title: Verifying detached xml signatures generated using openssl
body: <p>I currently have been assigned the task to verify digital signatures generated using openssl , The files I recieve are basically two files one being the xml data and the other being the corresponding signature of that xml data , The key used to sign the data is RSA with an algorithm of SHA1 , the openssl command used is : openssl smime -sign -binary -in {datafile} -out {signaturefile} -outform der -inkey {privatekey} -signer {publickey}
  where {datafile} = The input file, in either CSV or XML format, containing the data to be signed {signaturefile} = The output file containing the digital signature only in PKCS#7 format, same filename as datafile but with .sig extension {privatekey} = The private key part of the key to be used for signing {publickey} = The public key part of the key to be used for signing , I have written a class to verify these files but the result always returns a false meaning the verification has failed. below is the code i have written: Could someone please help me on how to verify openssl detached signatures using java?</p>
  
  <pre><code>public PublicKey pubTest(String path) throws Exception
   {
       FileInputStream fin = new FileInputStream(path);
       CertificateFactory f = CertificateFactory.getInstance("X.509");
       X509Certificate certificate = (X509Certificate)f.generateCertificate(fin);
       PublicKey pk = certificate.getPublicKey();
       System.out.println(pk);
       return pk;
   }
   public byte[] signature(String sigPath) throws Exception
   {
       FileInputStream sigfis = new FileInputStream(sigPath);
       byte[] sigToVerify = new byte[sigfis.available()]; 
       sigfis.read(sigToVerify);
       sigfis.close();
       System.out.println(sigToVerify.length);
  
       return sigToVerify ;
   }
  
   public boolean verification(PublicKey pubKey , String dataPath , byte[] sigToVerify ) throws Exception, NoSuchProviderException ,SignatureException
  {
  
      Signature sig = Signature.getInstance("SHA1withRSA");
      sig.initVerify(pubKey);
      FileInputStream datafis = new FileInputStream(dataPath);
      BufferedInputStream bufin = new BufferedInputStream(datafis);
      byte[] buffer = new byte[1024];
      int len;
      while (bufin.available() != 0)
      {
          len = bufin.read(buffer);
        sig.update(buffer, 0, len);
      }
      System.out.println(buffer.length);
      bufin.close();
      boolean verifies = sig.verify(sigToVerify);
      System.out.println("signature verifies: " + verifies);
      return verifies ;
  }
  </code></pre>