Digital Signature Implementation in Java

From OWASP
Revision as of 01:54, 15 December 2006 by Joekumar@gmail.com (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Overview

This article would give a brief overview of the concepts involved with Digital Signature and provide code sample for implementing Digital Signature in Java using the Java Cryptography Architecture

What is a Digital Signature ?

Digital Signature is a construct which helps achieve non-repudiation of Origin (ie. Origin Integrity) of data. By digitally signing the document, the person who signs it assures that he is the author of the document or the message that was signed.

Need for Digital Signature

During the "E" revolution, there was a need for authenticating critical transactions especially in the financial World. If Alice has agreed to transfer $x to Bob, then there had to be a way for Bob to be sure that

        1. It was Alice who agreed for the transaction and not someone else impersonating Alice (Authentication)
        2. The amount agreed by Alice is $x (Integrity)
        3. Alice could not dispute her statement of transacting $x to Bob (Non-Repudiation of Origin)

These concerns were addressed with a solution known as Digital Signature. To know more about Digital Signatures you can read Digital Signature article on Wikipedia.

Digital Signatures in Java using JCA

The Java Cryptography Architecture is a framework for accessing and developing cryptographic functionality for the Java platform. A JCA provider implements the cryptographic functionalities like Digital Signature and Message Digest. The default JCA provider in JDK 1.4.2 is SUN