title: Implementing RSA-SHA1 signature algorithm in Java (creating a private key for use with OAuth RSA-SHA1 signature)
body: <p>As you know, OAuth can support RSA-SHA1 Signature. I have an <code>OAuthSignature</code> interface that has the following method</p>
  
  <pre><code>public String sign(String data, String consumerSecret, String tokenSecret) throws GeneralSecurityException;
  </code></pre>
  
  <p>I successfully implemented and tested HMAC-SHA1 Signature (which OAuth Supports) as well as the PLAINTEXT "signature".</p>
  
  <p>I have searched google and I have to create a private key if I need to use <code>SHA1withRSA</code> signature: Sample code:</p>
  
  <pre><code>  /**
     * Signs the data with the given key and the provided algorithm.
     */
    private static byte[] sign(PrivateKey key,
                               String data)
        throws GeneralSecurityException {
  
      Signature signature = Signature.getInstance("SHA1withRSA");
      signature.initSign(key);
      signature.update(data.getBytes());
      return signature.sign();
    }
  </code></pre>
  
  <p>Now, How can I take the OAuth key (which is key = consumerSecret&amp;tokenSecret) and create a <code>PrivateKey</code> to use with <code>SHA1withRSA</code> signature?</p>
  
  <p>Thanks</p>
  
  <hr>
  
  <p>From <a href="http://oauth.net/core/1.0/#anchor19" rel="nofollow noreferrer"><strong>OAuth Core</strong></a> </p>
  
  <blockquote>
    <p>9.3.  RSA-SHA1</p>
    
    <p>The RSA-SHA1 signature method uses the
    RSASSA-PKCS1-v1_5 signature algorithm
    as defined in [RFC3447] (Jonsson, J.
    and B. Kaliski, “Public-Key
    Cryptography Standards (PKCS) #1: RSA
    Cryptography; Specifications Version
    2.1,” .) section 8.2 (more simply known as PKCS#1), using SHA-1 as the
    hash function for EMSA-PKCS1-v1_5. It
    is assumed that the Consumer has
    provided its RSA public key in a
    verified way to the Service Provider,
    in a manner which is beyond the scope
    of this specification.</p>
  </blockquote>
  
  <p>And I'm now using this (<a href="http://code.google.com/apis/gdata/docs/auth/oauth.html" rel="nofollow noreferrer">http://code.google.com/apis/gdata/docs/auth/oauth.html</a>) as a reference to doing RSA-SHA1 signature.</p>