To verify the signature, you must first extract the algorithm identifier from the signature and then construct the public key. Due to the proprietary algorithm identifier format, Phaos signatures are best verified by the Phaos API at the receiving end:
Listing 11. Phaos DSA signature verification in CryptoEngine
public boolean DSAVerify (byte [] mesg, byte [] sig)
throws Exception {
InputStream is = new ByteArrayInputStream(sig);
AlgorithmIdentifier algID = new AlgorithmIdentifier(is);
PooledArray sigBytes = ByteArrayPool.getArray(is.available());
is.read(sigBytes.buffer, 0, sigBytes.length);
is.close();
DSAPublicKey DSApubKey = new DSAPublicKey(algID,
new ByteArrayInputStream(DSApubKeyDer));
Signature signature =
Signature.getInstance(AlgIDList.SHA1_WITH_DSA,
DSApubKey);
return signature.verify(mesg, 0, mesg.length,
sigBytes.buffer, 0, sigBytes.length);
}
NTRU Neo for Java
As I have mentioned, NTRU Neo for Java probably has the simplest API due to its single algorithm nature. To use any methods in the Neo for Java package, you must first generate a secure random context:
Listing 12. Neo for Java secure context
private RandomNumber rn;
private Context ctx;
public CryptoEngine () {
try {
rn = new RandomNumber(NTRUConst.NTRU_SHA1_HASH);
ctx = new Context(rn);
... ...
}
Generating an NTRU key pair for digital signature takes only one line of code. The following code generates an NTRU 251-bit signing key, which has cryptographic strength equivalent to a 1,024-bit RSA key:
Listing 13. NTRU signature key generation in CryptoEngine
public void generateNTRUsgnKeys () throws Exception {
NTRUsgnKeys = new SgnKeys(ctx, NTRUConst.NTRU_KEYSTRENGTH_251,
NTRUConst.NTRU_SHA1_HASH);
return;
}
Complete key serialization by calling the appropriate export methods:
Listing 14. NTRU signature key serialization in keygensrc/GenerateAllKeys.java
byte [] pubKey = NTRUsgnKeys.exportPubKey(null, 0);
out = new FileOutputStream(outdir + "SgnPubKey.dat");
out.write(pubKey);
out.flush();
out.close();
byte [] privKey = NTRUsgnKeys.exportPrivKey(null, 0);
out = new FileOutputStream(outdir + "SgnPrivKey.dat");
out.write(privKey);
out.flush();
out.close();
Reconstructing serialized keys is also simple:
Listing 15. Reconstruct NTRU signature key pair in CryptoEngine constructor
is = c.getResourceAsStream("/keys/SgnPubKey.dat");
byte [] sgnPubKeyData = readFromStream(is);
is.close();
is = c.getResourceAsStream("/keys/SgnPrivKey.dat");
byte [] sgnPrivKeyData = readFromStream(is);
is.close();
NTRUsgnKeys = new SgnKeys (sgnPubKeyData, 0, sgnPubKeyData.length,
sgnPrivKeyData, 0, sgnPrivKeyData.length);
Now, we generate the signature:
Listing 16. Generate NTRU signature in CryptoEngine
public byte [] NTRUSign (byte [] message) throws Exception {
if ( NTRUsgnKeys == null )
throw new Exception("Generate NTRU encryption keys first!");
MessageDigest dig = new MessageDigest(NTRUConst.NTRU_SHA160_HASH);
Signature sig = new Signature(NTRUConst.NTRU_KEYSTRENGTH_251,
NTRUConst.NTRU_SHA160_HASH);
dig.updateMessageDigest(message, 0, message.length);
dig.completeMessageDigest();
sig.sign(ctx, NTRUsgnKeys, dig);
return sig.export();
}
The receiving party must verify the signature using the NTRU algorithm:
Listing 17. Verify NTRU signature in CryptoEngine
public boolean NTRUVerify (byte [] message, byte [] sigData)
throws Exception {
Signature sig = new Signature(sigData, 0, sigData.length);
MessageDigest dig = new MessageDigest(sig.getHashAlg());
dig.updateMessageDigest(message, 0, message.length);
dig.completeMessageDigest();
try {
sig.verify(ctx, NTRUsgnKeys, dig);
return true;
} catch (NTRUException e) {
return false;
}
}
Secure your mobile data
Advanced mobile commerce applications require content-based and single sign-on security solutions that protect both communication and on-device data. Today's popular HTTPS solution does not meet those requirements due to its point-to-point nature, inflexible protocol design, and slow algorithms.
Third-party vendors have come up with excellent security tools that will meet those future mobile commerce requirements. Those toolkits give developers programmatic access to cryptographic algorithms, especially algorithms specially designed for mobile applications. I encourage you to try those tools and better safeguard your crucial mobile data!
