基于SpongyCastle从字节获取ECKey，Android特定私钥签名失败求助

Hey there! It’s super frustrating when a key works everywhere except the platform you need it on—let’s break this down and get your Android app signing correctly with that specific private key. Since it works in VB and PHP, the key itself is valid; the problem is almost certainly in how Android is parsing or using it.

Common Culprits & Fixes #

1. Private Key Format Mismatch (PKCS#1 vs PKCS#8) #

VB and PHP are often more forgiving about key formats, but Android’s KeyFactory expects PKCS#8 format by default for RSA private keys. If your key is in PKCS#1 format (starts with -----BEGIN RSA PRIVATE KEY----- instead of -----BEGIN PRIVATE KEY-----), Android will fail to parse it silently.

Fix: Convert the Key to PKCS#8

Use OpenSSL to convert your existing key:

openssl pkcs8 -topk8 -inform PEM -outform PEM -in your_private_key.pem -out pkcs8_key.pem -nocrypt

Then use this converted PKCS#8 key in your Android code.

2. Incorrect Signature Algorithm or String Encoding #

Your VB/PHP code might be using a different hash algorithm or string-to-byte encoding than your Android code. Mismatches here will produce invalid signatures even with the right key.

Verify These Details:

• Signature Algorithm: Check what VB/PHP uses. For example:
  • VB might use SHA1withRSA (via RSACryptoServiceProvider)
  • PHP’s openssl_sign might use OPENSSL_ALGO_SHA1 or OPENSSL_ALGO_SHA256
  • Make sure Android’s Signature.getInstance("<ALGORITHM>") matches exactly.
• String Encoding: VB might convert strings to bytes using System.Text.Encoding.UTF8 or even Default (system encoding), while Android defaults to UTF-8. Double-check that both sides use the same encoding when converting the input string to bytes.

3. Android Code Implementation Pitfalls #

Here’s a tested code snippet that handles PKCS#8 keys correctly, with configurable algorithm and encoding:

import android.util.Base64;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.Signature;
import java.security.spec.PKCS8EncodedKeySpec;

public String signInput(String inputString, String privateKeyPem) throws Exception {
    // Clean up the PEM key: remove headers, footers, and whitespace
    String cleanedKey = privateKeyPem
            .replace("-----BEGIN PRIVATE KEY-----", "")
            .replace("-----END PRIVATE KEY-----", "")
            .replaceAll("\\s", "");

    // Decode Base64 to get raw key bytes
    byte[] keyBytes = Base64.decode(cleanedKey, Base64.DEFAULT);

    // Initialize PKCS8 spec and generate private key
    PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
    KeyFactory keyFactory = KeyFactory.getInstance("RSA");
    PrivateKey privateKey = keyFactory.generatePrivate(keySpec);

    // Match the algorithm used in VB/PHP (e.g., SHA1withRSA, SHA256withRSA)
    Signature signature = Signature.getInstance("SHA1withRSA");
    signature.initSign(privateKey);

    // Use the same encoding as VB/PHP (e.g., "UTF-8" or "ISO-8859-1")
    signature.update(inputString.getBytes("UTF-8"));

    // Generate signature and encode to Base64
    byte[] signedBytes = signature.sign();
    return Base64.encodeToString(signedBytes, Base64.DEFAULT);
}

4. Debugging Tips #

• Compare Raw Signatures: Generate the signature in VB/PHP and Android, then print the raw byte arrays (or hex-encoded versions) to see if they match. If they don’t, the algorithm/encoding is the issue.
• Validate Key Parsing: Add logging to confirm the private key is loaded correctly. For example, check privateKey.getAlgorithm() returns "RSA" and privateKey.getFormat() returns "PKCS#8".

Final Checks #

• Ensure you’re not accidentally modifying the private key string when passing it to Android (e.g., trimming whitespace incorrectly or introducing encoding errors).
• If your key is password-protected, you’ll need to add code to decrypt it first (but you said it works in VB/PHP, so probably not password-locked).

Give these steps a try—odds are the format or algorithm mismatch is the root cause!

内容的提问来源于stack exchange，提问作者Amelia Donser