Java Security, 2nd Edition

The Signature Class

When you handle digital signatures programatically, you perform two operations on them. You create them by taking a piece of data, creating a message digest of the data, and signing the message digest with a private key. The digitally signed data is then transmitted to someone else, who must verify the digital signature by creating a message digest of the data and verifying the signed digest using a public key. All of these operations are embodied within the Signature class (java.security.Signature):

public abstract class Signature extends SignatureSpi

Provide an engine to create and verify digital signatures.

The Sun security providers include implementations of this class that generate signatures based on the DSA and RSA algorithms.

Using the Signature Class

As with all engine classes, instances of the Signature class are obtained by calling one of these methods:

public static Signature getInstance(String algorithm)public static Signature getInstance(String algorithm, String provider)

Generate a signature object that implements the given algorithm, optionally using the named provider. If an implementation of the given algorithm is not found, a NoSuchAlgorithmException is thrown. If the named security provider cannot be found, a NoSuchProviderException is thrown.

If the algorithm string is “DSA”, the string “SHA/DSA” is substituted for it. Hence, implementors of this class that provide support for DSA signing must register themselves appropriately (that is, with ...