签名长度不正确：获得768，但在Java验证中预期为512

我已经发布了一个关于如何在java中加载RSA密钥的类似问题。查看问题的最佳答案，以完全理解我代码的第一部分（我的意思是getPulicKey方法）

方法verify（如下）引发以下异常

签名长度不正确：获得768，但在Java验证中预期为512

在下面的代码中，我对签名进行解码，因为我假设它是Base64，但我不确定，抱歉。我不知道我能否给你看签名和物品。签名是由1024位数字和数字组成的序列。它不以“=”结尾。我必须验证的对象是字符串格式的json对象。 下面是我编写的验证字符串对象的方法，该对象给定了一个符号和一个公钥。它调用上述方法getPublicKey（…）

编辑：

我的同事正在使用以下两种nodejs方法（verifySign和createSign）

在下面的nodejs代码（其中有工作伙伴的方法）中，我用“createSign”来编写消息“fake message”。标志如下：

5.5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-8-8-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-64.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBD4D3AA2CE49DC84B31907A50045456ACB57EDD1A896632969245D0F97FD88DACE7EB256099BBC4EEDF52B5D53B481DB829101D0089903EA9C3621BCDB763962B84AD57407623B576CC6A9C3328D85E07DD78565CD39A68A68D6F434DD3A68491AE655601A5B7BE7673AE0D3F9531FB213C0178ECB9067072AEF2767B577E677E677EECF457B577E677CF377B457B707B50B704ECB707CF070B704

然后，我用公钥pk验证它（见下文）

这是真的。但是，如果我传递给java方法，请验证以下（相同）参数：

object=“假消息”

符号=5.5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-8-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-5-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6-6 BFB4.一个中国非非B8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB8 8 8 8 8 8 8 8 8 8 8 8 AA2CE49DC84B31907A50045456ACB57EDD11A896632969245D0F97FD88DACE7EB256099BBC4EEDF52B5D53B481DB829101D0089903EA9C3621BCDB763962B84AD57407623B576CC6A9C3328D85E0F7DD78565CD39A68A68DD6F434DD3A68491AE655601A5B7BE7673AE0D3F9531FB213C0178ECB90672A11EF87EE77455E67707EF377B50B504E677E677CF377B457B50B707E677CF070B457B707B707E4760B707CF070B4B707B707E47B707B707B707B707E47B707B707B707B70

从pk复制的公钥（参见上面的节点代码）

java引发了异常：

签名长度不正确：获得768，但预期为512 签名长度不正确

---

您将签名视为base64编码，但它不是-它只是十六进制

1024个字符表示768个base64编码字节或512个十六进制编码字节

只要用十六进制而不是base64来解码就可以了

提示这是正确的，并注意签名的每个字符都是有效的十六进制数字（如果它实际上是base64，则极不可能）：

---

=

只是填充，Base64编码的数据不必以它结尾。那么，对象是否用与您使用的公钥对应的私钥签名？根据错误消息，它看起来不是这样的。@Polk我的同事告诉我该对象已用private签名key@JamesKPolk，对不起。我误解了你的评论。我现在会正确地回答。引发的异常与对象的结构无关。实际上，如果删除行“signature.update（…）”，将引发相同的异常。另一个线索是，正如我所说的，签名有1024个字符长，当我解码它时，它变成768字节长。768不可能是巧合。在RSA中，签名的长度总是与RSA密钥的长度相同（或稍短一点）（详细地说是RSA模）啊，我以为他只是将二进制显示为十六进制。你让我很高兴

private static PublicKey getPublicKey(String publicKey)
        throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
    try (PEMParser pp = new PEMParser(new StringReader(publicKey))) {
        SubjectPublicKeyInfo subjPubKeyInfo = (SubjectPublicKeyInfo) pp.readObject();
        RSAKeyParameters rsa = (RSAKeyParameters) PublicKeyFactory.createKey(subjPubKeyInfo);

        RSAPublicKeySpec rsaSpec = new RSAPublicKeySpec(rsa.getModulus(), rsa.getExponent());
        KeyFactory kf = KeyFactory.getInstance("RSA");
        PublicKey myKey = kf.generatePublic(rsaSpec);
        System.out.println(myKey);
        return myKey;
    }
}

public static boolean verify(String object, String sign, String publicKey) throws NoSuchAlgorithmException,
        InvalidKeySpecException, IOException, InvalidKeyException, SignatureException {
    //object to be verified
    //sign is the signature stored in the postgres DB
    //publicKey is the public key stored in the postgres DB
    Signature signature = Signature.getInstance("SHA256withRSA");
    signature.initVerify(getPublicKey(publicKey));
    byte[] objectBytes = Base64.getEncoder().encode(object.getBytes("utf-8"));
    signature.update(objectBytes);
    byte[] signBytes = Base64.getDecoder().decode(sign.getBytes("utf-8"));
    System.out.println(signBytes.length); //this line prints 768, with decode. 1024, otherwhise
    return signature.verify(signBytes);
}

const PASSPHRASE_KEY = "...";
const crypto = require('crypto');

const prk = "...";

const pk = "-----BEGIN RSA PUBLIC KEY-----\r\n" + 
            "MIICCgKCAgEA1ht0OqZpP7d/05373OE7pB7yCVGNGzkUEuCneyfOzps6iA03NbvI\r\n" + 
            "1ZL0Jpp/N3AW73lGdhaoa3X3JE4GsI/bsToVLQwTKmIOC4yjTvBctmFEoyhhTfxW\r\n" + 
            "s1UHZKl4XZ/7THbRlKHhRaTKyfDAbikkMAxNT/qutLAPjnN1qOwjb1oRq52NP6FJ\r\n" + 
            "KWTTikz4UeOHroX+Xthn2fJSJDlQ4YMdBbgrZVx5JcHKNuPTKRf5gI8QQKMSA9Q9\r\n" + 
            "QJRE5OGp7b6dG14ZmOUnUxb00Mp20LgcaGPcuWU+oFsbQaF6W4G4bdkSZRJJXhSg\r\n" + 
            "d4Q7mahpar94/gnztJmth0GzqTWUYyZIWNqIFoMwuOgeaiDV43zb3uLsRVpRKYYy\r\n" + 
            "esmzcOy/jTScVLRCD8QRyu9B2wgCkNAVztQOXPCOOa4O1LlVQWaecIs4WPhOqDhi\r\n" + 
            "KTBhyVkpC1TrrBkp+QMqMqWll1OyVb6k/7uV0qE/i6rHJtjo5v9bcIgYzswyx9CD\r\n" + 
            "9PKl2Q0L0Jg7TMG+yLDIrLfGeuSeEc4XYJzN7bJcCeiizzu5iU9dQUkrncOrq9jn\r\n" + 
            "Ub2pM/+A+JqIsoPK3IY/pJKqH4JYpGKhO1iPQF6iXIZT1r3ZgJUSQtzSeyYqhkla\r\n" + 
            "2uR2BsbPbDqebCuXm3lAsY5w+dujijcn96PKwYha1LsK5sACHuJ79AMCAwEAAQ==\r\n" + 
            "-----END RSA PUBLIC KEY-----\r\n" + 
            "";

function createSign(pvt_key, data_unsigned) {
    //Create a SHA256 sign generator
    const signer = crypto.createSign('SHA256');

    //Update context with data to sign
    signer.update(data_unsigned);

    //Sign the document based to user's private key
    return signer.sign({
        key: pvt_key,
        passphrase: PASSPHRASE_KEY
        },
        'hex'
    );
}

function verifySign(pub_key, signed_data, signature) {
  const verifier = crypto.createVerify('sha256');

  //Update context with data to verify
  verifier.update(signed_data);

  //Verify sign with user's public key
  const verified = verifier.verify(
    pub_key,
    signature,
    'hex'
  );

  //Send result
  return verified;
}

const phrase = "fake message";
var signMade = createSign(prk, phrase);
console.log("my signature: " + signMade);
//The signature is 5f188225c68dee2ce8de588dfaccb667710da94abb5388deabfe3ad83f7a94a72ee4a3c8c51be26c5b58cdec8c82cf8135c478ad609b7985496e201b23de6c5d03e93dcd9df7b5e2315efbfd2ff6496b0aea3b425bb99c912a16aeb5efb6cefc1e175c32aaf16af3a2baca5b54f974af0f14c853228bc06410e7ad1b2b0ecec19f5aed151389bd9ccebd5e998159d5205d81a7c7e37b502df3eb5229a5fd3492680576ebfa1e76b7c47fb757a9bfb18aa9ea0b71512ab9e1afc8e551ebf6d74a042bd447233953efbf374a3a6a210ead2019b8cc8548bb304979b4bfdc90dce644cb109bbddb75dda9df1322fd8e08ef1144e870324f34d4c826d9a4b64be0442aedc6f3d5f571d7336af212825c4e0216aa5eabab6218d685a3e73d81693149b45af5f1857c4a0e50b396d1a2ea5a3effafcc4e124fd23d0427abfe5509357936ef5e7c7ca4476d6a5ae7a26e9563923a03d0780f0d897039d4d3aa2ce49dc84b31907a50045456acb57edd11a896632969245d0f97fd88dace7eb256099bbc4eedf52b5d53b481b2aeb829101d0089903ea9c3621bcbd763962b84ad57407623b576cc6a9c3328d85e0f7dd78565cd39a6648a68dd6f4334dd3a68e48491ae655601a5c9be7673ae0d3f955431fb21f33c0178ecb9067072a6b1e360ee77a45f8e855e6c545276aefc7ae70b5c7e0f1ec0b66460575e3386f8a4bbf7fd3704
console.log("was it me to sign that?");
var res = verifySign(pk, phrase, signMade);
console.log(res);

return signer.sign({
    key: pvt_key,
    passphrase: PASSPHRASE_KEY
    },
    'hex' // Note this use of 'hex'...
);