title: Error when verifying ECDSA signature in Java with BouncyCastle
body: <p>I have tested a solution to verify an ECDSA signature (<a href="https://stackoverflow.com/questions/26159149/how-can-i-get-a-publickey-object-from-ec-public-key-bytes/26159150#26159150">How can I get a PublicKey object from EC public key bytes?</a>) that works perfect with the given data.</p>
  
  <p>This is the data:</p>
  
  <pre><code>byte[] pubKey = DatatypeConverter.parseHexBinary("049a55ad1e210cd113457ccd3465b930c9e7ade5e760ef64b63142dad43a308ed08e2d85632e8ff0322d3c7fda14409eafdc4c5b8ee0882fe885c92e3789c36a7a");
  byte[] message = DatatypeConverter.parseHexBinary("54686973206973206a75737420736f6d6520706f696e746c6573732064756d6d7920737472696e672e205468616e6b7320616e7977617920666f722074616b696e67207468652074696d6520746f206465636f6465206974203b2d29");
  byte[] signature = DatatypeConverter.parseHexBinary("304402205fef461a4714a18a5ca6dce6d5ab8604f09f3899313a28ab430eb9860f8be9d602203c8d36446be85383af3f2e8630f40c4172543322b5e8973e03fff2309755e654");
  </code></pre>
  
  <p>And this is the code (which prints <em>true</em>):</p>
  
  <pre><code>private static boolean isValidSignature(byte[] pubKey, byte[] message,byte[] signature) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException, SignatureException, InvalidKeySpecException {
      Signature ecdsaVerify = Signature.getInstance("SHA256withECDSA", new BouncyCastleProvider());
      ecdsaVerify.initVerify(getPublicKeyFromBytes(pubKey));
      ecdsaVerify.update(message);
      return ecdsaVerify.verify(signature);
  }
  
  private static PublicKey getPublicKeyFromBytes(byte[] pubKey) throws NoSuchAlgorithmException, InvalidKeySpecException {
      ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec("prime256v1");
      KeyFactory kf = KeyFactory.getInstance("ECDSA", new BouncyCastleProvider());
      ECNamedCurveSpec params = new ECNamedCurveSpec("prime256v1", spec.getCurve(), spec.getG(), spec.getN());
      ECPoint point =  ECPointUtil.decodePoint(params.getCurve(), pubKey);
      ECPublicKeySpec pubKeySpec = new ECPublicKeySpec(point, params);
      ECPublicKey pk = (ECPublicKey) kf.generatePublic(pubKeySpec);
      return pk;
  }
  
  public static void main (String[] args) {
      System.out.println(isValidSignature(pubKey, message, signature));
  }
  </code></pre>
  
  <p><strong>My problem comes when I change the signature and data to an example input from an already implemented system:</strong></p>
  
  <pre><code>final static byte[] pubKey = DatatypeConverter.parseHexBinary("0447303876C6FED5550DF3EE1136989FCD87293D54A5D8E2F2F6D7FBE9A81089B889A5917443AF33E696178CEF4C9D6A4288B2745B29AF6C8BCAD1348F78EB9F9B");
  final static byte[] message = DatatypeConverter.parseHexBinary("02158001f53611a06e2d1a270000013ed9305dc2780524015110500000002d0100140092569202017aa00c5dd30000000000000000000000000000000007d1000001020001b20788b80059f48d95cdefc8c6000200200030d41e0000012016840310a50733a9870fffd0430100");
  final static byte[] signature = DatatypeConverter.parseHexBinary("531F8918FF250132959B01F7F56FDFD9E6CA3EC2144E12A6DA37C281489A3D96");
  </code></pre>
  
  <p>New data outputs this error:</p>
  
  <pre><code>java.security.SignatureException: error decoding signature bytes.
      at org.bouncycastle.jcajce.provider.asymmetric.util.DSABase.engineVerify(Unknown Source)
      at java.security.Signature$Delegate.engineVerify(Signature.java:1178)
      at java.security.Signature.verify(Signature.java:612)
      at its.sec.exec.TestProgram.isValidSignature(TestProgram.java:168)
      at its.sec.exec.TestProgram.execution(TestProgram.java:101)
      at its.sec.exec.TestProgram.main(TestProgram.java:55)
  </code></pre>
  
  <p>I assume the problem is about the signature that comes with the <em>secured message</em> because:</p>
  
  <ul>
  <li>The key pair is the same length and format that the example. And are correct since it comes from the certificate that signs the message.</li>
  <li>The message itself (payload) shouldn't affect the security process.</li>
  </ul>
  
  <p>Last thing worth mention is that my documentation says that the signature must be preceded by a field called "R" which <em>"contains the x coordinate of the elliptic curve point resulting from multiplying the generator element by the ephemeral private key"</em> and its length must be the same as the signature (32 byte).</p>
  
  <p>Can someone point me out what I'm missing here?</p>
  
  <p><strong>EDIT: Solution</strong></p>
  
  <p>As Peter Dettman pointed in his answer, the <code>signature</code> was not correctly formatted (also content was incorrect too) in order to be computed by the <code>verify()</code> method. <a href="https://crypto.stackexchange.com/questions/1795/how-can-i-convert-a-der-ecdsa-signature-to-asn-1">Here</a> is a good explanation that mainly says that:</p>
  
  <blockquote>
    <p>When encoded in DER, this (signature) becomes the following sequence of bytes:</p>
    
    <p><code>0x30 b1 0x02 b2 (vr) 0x02 b3 (vs)</code></p>
    
    <p>where:</p>
    
    <ul>
    <li>b1 is a single byte value, equal to the length, in bytes, of the remaining list of bytes (from the first 0x02 to the end of the encoding);</li>
    <li>b2 is a single byte value, equal to the length, in bytes, of (vr);</li>
    <li>b3 is a single byte value, equal to the length, in bytes, of (vs);</li>
    <li>(vr) is the signed big-endian encoding of the value "r", of minimal length;</li>
    <li>(vs) is the signed big-endian encoding of the value "s", of minimal length.</li>
    </ul>
  </blockquote>
  
  <p>Applying that change, <code>signature</code> grows to 70 bytes and the execution outputs no error.</p>