title: Verify Digital Signature on Android
body: <p>I am developing an Android application that requires Digitally signing an html document.
  The document resides in the DB, in a JSON form.
  I'm signing the document locally using a BASH Script I found on some other SO question :</p>
  
  <p><code>openssl dgst -sha1 someHTMLDoc.html &gt; hash
  openssl rsautl -sign -inkey privateKey.pem -keyform PEM -in hash &gt; signature.bin</code></p>
  
  <p>Private key was generated using :</p>
  
  <pre><code>openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -pkeyopt rsa_keygen_pubexp:3 -out privateKey.pem 
  </code></pre>
  
  <p>Public key was generated using :</p>
  
  <pre><code>openssl pkey -in privateKey.pem -out publicKey.pem -pubout
  </code></pre>
  
  <p>I want to verify the signature created in Signature.bin together with the data in someHTMLDoc.html, back in the application.</p>
  
  <p>I am sending both the html and signature as JSON Object ex: </p>
  
  <pre><code>{ "data" : "&lt;html&gt;&lt;body&gt;&lt;/body&gt;&lt;/html&gt;", "signature":"6598 13a9 b12b 21a9 ..... " }
  </code></pre>
  
  <p>The android application holds the PublicKey in shared prefs as follows :</p>
  
  <p><code>-----BEGIN PUBLIC KEY-----
  MIIBIDANBgkqhkiG9w0AAAEFAAOCAQ0AvniCAKCAQEAvni/NSEX3Rhx91HkJl85
  \nx1noyYET ......</code></p>
  
  <blockquote>
    <p>Notice the <strong>"\n"</strong> (newline) in there (was automatically added when copying string from publicKey.pem to Android Gradle Config.</p>
  </blockquote>
  
  <p>Ok, after all preparations, now the question.
  I am trying to validate the key with no success.</p>
  
  <p>I am using the following code :</p>
  
  <pre><code>private boolean verifySignature(String data, String signature) {
      InputStream is = null;
      try {
          is = new ByteArrayInputStream(Config.getDogbarPublic().getBytes("UTF-8")); //Read DogBar Public key
  
          BufferedReader br = new BufferedReader(new InputStreamReader(is));
          List&lt;String&gt; lines = new ArrayList&lt;String&gt;();
          String line;
          while ((line = br.readLine()) != null)
              lines.add(line);
  
          // removes the first and last lines of the file (comments)
          if (lines.size() &gt; 1 &amp;&amp; lines.get(0).startsWith("-----") &amp;&amp; lines.get(lines.size() - 1).startsWith("-----")) {
              lines.remove(0);
              lines.remove(lines.size() - 1);
          }
  
          // concats the remaining lines to a single String
          StringBuilder sb = new StringBuilder();
          for (String aLine : lines)
              sb.append(aLine);
          String key = sb.toString();
  
          byte[] keyBytes = Base64.decode(key.getBytes("utf-8"), Base64.DEFAULT);
          X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
          KeyFactory keyFactory = KeyFactory.getInstance("RSA");
          PublicKey publicKey = keyFactory.generatePublic(spec);
  
          Signature signCheck = Signature.getInstance("SHA1withRSA"); //Instantiate signature checker object.
          signCheck.initVerify(publicKey);
          signCheck.update(data.getBytes());
          return signCheck.verify(signature.getBytes()); //verify signature with public key
      } catch (Exception e) {
          e.printStackTrace();
          return false;
      }
  }
  </code></pre>
  
  <p>Can anyone help ? what am i doing wrong ? </p>
  
  <p>Am i missing some byte conversion ? maybe the JSON object is affecting the signature ? </p>
  
  <p>Should a signature contain the <strong>\n</strong> (linebreak) that the original file contains or should it be without in the JSON file ?</p>
  
  <p>Thanks in advance for all the help, its highly appreciated.</p>