不是仅发送签名的文件。
这是正确的实施方法吗？如果没有，最好的方法是什么？请给一些指示。
Well when I studied signature files in Java, I aways read that you hash your file and attach the hash to the actual file, do the encryption, and send it to (for example) the server. In the server you decrypt the file, get the file, create a hash of it and if it's new hash is equals the client's hash, the file is really the client one's.
BUT now that I have to implement it in my project, I can only find examples using java.security.Signature (like this one), and in these examples, they sign the file, and then send the file and the signed file to the verification instead of only sending the signed file.
Is this the correct way of implementing it? If not, what is the best way? Please give some directions.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您发布的链接仅显示了一个示例，其中代码的后半部分调用
public static boolean verifySig(byte[] data, PublicKey key, byte[] sig)只是验证创建签名的代码的前半部分。这个想法是，在
signer.initVerify(key);中，您传递签名者的公钥，然后对您<的数据调用signer.update(data);强>认为签名是基于的，然后调用验证将签名传递给它。如果您传入的签名对于您认为签名所依据的数据有效，则验证成功。
The link you posted just shows an example, where the second half of the code calling
public static boolean verifySig(byte[] data, PublicKey key, byte[] sig)is just validating the first half of the code that created the signature.The idea is that in the
signer.initVerify(key);you pass the public key of the signer, then callsigner.update(data);on the data you think the signature is based on, and then call verify passing it the signature.If the signature you passed in, is valid for the data that you think the signature is based on, then the verification is succesfull.
加密文件和签名之间没有任何联系。您可以独立完成其中一项或两项。
要签名，您需要计算哈希值，使用私钥加密哈希值，然后将加密的哈希值与文档（文件）一起发送。
为了进行验证，您需要计算收到的文档的哈希值，使用公钥解密加密的哈希值，然后比较两者。如果哈希值匹配，则签名得到验证。
由于验证使用公钥，因此任何人都可以验证签名。但只有拥有私钥的人（或实体）才能对其进行签名。因此它证明了该文件的来源。
除此之外，如果您愿意，您可以加密该文件。您可以在加密之前或之后对文件进行签名。这完全取决于您想用它做什么以及您想保持它的安全性。例如，SSL 证书未加密，因为浏览器必须检查其内容及其签名。
There is no connection between encrypting the file and signing it. You can do either or both independently.
To sign, you calculate the hash, encrypt the hash using the private key, and send the encrypted hash along with the document (file).
To verify, you calculate the hash of the document you received, decrypt the encrypted hash using the public key, and compare the two. If the hashes match, the signature is verified.
Since verification uses the public key, anyone can verify a signature. But only the person (or entity) with the private key can sign it. And so it proves the origin of the document.
In addition to that, if you so wish, you can encrypt the file. You can sign the file before or after the encryption. It all depends on what you want to do with it and how secure you want to keep it. For example, SSL certificates are not encrypted, because the browser has to check their content as well as their signatures.