Signature verification checks whether a digital signature matches specific data and the corresponding public key. A successful match shows that the data was signed by the holder of the private key and has not changed. In a login flow, the server verifies a signed random challenge before granting access. section 15.2 section 6.4
A secure verification flow keeps the trust boundary clear:
- Generate a fresh random challenge or prepare the exact data that must be authenticated. section 15.2 section 15.3
- Have the authenticator or sending service sign that data with its private key; the private key remains undisclosed. section 15.2 section 6.4
- Retrieve the public key registered for the credential or service, then verify the signature against the original data. section 15.2 section 15.3
- Reject the request when verification fails; do not authenticate the user or decrypt the protected content. section 15.3 section 6.4
Java RSA verification
A payment service can verify signed warehouse data before decrypting it. With Java's Signature API, select SHA256withRSA, initialize verification with the registered public key, update it with the received data, and call verify(signature). A false result must stop processing. Keep encryption keys separate from signing keys: encryption uses a public/private pair for confidentiality, while signing uses another pair for authenticity. section 6.4
Figure 15.3 The authentication process using a hardware key. The app generates a random value and asks the key to sign it with its private key. The app verifies the signature using its public key. The public key from the pair must already be configured at the app level. This configuration happens during the registration step.
Follow the hardware-key sequence from registration through challenge generation, private-key signing, and public-key verification. section 15.2
